text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Digital & Data Officer (CDDO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CDDO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.


text: In the three-year period ended March 31, 2025, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior cybersecurity incidents experienced by either us or third parties, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.

companyName: DECKERS OUTDOOR CORP

ticker: DECK

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: CYBERSECURITY GOVERNANCE Our Board has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CDDO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.

stage1Category: Board Governance


text: Our CDDO and CISO have extensive experience in cybersecurity. Our CDDO has served in his role since September 2024. He has over 15 years of experience in digital transformations, enterprise technology, artificial intelligence, and data management. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.

stage1Category: Management Role


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. We maintain a robust cybersecurity infrastructure to safeguard our operations, networks, and data through comprehensive security measures including our technology tools, internal management, and external service providers.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY

stage1Category: Risk Management Process


text: Our Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 14 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 28 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information System Security Professional ("CISSP") certifications.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management, including information technology and cybersecurity. The Audit Committee routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends, and regulatory developments from the CIO.


text: We use a risk-based approach to identify, assess, protect, detect, respond to, and recover from cybersecurity threats, utilizing industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework, internal controls, and robust technological toolsets. Our information security program includes, among other aspects, penetration and vulnerability assessments and management, intrusion detection systems, antivirus and malware protection, encryption, access control, high availability and redundancy, and employee training. Risks identified by the CIO and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The CIO also routinely discusses trends in cyber risks and our strategy with our Audit Committee and management on a regular basis, in addition to an annual review and discussion with the full board.

stage1Method: majority


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any incidents from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our Chief Information Officer (" CIO ") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 15 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 29 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information Systems Security Professional ("CISSP") certifications.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. Such processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Oversight of Cybersecurity Risks by the Board of Directors and Management PPL's Board of Directors oversees the Registrants' management of cybersecurity risk through various processes identified below.

companyName: PPL ELECTRIC UTILITIES CORP


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training. Our teams evaluate the risk profile of third-party service providers, considering key risk factors such as cybersecurity measures, data privacy policies, and regulatory compliance. We maintain communication channels with key third-party service providers to assess and respond to potential impacts of incidents within a service provider's organization. We rely on our third parties to communicate such incidents to us in a timely manner. Beyond cybersecurity assessments, our teams conduct a structured due diligence process as part of our vendor compliance program for third-party providers that meet specific criteria set by us. We use third-party risk management services to evaluate additional risk factors, including but not limited to past or pending litigation, criminal history, derogatory information, and financial stability.

stage1Category: Third-Party Risk


text: The purpose of the Cybersecurity Steering Committee is to oversee our compliance with reasonable and appropriate organizational, physical, administrative and technical measures designed to protect the confidentiality, integrity, availability, security and operations of our information technology systems, transactions, and data owned by us, by providing guidance and oversight of our information technology and cybersecurity program.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: We engage external parties to supplement our internal capabilities and to assess our cyber maturity and readiness on a periodic basis. This includes being party to a managed services agreement with an external party for incident response; engaging an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery; and engaging additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives. While utilizing third-party service providers presents risk, we assess all third-party service providers for their qualifications before engaging them and monitor such providers throughout the term of the engagement in order to help protect us from any additional vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors ("Audit Committee") provides direct oversight over cybersecurity risk and acts in an advisory capacity to our management team, primarily, as it relates to cybersecurity, our Chief Information Officer ("CIO"), and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles.


text: In an effort to deter and detect cyber threats, we provide key employees, with various cybersecurity trainings that cover timely and relevant topics, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have specific processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. These processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. The processes are updated as needed on an annual basis.


text: Based on an assessment using the previously described cybersecurity risk management processes, we do not believe that there are currently any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: The Cybersecurity Steering Committee generally meets on a quarterly basis and receives reports from the CISO and CIO of our cybersecurity and information security risk management and strategies, covering topics such as data security posture, results from third-party assessments, progress towards key initiatives, our incident response plan, and cybersecurity threat risks, incidents and developments. The Cybersecurity Steering Committee generally delivers reports and updates to the Audit Committee once a quarter.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles. Our CIO is supported by a dedicated team of cybersecurity professionals in addition to managed services and retained external experts.


text: In an effort to deter and detect cyber threats, we provide key employees with various cybersecurity trainings that cover a range of timely and relevant topics. The trainings function to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks to our Company associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader enterprise risk management program process, covering other Company risks. As part of this process our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material information security breach incidents and the expenses we have incurred from information security breach incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risk. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 9 years of experience in cybersecurity and information technology risk managing, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our CISO and CIO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as vulnerability assessments, penetration testing, and tabletop exercises.


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risks. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The purpose of the Cybersecurity Steering Committee is to oversee our compliance with reasonable and appropriate organizational, physical, administrative and technical measures designed to protect the confidentiality, integrity, availability, security and operations of our information technology systems, transactions, and data owned by us, by providing guidance and oversight of our information technology and cybersecurity program.


text: The Cybersecurity Steering Committee generally meets on a quarterly basis and receives reports from the CISO and CIO of our cybersecurity and information security risk management and strategies, covering topics such as data security posture, results from third-party assessments, progress towards key initiatives, our incident response plan, and cybersecurity threat risks, incidents and developments. The Cybersecurity Steering Committee generally delivers reports and updates to the Audit Committee once a quarter.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity-related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 10 years of experience in cybersecurity and information technology risk management, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategies and implementing effective information and cybersecurity programs.


text: Cyber Risk Management and Strategy The Company, under the oversight of the Audit Committee of its Board of Directors, has implemented and maintains a cybersecurity risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This program extends to third-party vendors and the various properties under the Company's management, including corporate and commercial properties, through establishing vendor risk requirements and conducting vendor risk assessments.

companyName: MACERICH CO

ticker: MAC


text: This risk management program addresses, but is not limited to, risks identified by external auditors and assessors, internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. An internal audit team at the Company manages and maintains remediation strategies for identified risks, and reports on them regularly to senior leadership. As part of the Company's cyber risk management program, the Company has engaged external independent assessors to conduct cyber risk assessments, evaluate cyber risk management controls, and report both findings and recommendations to management.


text: The Company, like other companies in its industry, faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date, the Company has, from time to time, experienced threats to and security incidents related to its data and systems. For more information about the cybersecurity risks the Company faces, see Item 1A. Risk Factors.

stage1Category: None/Other


text: Additionally, the Company is subject to the requirements of the Sarbanes-Oxley Act of 2002 and information technology general controls are an important part of the Company's internal control over financial reporting and are subject to controls testing. Control deficiencies that represent cybersecurity risks would be reported by management to the Audit Committee.


text: Governance Related to Cybersecurity Risks The Company's cyber risk management program and related operations and processes are directed by the Senior Vice President of Information Technology (the "SVP-IT"). Currently, the SVP-IT role is held by an individual who has over twenty five years of cybersecurity, information technology and systems engineering experience. The SVP-IT meets with the Chief Financial Officer and Chief Legal Officer quarterly to monitor and review the outcomes of the Company's cybersecurity risk management processes and to discuss and decide matters related to cybersecurity risk treatment strategy (including mitigations).


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.


text: The Company's Board of Directors plays an important role in risk oversight and discharges its duties both as a full board and through its committees. The Board has delegated oversight of risk management matters, including cybersecurity and information technology matters, to its Audit Committee. As reflected in the Audit Committee charter, the committee is responsible for reviewing information technology, cybersecurity and other data protection strategies and plans, as well as assessing incident response protocols. The Security Committee provides quarterly reports to the Audit Committee and the SVP-IT attends board meetings yearly, or more frequently as appropriate, to inform the Company's Board of Directors on cybersecurity risks.


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, property management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software, and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.

companyName: GUESS INC

ticker: GES


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cyber security awareness training annually.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factors under the heading "Risks Related to Data Privacy and Cybersecurity" in Part I, Item 1A of this Report for additional information about the risks we face associated with cybersecurity threats.


text: The Chief Information Security Officer (CISO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 with knowledge of both operations and governance. In his previous position as Chief Technology Officer for an international managed security service provider, he worked as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide management level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The CISO provides quarterly updates on the information security program to the Audit Committee and more frequently as circumstances require.


text: Risk Management and Strategy We have developed and integrated into our overall risk management program an information security program that is designed to address material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. A cybersecurity risk assessment, based on an internationally recognized methodology, is conducted annually.


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, we have used third parties to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cybersecurity awareness training annually.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "—Risks Related to Data Privacy and Cybersecurity" in "Item 1A. Risk Factors" of this Annual Report for additional information about the risks we face associated with cybersecurity threats.


text: The Chief Information Security Officer ("CISO") is the management position with primary responsibility for the development, operation, and maintenance of our information security program, which includes cybersecurity. Our CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 and ISO 22301 with knowledge of both operations and governance. He previously served as Chief Technology Officer for an international managed security service provider, during which time he served as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide a management-level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The Audit Committee is informed of cybersecurity-related risks through the CISO providing quarterly updates on the information security program and more frequently as circumstances require.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its annual cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessment, penetration testing, or ethical hacking; and to audit and provide advice on how to make its security operations and controls more effective.


text: Furthermore, the Company utilizes third-party service providers to perform a variety of functions to assist in operating the business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided, the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents. While prior incidents have not had a material effect on the Company's business, there can be no guarantee that the Company will not experience a future incident that does have a material effect on its business. See "Risk Factors - Risks Related to Information Technology - The Company's business and financial performance may be adversely affected by cybersecurity attacks, information systems interruptions, equipment failures, and technology integration" for more information on the Company's cybersecurity risks.


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Senior leadership, including the Chief Digital Information Officer, updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit and Risk Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of internal audit, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber incidents, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001:2013 standard to ensure the consistent application of security principles, policy statements, and controls. In adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data by partnering with reputable, recognized security firms, and conducting ongoing internal and external information security audits, risk assessments, anti-phishing campaigns, penetration testing exercises, systems monitoring activities, employee training, and cyber incident response exercises. Our policies include standards and procedures for vulnerability management, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, mobile device management and system monitoring. SUN COMMUNITIES, INC.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.


text: To manage vendor risk, we conduct ongoing risk assessments based on the vendor's published Systems and Operational Controls ("SOC") reports, information provided in vendor security questionnaires, and any publicly available information including ongoing litigation or external disclosures.


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.


text: Senior leadership provides the Board of Directors with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, third-party audit reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Audit Committee of the Board of Directors provides oversight and is responsible for assessing risks to our business, in accordance with its charter. The Audit Committee engages in regular conversations with senior leadership about our security systems in order to monitor and mitigate risks from cybersecurity incidents, in accordance with our security principles and protocols.


text: The Senior Vice President of Information Technology and the Director of Information Security bear direct responsibility for daily management of cyber risk. Oversight from the executive team, led by the Chief Administrative Officer, ensures strategic alignment. With a wealth of executive leadership spanning over 20 years in both public and private sectors, these individuals collectively possess more than 75 years of invaluable experience in information technology and security.


text: The Information Security Management Committee (ISMC) and Enterprise Risk Management Committees (ERM) meet regularly to provide oversight of cyber risk management functions. Committee composition includes members from cross-functional departments, including technology, innovation, human resources, accounting and finance, internal audit, operations and executive management. Various members of these committees hold industry certifications representing expertise in information security risk and compliance management, including the Certified Information Technology Professional (CITP), Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), and Certified in Risk and Information Systems Control (CRISC) designations. SUN COMMUNITIES, INC.


text: Our business operations rely on the consistent availability of our communication platforms, enterprise applications, and related systems. We have implemented protocols to ensure the secure collection, storage, and transmission of data and have invested in the development and enhancement of controls designed to prevent, detect, and respond to unauthorized access, computer viruses, malware, data exfiltration, and other threats.


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001 standard to ensure the consistent application of security principles, policy statements and controls. By adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data through the following actions: • Partnering with reputable, recognized security firms • Conducting regular internal and external audits and risk assessments • Providing ongoing employee security awareness training • Conducting tabletop exercises • Running anti-phishing campaigns and simulated phishing exercise • Deploying tools for continuous vulnerability monitoring • Performing penetration testing and continuous system monitoring activities • Conducting recovery simulations for core systems and data centers Our comprehensive policies and procedures address critical areas including: • Vulnerability management • Business continuity planning • Encryption of sensitive data • Backup and recovery SUN COMMUNITIES, INC.


text: Our Chief Information Security Officer also provides quarterly briefings to the Cyber Risk Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents of interest and related responses, cybersecurity systems testing, applicable activities of third parties, and the like. Our Cyber Risk Committee provides regular updates to the board of directors on such reports.

companyName: RAMBUS INC

ticker: RMBS


text: • Physical security • User access controls • Vendor risk management • Teleworking protocols • Mobile device management • Comprehensive system monitoring These initiatives collectively reinforce our commitment to safeguarding information and ensuring the resilience of our security infrastructure. Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.


text: The Chief Information Officer (CIO) and the Director of Information Security are directly responsible for managing cyber risk on a daily basis. The CIO reports to the Chief Administrative Officer (CAO), who oversees the Company's overall information technology strategy and governance. Executive oversight, spearheaded by the CAO, ensures strategic alignment across the organization. With a wealth of leadership in both public and private sectors, these individuals collectively possess years of invaluable experience in information technology and security.


text: Cybersecurity Risk Management and Strategy Cybersecurity risk oversight and management is a top priority for the Company and the Board of Directors. The Company offers a broad portfolio of industrial cybersecurity solutions to its customers, and an understanding of cybersecurity risks is critical to both the Company internally and to our customers and business partners. The Company identifies, assesses, and manages cybersecurity risk as part of both the enterprise cybersecurity program and the enterprise risk management program. The Company's expertise, dedicated resources and proven technology in cybersecurity management are evident in the Company's enterprise cybersecurity program. The Company's Cybersecurity Committee (described below) is a subcommittee of and reports to the Audit Committee, which oversees the enterprise risk management program.

companyName: BELDEN INC.

ticker: BDC


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including: •24/7 Security Operations Center,


text: • advanced endpoint detection/response, • user behavior analytics, • vulnerability identification/patching, • email threat prevention, • data loss prevention, • privileged access management, and • ongoing/annual phishing training / testing.


text: To ensure the Company is addressing constant changes in the threat landscape, management and the Board of Directors continue to advance their cybersecurity knowledge and stay current with evolving information, regulations and industry practices through our memberships and affiliations with industry leading companies such as Crowdstrike, IBM, and Palo Alto Networks, as well as national organizations such as the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and others. In addition, to supplement our efforts, expert consultants and third-party vendors are engaged from time to time to assess enterprise security posture, identify operational technology vulnerabilities, and assess software product security. In addition to these assessments, the Company engages third-party vendors to perform enterprise-wide attack and penetration tests. Findings from these activities are reported to senior management and the Belden Board of Directors.


text: The Company recognizes the importance of identifying and managing material cybersecurity risks associated with our use of third-party service providers. To address these third-party risks, the Company has developed a program to assess both new and existing vendors and suppliers that are expected to have access to or otherwise influence Belden's internal network or internal data. Components of this program include customed vendor security assessments, security architecture review, and third-party rating services. We perform cybersecurity due diligence through this program as appropriate in connection with the on-boarding of a third-party relationship and conduct periodic reviews based on the inherent risk profile of the particular provider.


text: Impact of Cybersecurity Risks on Strategy and Results Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company believes that they are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The Company experienced a cybersecurity breach in 2020. The Company determined the impact of this incident was not material, but enhanced its cybersecurity controls and processes in response to the incident. The Company has taken reasonable measures to protect against future compromise, and believes these measures will protect against material adverse impact, including its business strategy, results of operations or financial condition.


text: Cybersecurity Governance In 2018, in recognition of the unique nature of cybersecurity threats and the desire to apply focused oversight of cybersecurity risk, the Company's Board of Directors formed a Cybersecurity Subcommittee (the "Subcommittee") providing oversight of the Company's cybersecurity posture and reporting to the Board's Audit Committee. The Subcommittee consists of three independent directors with experience and/or expertise in cybersecurity management and oversight. The Subcommittee meets regularly on at least a quarterly basis. The Subcommittee has full access to management and consultants engaged by management and receives regular reporting directly from the Company's chief information officer, head of cybersecurity, internal audit and the legal function, as well as third-party assessments of the Company's cybersecurity processes. In addition, the full Board of Directors receives a report on cybersecurity annually, or as necessary.


text: The Company's cybersecurity program is managed by a dedicated vice president of cybersecurity, who reports directly to Belden's chief information officer and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The chief information officer reports directly to the Company's chief financial officer and has access to other members of senior management, including Belden's chief executive officer, as appropriate. Belden's vice president of cybersecurity has over 30 years of IT experience, including twelve years of cybersecurity experience. Belden's chief information officer has over 35 years of IT experience, a BS in Computer Science and an MBA.


text: The Company's policies and procedures described above are designed to ensure that the Company's vice president of cybersecurity and chief information officer and other necessary members of any cybersecurity response team are appropriately informed of any cybersecurity matters and the status of our ongoing processes. The Company's vice president of cybersecurity and chief information officer jointly provide periodic reports to the Subcommittee, the Company's CEO and CFO, and other members of management. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The Company's program is regularly evaluated internally and externally and updates are presented to senior management and the Subcommittee. The Company also actively engages with key vendors, industry participants, and knowledge leaders as part of the Company's continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.


text: Cybersecurity Risk Management and Strategy Cybersecurity risk oversight and management is a top priority for the Company and the Board of Directors. The Company offers a broad portfolio of cybersecurity solutions to its customers, and an understanding of cybersecurity risks is critical to both the Company internally and to our customers and business partners. The Company identifies, assesses, and manages cybersecurity risk as part of both the enterprise cybersecurity program and the enterprise risk management program. The Company's expertise, dedicated resources and proven technology in cybersecurity management are evident in the Company's enterprise cybersecurity program. The Company's Cybersecurity Committee (described below) is a subcommittee of and reports to the Audit Committee, which oversees the enterprise risk management program.


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including:


text: •24/7 Security Operations Center, • advanced endpoint detection and response, • user behavior analytics, • vulnerability identification and patching, • email threat prevention, • data loss prevention, • identity and privileged access management, and • ongoing phishing training and testing.


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company, and the effectiveness of the Company's cybersecurity program to the RMC. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Impact of Cybersecurity Risks on Strategy and Results Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company believes that they are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The Company determined the impact of a past incident was not material, but enhanced its cybersecurity controls and processes in response to the incident. The Company has taken reasonable measures to protect against future compromise, and believes these measures will protect against material adverse impact, including its business strategy, results of operations or financial condition.


text: Cybersecurity Governance In 2018, in recognition of the unique nature of cybersecurity threats and the desire to apply focused oversight of cybersecurity risk, the Company's Board of Directors formed a Cybersecurity Subcommittee (the "Subcommittee") providing oversight of the Company's cybersecurity posture and reporting to the Board's Audit Committee. The Subcommittee consists of three independent directors with experience and/or expertise in cybersecurity management and oversight. The Subcommittee meets regularly on at least a quarterly basis. The Subcommittee has full access to management and consultants engaged by management and receives regular reporting directly from the Company's chief information officer, head of cybersecurity, internal audit and the legal function, as well as third-party assessments of the Company's cybersecurity processes and posture. In addition, the full Board of Directors receives a report on cybersecurity annually, or as necessary.


text: INFORMATION TECHNOLOGY AND CYBERSECURITY Our business and support functions utilize information systems that provide critical services to both our employees and our customers. We have an integrated team of professionals who manage and support our communication platforms, transaction-management systems, and analytics and reporting capabilities, including the development of proprietary solutions like REMS. We use both cloud-based platforms and services and off-site, secure data centers in North America and Europe for our core applications.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: The Corporation utilizes third-party threat analysis tools such as penetration testing and vulnerability scanning to assist in understanding and supporting the measurement of information security related risks. Additionally, the Corporation uses a third-party tool to help management identify current cybersecurity risks and control maturity levels, and to evaluate overall cybersecurity preparedness. The Corporation has also implemented a gap analysis and action plan designed to identify potential actions that would improve our overall cybersecurity posture, and periodically reevaluates both cybersecurity risks and controls to assure they are commensurate with our size and complexity and are keeping pace with the overall cybersecurity threat environment.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: Information security and privacy are important concerns, with an escalating cyber-threat environment and evolving regulatory requirements driving continued investment in this area. Our information security program is designed to meet or exceed industry best practices, and is integrated into our broader ERM framework. We are subject to a number of cybersecurity and data privacy laws and regulations, such as those promulgated by the BMA, NYDFS and EU. Pursuant to applicable regulations, we have established and maintain a cybersecurity program designed to protect our information technology systems and customer data. Our program is designed to comply with all applicable cybersecurity regulatory requirements, including disclosure requirements, and we continue to evaluate and assess our compliance in the changing regulatory environment. It is likely that we will be subject to new regulations that could adversely affect our operations or ability to write business profitably in one or more jurisdictions. We cannot predict what, if any, regulatory actions may be taken with regard to "big data" or other emerging technologies, but any actions could have a material impact on our business, business processes, financial condition, and results of operations.


text: We have in place, and seek to continuously improve, a comprehensive system of security controls, managed by a dedicated staff. From time to time, we engage reputable third parties to perform a variety of services, including managed network security services, incident response or management services, cyber-forensic investigation services, and periodic security penetration testing which we utilize to update our security controls based on any findings. In addition, we are subject to independent assessment and review by regulators, as well as an annual audit of our security controls by our independent internal audit team. We also provide regular security risk education awareness and training sessions for all staff. Additionally, we maintain an ongoing internal third-party cybersecurity risk assessment program to oversee and identify potential cybersecurity threats associated with our use of third-party service providers, and consider these assessments when selecting and engaging service providers.


text: Our Board is responsible for overseeing enterprise-wide risk management and is actively involved in the monitoring of risks that could affect us, including cybersecurity risks. Pursuant to its charter, one of the key responsibilities of the Audit Committee of our Board is oversight of our information and cybersecurity programs and it receives regular reports on cybersecurity, information security, technology and other related matters and risks. The Audit Committee regularly briefs the Board on matters relating to its information technology and cybersecurity risk oversight.


text: Our Board and its Audit Committee are supported in their oversight of information technology and cybersecurity matters and risks by two management committees, the Operational Risk and Resilience Committee, which regularly reports to the Audit Committee, and the Information Security Steering Committee (the "ISSC"). The ISSC is responsible for providing management oversight for our cybersecurity risk management program, and its membership includes our Chief Technology Officer and Corporate Information Security Officer, among other members of senior management. Our Chief Technology Officer and Corporate Information Security Officer have each served in various roles in information technology and/or information security for many years, and have extensive information technology and cybersecurity experience. The Chief Technology Officer, and Corporate Information Security Officer, alongside other multidisciplinary teams across the Company, work to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The broad, cross-functional management team leverages significant experience and expertise across a range of areas, including in managing risk, technology, and legal and regulatory affairs, among others, for assessing and managing cybersecurity risks.


text: We have implemented incident response and business continuity plans for our operations, which are regularly tested with respect to our business-critical infrastructure and systems. We employ data backup procedures that seek to ensure that our key business systems and data are regularly backed up, and can be restored promptly if, and as needed. In addition, we generally store backup information at off-site locations, in order to seek to minimize our risk of loss of key data in the event of a disaster. Our recovery plans involve arrangements with our off-site, secure data centers and cloud infrastructure. We believe we will be able to utilize these plans to efficiently recover key system functionality in the event that our primary systems are unavailable due to various scenarios, such as natural disasters.


text: Management also obtains, analyzes, and responds to information from various sources on cybersecurity threats and vulnerabilities that may affect the Corporation, while incorporating available information on cybersecurity events into our ISP. Additionally, management develops, maintains, and updates a repository of cybersecurity threat and vulnerability information that may be used in conducting risk assessments, and ultimately provide updates to the Board of Directors on cybersecurity risk trends. The Corporation has not experienced any cybersecurity incidents in the past that have individually or in the aggregate had a materially adverse effect on our business, financial condition or results of operations.


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Information security and privacy are important concerns, with an escalating cyber-threat environment and evolving regulatory requirements driving continued investment in this area. Our information security program is designed to meet or exceed industry best practices and is integrated into our broader ERM framework. We are subject to a number of cybersecurity and data privacy laws and regulations, such as those promulgated by the BMA, Office of the Privacy Commission, NYDFS, MIA, and the EU. Pursuant to applicable regulations, we have established and maintain a cybersecurity program designed to protect our information technology systems and customer data. Our program is designed to comply with all applicable cybersecurity regulatory requirements, including disclosure requirements, and we continue to evaluate and assess our compliance in the changing regulatory environment. It is likely that we will be subject to new regulations that could adversely affect our operations or ability to write business profitably in one or more jurisdictions. We cannot predict what, if any, regulatory actions may be taken with regard to "big data" or emerging technologies, such as artificial intelligence, but any actions could have a material impact on our business, business processes, financial condition, and results of operations.


text: We have in place, and seek to continuously improve, a comprehensive system of security controls, managed by a dedicated staff. We also engage reputable third parties to perform a variety of services, including continuous monitoring of our information systems, incident response or management services, cyber-forensic investigation services, and periodic security penetration testing. In addition, we are subject to independent assessment and review by regulators and external auditors, as well as periodic audits of our security controls by our independent internal audit team. We provide regular security risk education and awareness training sessions for all staff. We maintain an ongoing internal third-party cybersecurity risk assessment program to identify potential cybersecurity threats associated with our use of third-party service providers, and consider these assessments when selecting and engaging service providers with periodic re-evaluations. See "Part I, Item 1A. Risk Factors" for additional information on information technology and cybersecurity related risks that may impact us and our financial results.


text: Our Board is responsible for overseeing enterprise-wide risk management and is actively involved in the monitoring of risks that could affect us, including cybersecurity risks. Pursuant to its charter, one of the key responsibilities of the Audit Committee of our Board is oversight of our information and cybersecurity programs and it receives regular reports on cybersecurity, information technology and other related matters and risks. The Audit Committee regularly briefs the Board on matters relating to its information technology and cybersecurity risk oversight.


text: Our Board and its Audit Committee are supported in their oversight of information technology and cybersecurity matters and risks by two management committees, the Operational Risk and Resilience Committee and the Information Security Steering Committee (the "ISSC"), both of which regularly report to the Audit Committee. The ISSC is responsible for providing management oversight for our cybersecurity risk management program, and its membership includes our Chief Technology Officer and Chief Information Security Officer, among other members of senior management. Our Chief Technology Officer and Chief Information Security Officer have each served in various roles in information technology and/or information security for many years, and have extensive information technology and cybersecurity experience. The Chief Technology Officer, and Chief Information Security Officer, alongside other multidisciplinary teams across the Company, work to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The broad, cross-functional management team leverages significant experience and expertise across a range of areas, including risk management, technology, and legal and regulatory affairs, among others, for assessing and managing cybersecurity risks.


text: We have implemented incident response and business continuity and resilience plans for our operations, which are regularly tested with respect to our business-critical infrastructure and systems. We employ data backup procedures that seek to ensure that our key business systems and data are regularly backed up, and can be restored promptly if, and as needed. In addition, we generally store backup information at off-site locations, in order to seek to minimize our risk of loss of key data in the event of a disaster. Our recovery plans involve arrangements with our off-site, secure data centers and cloud infrastructure. We believe we will be able to utilize these plans to efficiently recover key system functionality in the event that our primary systems are unavailable due to various scenarios, such as natural disasters.


text: The Corporation considers cybersecurity a subset of information security, and as such, cybersecurity risks and controls are assessed in our information security risk assessment and managed in our Information Security Program (ISP). The ISP is developed and maintained utilizing the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook and represents the standards, policies, procedures, and guidelines defining the Corporation's security requirements and related activities, which includes risk management and risk assessment practices. Management has designated the Information Security Officer (ISO), along with the Systems and Information Technology (IT) Steering Committee, with implementing and monitoring the ISP. The Corporation's IT department consists of the Chief Information Officer (CIO), who has over 40 years of experience in the IT field, including 14 with the Corporation, and other key personnel who have years of experience and various certifications related to assessing and managing cybersecurity risk. Additionally, the Corporation has established a comprehensive enterprise risk management program to monitor risks related to its operations, including cybersecurity risk, and the Corporation's Chief Risk Officer has primary responsibility for the enterprise risk management program. Management also engages the services of third parties to assist the ISO with their tasks. The Corporation believes that risk management is a component of overall governance and that IT risk management is a component of overall risk management.


text: The Corporation recognizes that our overall security culture contributes to the effectiveness of our ISP. The Corporation maintains an enterprise risk management program that identifies, prioritizes and provides a formal structure for the internal and external risks that impact the organization. The Board of Directors sets the tone and direction for the Corporation's use of IT and has identified the Audit Committee as having primary responsibility for oversight of the Corporation's risk exposures and risk assessments and policies, including risks related to cybersecurity. The Board of Directors and Audit Committee approve and periodically review and re-approve the ISP and other IT related policies. While the Board of Directors may delegate the design, implementation, and monitoring of certain IT activities to the CIO or designee, the full Board of Directors remains responsible for overseeing IT strategies and policies, including cybersecurity. To help carry out their responsibilities, Directors, management, and all employees are periodically trained to understand IT activities and risks, including cybersecurity risks. Management, via the Systems and IT Steering Committee and ISO, or combination, provides a status report to the Board of Directors at least annually, with more frequently communications as necessary. The report describes the overall status of the ISP and material matters related to the program, including security breaches, cybersecurity assessments, cybersecurity awareness training for employees and the Board of Directors and results of incident response testing.


text: Additionally, the Corporation conducts due diligence in the selection and on-going monitoring of third-party service providers. Management is responsible for ensuring that such third parties use suitable information security controls when providing services to us. As part of the oversight of third-party service providers, management will determine whether cybersecurity risks are identified, measured, mitigated, monitored, and reported by such third parties.


text: The Corporation considers cybersecurity a subset of information security, and as such, cybersecurity risks and controls are assessed in our information security risk assessment and managed in our Information Security Program (ISP). The ISP is developed and maintained utilizing the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook and represents the standards, policies, procedures, and guidelines defining the Corporation's security requirements and related activities, which includes risk management and risk assessment practices. Management has designated the Information Security Officer (ISO), along with the Systems and Information Technology (IT) Steering Committee, with implementing and monitoring the ISP. The Corporation's IT department consists of the Chief Information Officer (CIO), who has over 40 years of experience in the IT field, including 15 with the Corporation, and other key personnel who have years of experience and various certifications related to assessing and managing cybersecurity risk. Additionally, the Corporation has established a comprehensive enterprise risk management program to monitor risks related to its operations, including cybersecurity risk, and the Corporation's Chief Risk Officer has primary responsibility for the enterprise risk management program. Management also engages the services of third parties to assist the ISO with their tasks. The Corporation believes that risk management is a component of overall governance and that IT risk management is a component of overall risk management.


text: The Corporation recognizes that our overall security culture contributes to the effectiveness of our ISP. The Corporation maintains an enterprise risk management program that identifies, prioritizes and provides a formal structure for the internal and external risks that impact the organization. The Board of Directors sets the tone and direction for the Corporation's use of IT and has identified the Audit Committee as having primary responsibility for oversight of the Corporation's risk exposures and risk assessments and policies, including risks related to cybersecurity. The Board of Directors and Audit Committee approve and periodically review and re-approve the ISP and other IT related policies. While the Board of Directors may delegate the design, implementation, and monitoring of certain IT activities to the CIO or designee, the full Board of Directors remains responsible for overseeing IT strategies and policies, including cybersecurity. To help carry out their responsibilities, Directors, management, and all employees are periodically trained to understand IT activities and risks, including cybersecurity risks. Management, via the Systems and IT Steering Committee and ISO, or combination, provides a status report to the Board of Directors at least annually, with more frequent communications as necessary. The report describes the overall status of the ISP and material matters related to the program, including security breaches, cybersecurity assessments, cybersecurity awareness training for employees and the Board of Directors and results of incident response testing.


text: Risk Management and Strategy We recognize that cyber incidents, including but not limited to data breaches, ransomware attacks, and system outages, pose a material risk to our operations. We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes are embodied in our Information Risk Management Policy, which is supported by a set of standards and procedures, to provide a structured methodology for identifying, assessing, and managing risks to critical assets, including applications and systems. The Information Risk Management Policy is designed to provide a consistent risk management approach across the organization to safeguard against existing and emerging threats and to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The processes for cybersecurity risk management that we follow are integrated into our enterprise risk management ("ERM") program.

companyName: StoneX Group Inc.

ticker: SNEX


text: Our risk management processes include identifying and documenting key risks, assessing the potential business impact and likelihood of the identified risks, and developing mitigation plans for any risks that are deemed to be critical and or material. The Company uses various techniques to identify risks, up to and including input from our threat intelligence teams, which includes monitoring adversarial tactics and techniques, as well as annual penetration testing using third-party vendors. Once identified, these risks are assessed to evaluate potential impacts to us from compromised confidentiality, integrity, or availability of information systems, considering financial, operational, legal, and reputational risks. Risk ratings are determined by evaluating the threats, any vulnerabilities, and potential business impacts, and this information is documented in our risk register. The management of material risks from cybersecurity threats is assigned to appropriate personnel, with mitigation or remediation plans approved by executive management and reviewed regularly.


text: The ongoing management of material risks from cybersecurity threats includes promoting security awareness throughout the Company, such as quarterly employee training, ongoing monitoring for cybersecurity threats and vulnerabilities, incident response planning, and data backup and retention and recovery readiness in accordance with our global business resilience planning policy and program. We have in place a comprehensive Security Incident Response Plan that outlines the policies and procedure to be followed in the event of an incident, including escalation and communication procedures.


text: We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. These processes include a review of vendors against cybersecurity-focused criteria through our vendor due diligence process, as well as a policy which mandates the inclusion of certain security-related clauses and provisions in our contracts with vendors and suppliers. We also conduct ongoing monitoring and assurance processes, including assessments, to ensure compliance with applicable security-related contractual provisions and other requirements.


text: Periodically, we engage third-party consultants to assess the maturity of our cybersecurity controls using the NIST Cybersecurity Framework. The assessment covers our risk management processes, people, and technologies. The findings are shared with our Chief Information Security Officer ("CISO"), senior management, and the Board of Directors, and the results are used to refine or enhance our risk management practices relating to cybersecurity.


text: The consequences of prior cybersecurity incidents we have encountered have not materially affected our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions and the occurrence of a significant cybersecurity incident could have a substantial negative impact on us. See Item 1A. Risk Factors — Technology and Cybersecurity Risks for additional discussion.


text: Our management is responsible for identifying, assessing, and managing our exposure to risk. The Board of Directors plays an active role in overseeing management's activities regarding risk management in part through its various committees based on each committee's responsibilities and expertise. The Board has delegated to the Technology and Operations Committee (the "Committee") oversight of the Company's Information Technology Department and risks arising from technology and operations, including information security, fraud, vendor, data protection and privacy, business continuity and resilience and cybersecurity risks.


text: Our CISO and Chief Information Officer ("CIO") are primarily responsible for the management of cybersecurity-related risks. Our CISO reports to our CIO, who is a member of our executive committee. The CIO collaborates closely with the CISO to align cybersecurity risk management with business goals. Our Governance, Risk and Compliance team is responsible for implementing the Company's security risk management program, and our security engineering and Threat Management teams manage the technical aspects of cybersecurity and incident detection, response, and remediation. These teams report to the CISO and CIO to keep them informed of the matters for which they are responsible. The CISO and CIO report quarterly to the Committee on current and emerging strategies and trends, the Company's approach to technology and operations, developments with respect to cybersecurity events and risks and the Company's cybersecurity roadmap. More frequent reporting occurs when circumstances dictate, such as pursuant to the escalation procedures included in the Company's Security Incident Response Plan.


text: The Bank's CISO has over 20 years of experience serving in various IT roles, and he maintains a number of technology and cloud certifications, including the Certified Information Systems Security Professional certification.

companyName: Federal Home Loan Bank of Dallas


text: Our CISO has over 20 years of experience in cybersecurity. Before joining the Company in 2023, he held senior leadership positions in cybersecurity and security operations at publicly traded companies, a federally funded research and development center and the U.S. military. He holds a B.A. in Political Science from the University of Arizona and an MA in Strategic Intelligence from American Military University. He is also a Certified Information Systems Security Professional. Our CIO has been with the Company since 2017. She has over 20 years of experience in senior technology and financial roles in the asset management and financial services sector. She holds a B.S. in Accounting from Babson College and an MBA from Indiana University.


text: The ongoing management of material risks from cybersecurity threats includes promoting security awareness throughout the Company, such as quarterly employee training, ongoing monitoring for cybersecurity threats and vulnerabilities, incident response planning, and data backup and retention and recovery readiness in accordance with our global business resilience planning policy and program. We have in place a comprehensive Security Incident Response Plan that outlines the policies and procedures to be followed in the event of an incident, including escalation and communication procedures.


text: We are regularly the target of attempted cyber attacks and such prior incidents have not had a material affect on our business strategy, results of operations or financial condition. We anticipate that we will continue to be subject to such attacks. Our security programs and measures do not prevent all intrusions and the occurrence of a significant cybersecurity incident could have a material adverse effect on our business, financial condition or results of operation. See Item 1A. Risk Factors — Technology and Cybersecurity Risks for additional discussion.


text: Risk Management and Strategy The Company is committed to incorporating industry best practices in its cybersecurity program. Its Information Security Management System (ISMS), which the Company uses in the identification of cybersecurity risks and their classification and evaluation, is based on the National Institute Standards and Technology (NIST) framework and International Organization for Standardization (ISO) standards. The Company invests considerable resources in its information systems and personnel to safeguard its operations. It also regularly engages with external security consultants and auditors to validate its overall cybersecurity and risk management posture.

companyName: SIGMATRON INTERNATIONAL INC


text: Risk Management and Strategy. We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX