text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.


text: No risks from cybersecurity threats have materially affected, nor has the Company identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Please see "Item 1A. Risk Factors — Risks Related to Technology and Data Security" for additional discussion of cybersecurity risks applicable to the Company.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC

secItem: Item 1C


text: Management Responsibilities Our cybersecurity program is managed by our Senior Director of Information Technology ("Technology Senior Director"). Our Technology Senior Director has 21 years of experience in information technology and cybersecurity, having been at the Company since 2003. The Technology Senior Director, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.

stage1Category: Management Role

stage1Method: unanimous


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Technology Senior Director briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.

stage1Category: Board Governance


text: Cybersecurity Risk Management and Strategy The Company is committed to, and recognizes the importance of, information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program uses processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: The Company employs a number of tools and services, such as network monitoring and vulnerability assessments to inform our risk identification and assessment processes. We also maintain an incident response plan that outlines processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate cybersecurity incidents while also complying with relevant legal obligations. Our employees receive cybersecurity awareness and sensitive information protection training on a regular basis, which we also periodically test for effectiveness through simulations, which may include simulated phishing emails and tabletop exercises. Additionally, the Company regularly makes assessments related to the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses. We also maintain cybersecurity risk insurance.


text: Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management function, which includes members of our executive leadership team, serves as a second line of defense, bringing holistic risk oversight while serving as a partner to the business to help strategically manage risk. In particular, cybersecurity risks are monitored by a team composed of members of our executive team, who in turn provides updates to the Audit Committee of our Board of Directors, who is responsible for assisting the Board of Directors with oversight over cybersecurity risks.


text: Through the processes described above, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See Part I, Item IA. Risk Factors – "Risks Related to Our Information Technology and Security".


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: Cybersecurity Governance Our Board of Directors and Audit Committee are actively engaged in the oversight of our information security program, including the Company's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and employee training. Role or project specific employee training, as well as other training, may also occur, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"), who is assisted by other members of our senior management team. The team engaged in the cybersecurity risk management process, including the CIO, has risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team also maintains expertise on cyber risk management through third party consultants, external training, and affiliations with relevant organizations.


text: Given the importance of information security to our customers, employees, suppliers and other partners, our Board and/or the Audit Committee receives reports as needed from our CIO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks.


text: We believe that cybersecurity is important to maintaining the trust of our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats which could adversely affect the confidentiality of our data and the integrity of our business operations and financial systems. Our cybersecurity program is based on best practices and guidelines of the National Institute of Standards and Technology Cybersecurity Framework. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risk.

companyName: ENNIS, INC.

ticker: EBF


text: Annual risk assessments and penetration testing are performed by independent third party consultants. These tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the Board of Directors ("Board"), Audit Committee, and senior management for review to ensure compliance with cybersecurity standards.


text: During the fiscal year ended February 28, 2025, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

stage1Category: Strategy Integration


text: Our Board of Directors, Audit Committee and senior management oversee risk management to ensure that the Company's policies and procedures are functioning as intended to protect the Company's information systems from cybersecurity threats. The Audit Committee performs an annual review and discussion of the Company's cybersecurity program, which includes planned actions in the event of a threat or recovery situation.


text: Our IT team is led by the Director of Information Technology and is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.


text: We view cybersecurity as a shared responsibility of the Audit Committee and the IT team led by the Director of Information Technology, and we incorporate external resources and advisors as needed to conduct evaluations of our security controls through penetration testing, independent audits and consulting on best practices. The results of those tests are presented annually to the Board.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our Director of Cybersecurity, who reports to our Chief Information Officer, and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our Chief Information Officer leads our cybersecurity team and regularly reports to our Audit Committee.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our Chief Information Officer based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

stage1Category: Risk Management Process


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threa ts. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Information Officer and Director of Cybersecurity, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

stage1Method: majority


text: Our Director of Cybersecurity has served in various roles in technology leadership and cybersecurity for over 20 years. Our Chief Information Officer has served in various roles in technology and business leadership for more than 40 years. Our Chief Executive Officer, Chief Financial Officer and Chief Information Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: RISK MANAGEMENT AND STRATEGY The Company continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Managing Material Risks and Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs, and industry-accepted standards, such as National Institute of Standards and Technology frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • maintaining a defined and practiced incident response plan; • maintaining cyber insurance coverage; • employing appropriate incident prevention and detection safeguards; • maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate; • educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.


text: Risks from Cybersecurity Incidents To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.


text: Risk Management Personnel The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 39 years of IT experience, 34 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.


text: Monitor Cybersecurity Incidents Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Directors Oversight The Audit Committee of the Company's Board is responsible for overseeing the Company's policies and practices related to cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • current cybersecurity threat landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learning from unique cybersecurity events, including those of other companies; and • compliance status and efforts with regulatory requirements and industry standards.


text: In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.


text: Risk Management and Strategy We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.

stage1Category: None/Other


text: We have adopted and continue to maintain a cybersecurity risk management program that implements various controls, technology, and procedures for the evaluation, identification, and handling of significant cybersecurity risks that could impact the confidentiality, integrity, or availability of our information systems.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our practices include providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying advanced tools for detecting and analyzing anomalous network activities, and implementing robust containment and incident response procedures. We leverage threat intelligence from our security vendors, as well as from trusted sources such as CISA and the FBI, to enhance our defenses and stay ahead of emerging threats. Additionally, we are committed to staying aligned with the latest industry standards and actively participating in industry forums to exchange insights and proactively address evolving cybersecurity challenges.


text: A critical component of our cybersecurity strategy is the integration of a third-party Security Operations Center support, which monitors our global network environment on a 24/7/365 basis, and is designed to rapidly identify and respond to threats. This program monitors both internally detected and externally reported vulnerabilities that could impact our products, which are then evaluated for their cybersecurity implications according to Company protocols. We also utilize third-party service providers as part of our cybersecurity risk management program and maintain a framework for managing cybersecurity risks presented by our third-party Service Providers. This framework governs the third party's security management system and mandates that the program (i) adhere to certain information handling and asset management protocols and (ii) promptly notify us of any cybersecurity incidents that impact its systems.


text: Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.


text: We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran's corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran's cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.


text: The Company's cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran's information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company's security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.


text: Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.


text: Cybersecurity risk management is integrated into Adtran's Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.


text: For additional discussion of risks associated with cybersecurity, see "Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT risk register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • periodic tabletop exercises conducted by outside counsel to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Information Technology, Intellectual Property, and Data Security and Privacy."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of risk assessment and risk management, including cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and emerging threats; • progress on cybersecurity projects; • incident reports; • lessons learned from past events; and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital and Information Officer.


text: Our management team, including our Chief Digital and Information Officer and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have an information security team with varying backgrounds, years of experience and levels of information security certification.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. Security awareness training is also a key component of our information security program and involves required training for our employees several times per year.

companyName: AGILYSYS INC

ticker: AGYS


text: We also evaluate the information security of potential partners and vendors as part of our vendor selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

stage1Category: Third-Party Risk


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards to mitigate such risks. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures.


text: Our systems periodically experience attacks intended to lead to interruptions and delays in our services and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including having held similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.


text: The results of our SOC 2 and PCI assessments are annually reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including cyber security and technology risks.


text: Our information security and cybersecurity program is based on a cybersecurity framework that is designed to protect against operational risks related to cybersecurity.

companyName: CORVEL CORP

ticker: CRVL


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees our day-to-day security operations, and our Chief Information Officer ("CIO") oversees our secure development activities.


text: The Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a Cybersecurity Incident Response Plan which contains processes and procedures related to security incident handling.


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including through third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.


text: We also have vendor assessment processes to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our agreements with third parties may include various compliance requirements, data protection terms, audit or monitoring rights, and notification requirements in the event the third party experiences its own cybersecurity event.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our information security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees and is supplemented with periodic social engineering tests.


text: We engage consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. In the last three fiscal years, we have not experienced any material cybersecurity incidents or costs.


text: Cybersecurity Governance As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer, is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our Chief Execuctive Officer, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.


text: Our cybersecurity and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. Such leaders in our organization hold industry recognized certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Global Information Assurance Certification (GIAC).


text: Viasat Cybersecurity Risk Management, Strategy and Governance Disclosure Viasat builds, maintains, and operates satellite and telecommunications systems, infrastructure and services used by both government and commercial customers across the globe. We recognize the importance of building a resilient cybersecurity program focused on reducing cybersecurity risk to our customers, partners and our own organization. Our Cybersecurity Engineering organization, at the direction of the Board of Directors, has developed and implemented a cybersecurity risk management and technical assistance program intended to protect the confidentiality, integrity and availability of the services provided and the information stored, processed or transmitted by our critical systems and infrastructure, while assisting staff to develop, operate and maintain secure products and services.

companyName: VIASAT INC

ticker: VSAT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our executive management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. As part of the acquisition and continuing integration of Inmarsat, the legacy Inmarsat cybersecurity team joined the Viasat Security Engineering organization. The engineering and operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. Based on the monthly reports, the CFO, with support from the VP of Information Technology, evaluates and provides a summary report to the Audit Committee on an annual basis. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.

companyName: Canopy Growth Corp

ticker: CGC


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known as the "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our identification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.


text: Integration efforts continue between legacy Viasat and Inmarsat's cybersecurity departments. Viasat is actively merging policies, processes, and operations security practices and operational footprints ensuring we have appropriate security tools and solutions that align with our business objectives and security requirements. The combined Viasat and Inmarsat cybersecurity organizations report to Viasat's CISO and remain focused on the overall Viasat and Inmarsat satellite service network and corporate integration activities.


text: Functionally, our cybersecurity team performs internal and external risk assessments and testing on both internally and externally developed systems, as well as certain third-party and supply chain partner ecosystems based on our assessment of their respective operational criticality and risk profile. Depending on the risks presented, this may include some combination of manual and automation-driven testing methods and supply chain risk management activities such as hardware and software assurance assessments, anti-counterfeit measures, and the use of trusted suppliers. Compliance with security policies, procedures, and standards are assessed, and depending on the potential risks posed to us, third-party assessments may be performed, including penetration tests, red team engagements, gap assessments, and compliance certification assessments. We also conduct several 3rd party compliance and audit assessments, including PCI DSS Tier 1 Merchant and Service Provider, ISO 27001, UK Cyber Essentials Plus, and DFARS 252.204-7012 High Assurance assessments.


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers (ISACs), including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC).


text: Our cybersecurity engineering teams have personnel dedicated to detection engineering activities that leverage threat intel gathered to mitigate the impact of security events. Security detection and operations teams are responsible for detection activities including 7x24 staffed Cybersecurity Operations Centers responsible for monitoring our service provider networks and internal corporate and development environments. Various automated tools are used for detection and remediation, with support from experienced detection and response analysts and engineers.


text: When security events do occur, we employ a security incident response process that is designed to contain, eradicate, and recover operations as quickly as possible, while preserving forensic evidence for further analysis and potential attribution. We leverage multiple third parties for incident response and forensic support on retainer as necessary to assist during the incident response and remediation phases. We also maintain cybersecurity insurance in the event of cybersecurity related damages or data loss as a result of a cybersecurity incident or unauthorized data disclosure.


text: During fiscal year 2025, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibility and has delegated responsibility for oversight of this risk to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. The Audit Committee oversees our enterprise risk assessment process, and cybersecurity represents an important component of our overall approach to risk assessment. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Champion Homes, Inc.

ticker: SKY


text: Governance: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Chief Technology Officer, and other members of management.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Third-Party Risk Management: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: Education and Awareness: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Audit Committee receives regular presentations and reports from our Chief Technology Officer on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The Chief Technology Officer, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Risk management and strategy Our cybersecurity program is designed to safeguard our information systems and protect confidentiality, integrity, and availability of those information systems and the information residing therein. Our cybersecurity risk management program is integrated with our broader enterprise risk management programs under the oversight of our Chief Administrative Officer ("CAO") and the Enterprise Risk Management Committee. The CAO reports to the CEO and is responsible for our overall information and data security strategy, cybersecurity risk policies and procedures, as well as evaluating and managing any material risks from cyber threats. Our Chief Information Security Officer ("CISO") reports directly to our CAO and leads our cybersecurity and compliance department.

companyName: TRIUMPH GROUP INC


text: The Audit Committee oversees the Company's risk management program, including the management of cybersecurity threats. The Audit Committee receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company's approach to overseeing cybersecurity threats with the Company's CFO and other members of senior management.


text: The cybersecurity and compliance department, in conjunction with our Computer Security Incident Response Team ("CSIRT"), designs, implements, and executes continuous monitoring processes for our information systems. Our monitoring programs include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CSIRT is responsible for the detection and assessment of cybersecurity threats and incidents in accordance with a formal risk assessment matrix established in cooperation with our Cybersecurity Disclosure Committee. This risk assessment matrix establishes a framework for notification of an incident to the Cybersecurity Disclosure Committee and, if appropriate, the Audit Committee or Board of Directors. The CISO also partners with internal functions such as finance, legal, and internal audit, as well as third-party consultants who perform risk-based assessments against the National Institute of Standards and Technology ("NIST") 800-171 Rev2 and Cybersecurity Maturity Model Certification with recommendations, in designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategy, helping ensure such programs and strategy align with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee or Board of Directors.


text: In the event of a cybersecurity incident, the CSIRT has an Incident Response Plan that outlines the steps that are designed to help ensure regulatory requirements are met and cyber vulnerabilities, if any, are addressed. We periodically conduct "tabletop" exercises to simulate cybersecurity incidents and help ensure that we are prepared to respond to such incidents in accordance with our internal policies and programs, as well as applicable laws and regulations. In addition, tabletop exercises allow us to identify areas for potential improvement and maturation of our Incident Response Plan, or other aspects of our cybersecurity risk management program. These exercises have included participation by members of our Cybersecurity Disclosure Committee, including our CAO and Chief Financial Officer.


text: We have established a supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to assess and evolve our oversight processes to mature how we manage cybersecurity risks associated with the products and services we procure. We generally require our suppliers to adopt security practices based on industry-recognized standards.


text: We have experienced, and may experience in the future, either directly or through our supply chain or other channels, cybersecurity incidents. To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks associated with cybersecurity, refer to "Our business could be negatively affected by cyber or other security threats or other disruptions" in Item 1A. Risk Factors.


text: Our Board of Directors has overall responsibility for risk oversight and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee reports on its activities, findings, and other matters to the full Board of Directors quarterly, or more frequently as events or circumstances may require. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The CAO and CISO present an update to the Audit Committee on our cybersecurity risks and risk management strategies and processes at each regularly scheduled, quarterly meeting. These presentations include assessments on the threat landscape; emerging risks, threats, or vulnerabilities; updates on our risk management activities, including investments in risk mitigation and governance; compliance with laws and regulations; internal controls; and updates on incidents.


text: At the management level, we have established two committees that are directly involved in managing and responding to cybersecurity risks and incidents: the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee. The Enterprise Risk Management Committee is responsible for assessing enterprise risk and overseeing our enterprise risk management programs, including the cybersecurity risk management programs described above. The Cybersecurity Disclosure Committee is a subcommittee of our Disclosure Committee and is responsible for assessing the materiality of identified cybersecurity incidents resulting from our monitoring programs described above and informing the Chair of the Audit Committee, the Audit Committee, or the Board of Directors, as appropriate. The CISO has responsibility for notifying the CAO and the Cybersecurity Disclosure Committee of potentially material cybersecurity incidents based on an established policy and risk assessment matrix that incorporates an evaluation of quantitative and qualitative factors such as potential impact on results of operations and financial condition, compliance with laws and regulations, and impact on key stakeholders such as employees and business partners. The CISO has over fifteen years of cybersecurity risk management experience and has served the Company for over twenty years in various roles involving managing information technology, security and compliance functions, including developing key enterprise capabilities such as security engineering and strategies on information security risk management.


text: The CAO and Chief Financial Officer are members of both the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee and are supported by our information security, compliance, contracts, treasury, investor relations, operations, and supply chain organizations so that identified issues can be addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Cybersecurity Risk Management and Strategy As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations. Informa PLC's chief information security officer ("CISO") and Security team have implemented a similar framework and we collaborate on best practices, improvements, and risk assessments. Some Informa TechTarget systems are currently managed within the Informa PLC environments and overseen by the Informa PLC framework. The teams collaborate regularly and share any relevant findings.

companyName: TechTarget, Inc.

ticker: TTGT


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage.


text: We regularly engage external parties, including consultants, auditors, and cybersecurity service providers to enhance our cybersecurity oversight. For example, we maintain an ISO 27001 certification for our BrightTALK platform and obtained a SOC 2, Type II report for our Priority Engine platform. These third-party assessments are evaluated and updated regularly. Additionally, we utilize various external parties and tools to assist us with annual penetration testing, cybersecurity and related training, vulnerability and patch management, threat detection and response, and information technology general controls.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management and assessment program designed to help protect against the misuse of information technology, data, and systems by third parties and business partners generally requiring third-party service providers to complete a security risk assessment, with certain high priority third-party providers undergoing annual risk assessments to determine if they have experienced any changes that could impact their security risk. If any critical risks are identified, we may perform a compliance audit of the third-party to further document findings and to recommend corrective actions.


text: Based on an assessment using the previously described enterprise information security program, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior security incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled " The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance and Oversight Our board of directors provides oversight over cybersecurity risk. Our board of directors receives and provides feedback on periodic updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity incidents, if any. Our board of directors also receives periodic briefings on cyber-related issues and accomplishments including, among other things, reviewing key elements of our cybersecurity program, ongoing training initiatives and awareness programs, occurrence of any incidents, and updates regarding third-party certifications and assessments.


text: The VP of Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. The IT Security Team also collaborates closely with the CISO of Informa and his team to, among other things, align strategy, assessments, and tooling. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. We also periodically perform tests on aspects of the operations of our cybersecurity program and the supporting control framework and report the results of these audits in reports to our Audit Committee.


text: In an effort to deter and detect cyber threats, we periodically provide all full- and part-time employees with a data privacy, cybersecurity, and incident response training and compliance program, which covers timely and relevant topics, including phishing, malware, password security, confidential data protection, asset use and mobile security, and educates all employees on the importance of reporting all incidents immediately to the Company's dedicated Incident Management Team. We also use technology-based tools to mitigate cybersecurity risks to bolster our employee based cybersecurity programs.


text: Cybersecurity incidents are inevitable in the current threat environment. We believe that it is a question of "when" not "if" a cybersecurity incident will occur. As a result, we commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents, including the amount of information that can be extracted from our systems by threat actors, whether internal or external.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: We take a cross-departmental approach to addressing cybersecurity risk, which includes input from senior management, our Cybersecurity Council (a taskforce comprised of representatives from primary corporate functions across our Moving and Storage, Property and Casualty Insurance, and Life Insurance subsidiaries), other team members, and oversight by the Board and its Audit & Cyber Committee. We commit resources to cybersecurity and risk management processes to analyze the changing cybersecurity landscape and respond to ongoing and emerging threats. We monitor and assess the threat landscape on an ongoing basis. Our Cybersecurity Council reviews cybersecurity risks. In addition, we have a set of Company-wide policies and procedures that directly or indirectly relate to cybersecurity. These policies go through an internal review process and are approved by members of management.


text: The Company's Director, Data Privacy & Security leads the IT security team and is responsible for coordinating and implementing our information security program. The Director, Data Privacy and Security also reports on cybersecurity matters to senior management and informs on such matters to the Audit & Cyber Committee of the Board. IT security team members have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we perform simulations and tabletop exercises with members of the Cybersecurity Council and other team members involved in incident response. We involve external resources and advisors as needed. Team members have on-demand online access to cybersecurity training through our online U-Haul University.


text: We have expanded investments in IT security and improved access control and identity and authentication management, and engage consultants as needed. We test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party consultants. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, mitigation, and remediation. The cybersecurity team collects data on cybersecurity threats and risk areas and conducts risk assessments. We conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of our third-party service providers. Our assessment of risks associated with our use of third-party service providers is part of our overall cybersecurity risk management framework.


text: The Audit & Cyber Committee and the full Board participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit & Cyber Committee reviews the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, recent enhancements to the Company's defenses, and management's progress on its cybersecurity initiatives. In addition, the Board and the Audit & Cyber Committee discuss recent threats and how the Company is managing those threats.


text: Despite our work to identify and address cybersecurity risks, we experience threats to our data and systems. We have experienced cybersecurity incidents in the past, including breaches of our data and systems. To date, none of those cybersecurity incidents has resulted in a material impact on our business strategy, results of operations or financial condition. However, the impacts of cybersecurity incidents in the future could be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents are inevitable, and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us" in Item 1A- Risk Factors in this Annual Report.


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: Furthermore, AVD has taken measures to prevent cybersecurity breaches, to minimize threats and, to the extent possible, to anticipate trends and identify vulnerabilities before arising to the level of an incident. In short, AVD is pro-active in its approach and has formulated a specific plan to investigate, respond and minimize loss of functionality or other damage from an incident. There are no cybersecurity threats, including as a result of prior incidents, that have materially affected the Company, including our business strategy, results of operations or financial condition as of the date hereof to our knowledge.


text: Governance. The REIS Policy has been drafted in collaboration with one of the largest IT solutions providers in the field and was modeled after NIST standards relating to governance, documentation and processes. The Company is implementing the REIS Policy through its Cyber and Privacy Risk Steering Committee (the "CPRSC"), which is chaired by the Chief Administrative Officer (who is also AVD's Risk Manager) and includes cross functional business process owners from operations, sales, marketing, finance and Human Resources, as well as our Director of Information Technology, who alone has over 30 years' experience in IT-related security and whose staff collectively has over 50 years' experience in this area. In addition, the committee is advised by a virtual Corporate Information Security Officer who works with the third-party solutions provider.


text: A VD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.


text: The Company's Audit Committee is responsible for overseeing the Company's internal controls including oversight over our risk management program and cybersecurity. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from the Company's overall risk management system and processes. The Company seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security includes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party breach response process through our insurer's cyber panel, which includes access to a breach coach and forensic experts under a tripartite agreement to ensure coordinated response and maintain privilege; security playbooks setting forth a tactical guide to respond to cybersecurity events and threats as they occur; and recovery procedures. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Cyber Governance & Oversight Members of management report to the Company's Board of Directors regarding cybersecurity matters, including the cyber risk assessments performed for the Company. As part of its risk oversight responsibility, the Board oversees our policies and strategies for mitigating cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: The VP of Information Technology has been with our Company for over six years, previously serving as Director and subsequently Senior Director of Global IT Engineering. Prior to joining our organization, he was the Founder, President, and CEO of RjR Innovations, a recognized North American leader in IT Service Management. Over the course of his 27-year career within the Information Technology industry, he has established himself as a subject matter expert and thought leader, having served as both an ITIL Best Practice Conference and Keynote Speaker at various industry events. Supporting the VP of Information Technology is the Director of Cybersecurity & IT Engineering, a seasoned IT professional with more than 25 years of comprehensive experience spanning infrastructure, cybersecurity, architecture, and operations. He has been with our Company for over five years, during which he has held key roles including Senior Solutions Architect, Global IT Engineering and Network Engineer, Global IT Operations. He has also successfully completed advanced executive programs in cybersecurity leadership, including CISO and CISM certifications.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, have not materially affected and are not reasonably likely to materially impact our operations materially, including our business strategy, results of operations, or financial condition.


text: Cybersecurity is one of the top operational risks facing TMCC. We and other financial institutions continue to be targets of ever evolving cybersecurity threats and cyberattacks. As a result, we devote significant resources to a cybersecurity program designed to minimize such risks and protect TMCC, along with data from our customers and clients.

companyName: TOYOTA MOTOR CREDIT CORP


text: Cybersecurity Risk Management and Strategy TMCC's cybersecurity program is designed to identify and assess internal and external cybersecurity threats to and within TMCC's business and operations and to take action aimed at protecting the Company, mitigating and managing cybersecurity risk, and in time of attack, to respond expeditiously to minimize the impact of the attack.


text: Managing cybersecurity threats is a component of our broader enterprise risk management program, which establishes a risk management framework that seeks to identify, assess, and monitor risks that could materially impact our business, customers, clients, employees and stakeholders.


text: TMCC's cybersecurity program utilizes a variety of controls that are designed to identify, prevent, detect, respond to, and recover from cybersecurity threats and events. Those processes and controls include: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity risk policies and standards, implementing controls, monitoring the environment, and responding to cybersecurity incidents; • periodic cybersecurity awareness training for employees and contractors on our policies and emerging cybersecurity threats, including phishing awareness; • internal and independent cybersecurity testing, including penetration testing and tabletop exercises, to assess vulnerabilities of our information systems and evaluate our cyber defense capabilities, technical safeguards and resiliency; • identifying and managing cybersecurity risk of our critical third-party suppliers; • periodic cybersecurity risk assessments for our information systems and applications; • cybersecurity monitoring and response processes employing cross functional teams to identify, assess, escalate, investigate, contain, and remediate incidents; and • incident response and recovery plans.


text: As part of TMCC's cybersecurity program, TMCC engages with assessors and third-party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: TMCC's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third-party service providers with access to TMCC's systems and data, as well as such third-party service providers' adherence to certain cybersecurity standards and processes. As appropriate, TMCC requires such third-party service providers to agree to be subject to cybersecurity evaluations by TMCC.


text: Although our third-party service providers have experienced cybersecurity incidents, which have resulted in minor adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. We expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."


text: Cybersecurity Governance The Board of Directors (the "Board") has risk oversight responsibility for the cybersecurity and data privacy risk management programs of TMCC, which are administered directly and with assistance from the Cybersecurity Committee of the Board.


text: The purpose of the Cybersecurity Committee is to assist the Board in fulfilling its oversight responsibility with respect to its information technology use and protection, including enterprise cybersecurity and data privacy, among other things. The Cybersecurity Committee receives, reviews, and discusses reports from members of management, as appropriate or required by law, including but not limited to the Chief Information Officer, Chief Information Security Officer, Chief Risk Officer, Chief Legal, Compliance and Administrative Officer, and other officers or employees as appropriate, regarding TMCC's practices, management and functioning of technology operations and information security, cybersecurity and data privacy risks. The Cybersecurity Committee reports to the Board regarding its activities, its receipt of reports regarding material cybersecurity and data privacy issues, material issues found in vulnerability assessments or penetration testing, and reports from the Chief Information Officer and Chief Information Security Officer.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: TMCC's cybersecurity program is administered by our Chief Information Security Officer. We believe our Chief Information Security Officer and our information security team have the appropriate expertise, background, and depth of experience to manage cybersecurity and data privacy risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, information security leadership roles, military experience, academia, ongoing internal and external training, and regular discussions with consultants and industry peers with applicable knowledge and expertise regarding emerging cybersecurity threats.


text: When a cybersecurity threat or incident is identified, the Chief Information Security Officer works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, the Cybersecurity Committee, and the Board, as necessary, regarding significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, employees and stakeholders, and continues to provide regular reports until such incidents are concluded.


text: We believe cybersecurity is critical to advancing our technological advancements. As a pharmaceutical and biotechnology services company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS