text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes; (2) our security processes; and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions, as we have described in the Risk Factors section of this Form 10-K.

companyName: PARSONS CORP

ticker: PSN

secItem: Item 1C


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit and Risk Committee. The Audit and Risk Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security & Risk Officer reports to the Chief Technology Officer and works closely with the Chief Legal Officer to ensure that all disclosure or reporting requirements are satisfied if an incident were to occur. The Chief Security & Risk Officer leads Parsons' overall cybersecurity function and provides quarterly reports to the Audit and Risk Committee on our cybersecurity risks, including briefings on our cybersecurity risk management program and cybersecurity incidents. The Audit and Risk Committee also receives periodic presentations on relevant cybersecurity topics as part of the Committee and the Board's continuing education on topics that impact public companies.

stage1Category: Management Role

stage1Method: unanimous


text: Our Chief Security & Risk Officer supervises efforts to prevent, detect, mitigation and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment. Our Chief Security & Risk Officer is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for leading our overall cybersecurity risks management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Security & Risk Officer has significant global experience in managing and leading IT and cybersecurity teams.


text: Risk Management and Strategy. The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. Risk-based analysis and judgment, along with a recognized security framework, are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services, as well as a security operations center. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Governance. The Chief Technology Officer (CTO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CTO, Doug Fay, has served as the Chief Technology Officer & Sr. Vice President for Cinemark since August 2006. Mr. Fay has a background in software engineering and application architecture and has worked in the information technology field since the early 1990s. The CTO routinely reviews risks and security measures and meets monthly with the general counsel, CFO, and Global Controller to review security measures and risks. Oversight of the information security program at the Board level sits with Audit Committee. Presentations regarding security measures and risks to the Audit Committee occur semi-annually. The Company's incident response plan defines the process for escalating incidents based on level of severity to the management team and Audit Committee.


text: Risk Management and Strategy Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Innospec's Board has delegated responsibility for the management of the Company's IT to the Company's IT steering committee via the CEO and CFO. The IT steering committee is made up of executive management, business leaders from our reporting segments, the functional heads responsible for our operating systems, IT leadership and is chaired by our Global IT Director. The Company considers that the IT steering committee members have the appropriate qualifications and experience required to enable them to fulfill their responsibilities. The IT steering committee may, as per its agreed terms of reference, escalate any matter it wishes to the Board via either the CEO or CFO.

companyName: INNOSPEC INC.

ticker: IOSP


text: Board of Directors Oversight Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy As is the case for most companies, we are regularly subject to cyberattacks and other cyber incidents, and, therefore, cybersecurity is an important element of our ongoing information technology operations. We devote significant resources to protecting and enhancing the security of our computer systems, business information, software, networks and other technology assets, by applying our cybersecurity risk management processes, which consider physical, procedural and technical safeguards. We have a multi-faceted program for assessing, identifying and managing cybersecurity risks, that is designed to help protect our information assets and operations from internal and external cyber threats by: • organizing our cybersecurity efforts based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework by applying the framework's rubric of Govern, Identify, Protect, Detect, Respond, and Recover; • seeking to understand, manage and mitigate risk while ensuring business resiliency and protecting business, employee and patient information from unauthorized access or attack; • identifying critical business information, the lifecycles of that information, and the systems where this information is stored, distributed, processed, and eventually destroyed. For example, by managing important external parties and their operations, analyzing their cybersecurity risk to our business operations, and reviewing the residual risk with business leaders to accept and manage each external party appropriately; • protecting and securing our systems from attack with secure configuration standards and protective cybersecurity tools; • detecting potential attacks through appropriate tools, including cybersecurity-related data collection and analysis to help identify potential attacks; • responding to alerts from those tools with processes to verify whether there is a real incident and the severity of that incident using appropriate resources and team members, including establishing and exercising a Cybersecurity Incident Response Plan ("IRP") based on recognized industry practices, including NIST guidance; and • establishing and exercising processes and procedures to recover from cybersecurity incidents.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI

stage1Category: Risk Management Process

stage1Method: majority


text: Our IRP contains tools and guidance related to cybersecurity events and is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents as well as comply with applicable legal obligations. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We regularly engage external parties, inclusive of but not limited to, service vendors, consultants, independent privacy assessors, peer companies, industry groups, and governance experts to enhance our understanding and application of oversight of the cybersecurity landscape. For example, we provide an annual assessment of our cybersecurity program, completed by our third-party Chief Information Security Officer ("CISO"), to our Audit Committee for review and feedback. These external parties provide an industry perspective on appropriate risk management and investment in our cybersecurity efforts that is reviewed and approved by company management and the Board of Directors.


text: Based on an assessment using the previously described cybersecurity risk management process, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Our business and operations may be materially adversely affected in the event of information technology system failures or security breaches, and the costs and consequences of implementing data protection measures could be significant." in Part I, Item 1A. "Risk Factors" for additional information.

stage1Category: Strategy Integration


text: Cybersecurity Governance and Oversight The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity threats or incidents, if any. As part of these quarterly updates to the Audit Committee, our Vice President of Information Technology presents any developments, emerging risks or key topics to the Audit Committee, including, among other things, the external threat environment, risk profile changes, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and industry practices, cyber readiness, results of third-party assessments, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Chair of the Audit Committee, as well as periodic updates highlighting recent incidents throughout the industry and the emerging threat landscape.


text: Our Vice President of Information Technology leads an IT Security Team and has overall responsibility for the security program. The IT Security Team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes. The IT Security Team works across the enterprise to assess and prepare our employees and third parties to manage cybersecurity risks and detect, investigate and respond to cybersecurity incidents. Our Vice President of Information Technology has over 25 years of information technology experience, including 23 years of leadership responsibility, and has substantial operational experience with cybersecurity policy, protection, incident response, and governance. We also utilize a third-party cybersecurity advisor to act as our CISO, supporting the Vice President of Information Technology. This fractional executive has extensive experience as a CISO and cybersecurity executive with over 25 years of expertise in designing, building, and operating transformational information security programs, is a Certified Information Systems Security Professional, and holds a Master of Science in Strategic Intelligence.


text: Further, our IRP establishes a corporate incident response team, which is responsible for providing oversight, direction, and governance of incident response policies and processes and is composed of certain company stakeholders, including our Chief Financial Officer, General Counsel, Vice President of Information Technology and our third-party CISO.


text: In an effort to deter and detect cyber threats, we provide a monthly cybersecurity awareness newsletter to all employees, including part-time and temporary contractors, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The cybersecurity training and awareness programs function to remind employees of the importance of reporting all incidents quickly. We run frequent phishing tests to raise awareness of spam emails, the primary attack vectors for cyber threats and to further raise awareness of cyber threats. We provide annual training on employee responsibilities for protecting company information and data along with our overall compliance responsibility. Each October during cybersecurity awareness month in the U.S., we provide weekly updates on cybersecurity awareness and host a company-wide lunch and learn discussion of our cybersecurity program and the impact of cybersecurity on individuals as well as the company, with a data protection, cybersecurity and incident response and prevention training and compliance program.


text: Risk Management & Strategy Innospec has strategically integrated cyber security risk management into its broader risk management framework to promote a company-wide culture of cyber security risk management. This integration ensures that cyber security considerations are an integral part of our decision-making processes at every level. For example, training on cyber security risks was required of all Innospec directors and employees who have access to our information technology resources. Our risk management team works closely with our Information Technology ("IT") leadership to continuously evaluate and address cyber security risks in alignment with our business objectives and operational needs.


text: Innospec's IT leadership team is responsible for assessing, identifying and managing the inherent and residual risks associated with cyber security threats across our IT and Operational Technology landscape. IT leadership periodically reviews the Company's external threats, portfolio, and external services, and will update its risk register accordingly.


text: IT leadership will, when required by either executive management or the Board, engage third-party reviews of our overall cyber security compliance using The National Institute of Technology ("NIST") framework. IT leadership will also periodically engage specialist security contractors to test the Company's resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.


text: Innospec utilizes an external service to provide ongoing analysis of the security related to our critical third-party service providers for IT operations and business IT services. Innospec will use the information provided by this external service as part of its IT vendor selection criteria and for ongoing third-party risk management.


text: Innospec's cyber security is underpinned by a third-party specialist that monitors critical systems and end-user devices for cyber-attacks. In the first instance, cyber-attacks are brought to the attention of the IT leadership for evaluation and remediation before further escalation to the CEO and CFO is considered.


text: Periodically, our systems are subject to targeted attacks which are intended to interrupt our operations or may lead to the loss, misuse or theft of personal information relating to our employees, suppliers and customers or lead to the loss of Company data, confidential information or our intellectual property.


text: Innospec's Board and its committees provide oversight of the Company's IT, including cyber security, in connection with the Company's efforts to assess and manage the Company's risk exposure. Oversight of risk management, including cyber security risk management is an integral part of Board and committee deliberations throughout the year. Since 2019, the Board has retained NCC Group ("NCC") to perform cyber security reviews. NCC reports its findings directly to the Board.

stage1Category: Board Governance


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles overseeing Innospec's IT operations. In addition, the IT leadership team includes specialists with many years cyber security experience at both Innospec and previously with other organizations, combined with multiple cyber security qualifications. Innospec's IT leadership formally reports through the CEO and CFO to the Board.


text: Innospec's CEO and CFO are involved with and approve the Company's strategy for managing the prevention, detection, mitigation and remediation of cyber security incidents as part of its "IT Security Management System" which includes defined escalation and internal communications processes and responsibilities.


text: IT leadership will, as required, present to the IT steering committee, information regarding any IT risks identified and the mitigation plans to reduce the Company's residual risks. The IT steering committee will be regularly updated as to the occurrence, mitigation and resolution of cyber security incidents. Any cyber security incident that is considered significant in nature will be shared by IT leadership with the IT steering committee in accordance with the agreed communication and escalation processes. The IT steering committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.


text: In the last three fiscal years, management has determined there were no cyber security threats that have materially affected Innospec and that the expenses incurred relating to cyber incidents have been immaterial. The Company is not aware of any threats that are reasonably likely to materially affect its business strategy, results of operations or financial condition for the foreseeable future.


text: IT leadership provides a written report to the Board each quarter and the Global IT Director presents in person at least annually. Those reports and presentations include information on Innospec's cyber security and the related key performance indicators. IT leadership also provides external threat analysis to the Board when new relevant threats are identified as being exploitable and their potential impact on Innospec.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Risk Management and Strategy The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and Cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cybersecurity update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Chief Information Security Officer (CISO) leads our global information security organization responsible for overseeing the Company's information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at various technology companies. The global information security organization provides regular reports to senior management on various cybersecurity threats, assessments and findings.

companyName: ManpowerGroup Inc.

ticker: MAN


text: The Board oversees the effectiveness of the Company's management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives on a regular basis information and updates regarding cybersecurity matters. The Cybersecurity Steering Committee meets multiple times throughout the year to discuss the Company's cybersecurity programs and practices, risk management related to cybersecurity and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cybersecurity professionals with decades of relevant experience.


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plan. Through the ongoing communications from these teams, the Cybersecurity Steering Committee monitors effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any material cybersecurity incidents to the Board when appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company maintains a comprehensive cybersecurity management and governance program. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR INC

ticker: PCAR


text: The Company's Security Risk Council, including the Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the Company's Security Risk Council evaluates its significance and briefs the Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management is integrated in our overall risk management program and is based on recognized cybersecurity industry frameworks and standards, including those from the National Institute of Standards and Technology, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies and defined procedures for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, malware defenses and zero trust principles. We work with internal stakeholders across the Company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we regularly train our employees on cybersecurity awareness and, confidential information protection. We routinely test our employees using simulated phishing attacks. Risks from cybersecurity threats have not materially affected our company, business strategy, results of operations or financial condition; however, we remain subject to cybersecurity risks in the future. See Item 1A. Risk Factors – "Our systems, networks and business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, including information technology system failures, and security breaches."

companyName: Adeia Inc.

ticker: ADEA


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. Our information technology team led by our Vice President of Information Technology (VP of IT) frequently collaborates with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices, and industry trends.


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We routinely conduct risk and compliance assessments of third-party service providers that request access to our information assets. We re-assess our third-party vendors in an ongoing basis.

stage1Category: Third-Party Risk


text: Our cybersecurity risk management is integrated into our comprehensive business continuity program and enterprise risk management. Our information technology team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness.


text: Governance of Cybersecurity Risk Management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The board of directors has delegated to the audit committee the responsibility of reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, regularly reports on its review with the board of directors.


text: Management is responsible for day-to-day implementation of risk management strategies and recommends process improvements. Our VP of IT has primary oversight of material risks from cybersecurity threats. Our VP of IT has more than 25 years of experience across various engineering, business and management roles focused on information technology, including roles at global, public companies, as well as across multiple industries including fintech, research, and high tech. Our VP of IT regularly presents updates to the audit committee regarding Company cybersecurity matters and developing industry trends.


text: We have retained an outside cybersecurity firm for our managed security services, which reports to our VP of IT. The cybersecurity firm has professionals with more than 20 years of experience working in information technology-related roles and degrees in Information Technology, including cybersecurity, Certified in Risk and Information Systems Control (CRISC), and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA). The cybersecurity firm has extensive experience is supporting firms in applied knowledge of information technology governance and security frameworks that include: ISO 27000, NIST, HITRUST, ISC2, ITIL, and COBIT.


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and regular evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to management and the audit committee, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our VP of IT meets with the audit committee quarterly to review our information technology systems and discuss key cybersecurity risks, and these matters are also presented to the board of directors annually. In addition, our chief financial officer reviews with the audit committee, at least annually, our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board of directors.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's Chief Compliance Officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.


text: Crescent's Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.


text: Since our commencement of operations, we have not experienced a material cybersecurity incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships"


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test PACCAR Financial Corp. (Millions of Dollars)

companyName: PACCAR FINANCIAL CORP


text: preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain PACCAR dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to PACCAR or the Company.


text: Trustmark recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. Trustmark is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Trustmark's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Enterprise Risk Committee and the Audit Committee. Processes for identifying, assessing and managing cybersecurity-related risks are integrated into Trustmark's overall enterprise risk management process, which is overseen by the Enterprise Risk Committee. The Enterprise Risk Committee is responsible for monitoring risks that are being taken by Trustmark, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Enterprise Risk Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves Trustmark's cybersecurity strategy for protecting Trustmark's information assets and technology platforms. The Audit Committee oversees Trustmark's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Enterprise Risk Committee and the Audit Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: Trustmark's information security program is primarily administered at the management level by the Information Security Department, which is led by Trustmark's Chief Information Security Officer (CISO), and is supported by the Information Technology Department, which is led by Trustmark's Chief Information Officer (CIO). The CISO reports to the CIO, who in turn reports to Trustmark's Chief Credit and Operations Officer. Trustmark's Information Security Department is responsible for day-to-day management of Trustmark's information security program, including data loss prevention, access control, threat monitoring, incident response, insider threat monitoring and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, Trustmark's Information Technology Department maintains policies that govern technical aspects of Trustmark's information security program. Each policy is reviewed and approved by the Enterprise Risk Committee at least every three years and is mapped to applicable regulatory guidance. The Cybersecurity Operations team within the Information Technology Department maintains and runs Trustmark's security operations center and is responsible for cybersecurity event management and maintaining security tooling. Trustmark also maintains an Information Security / Cybersecurity Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Corporate Security, Internal Audit and Legal departments and members of executive management. This committee meets quarterly to discuss and review Trustmark's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department and Information Technology Department.


text: Trustmark engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. Trustmark also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Trustmark confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, Trustmark is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Financial Privacy Laws and Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Although Trustmark has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that Trustmark will not experience such an incident in the future. For additional information regarding the risk Trustmark faces from cybersecurity threats, please see the risk factors titled "Trustmark may experience disruptions of its operating systems or breaches in its information system security" and "Trustmark must utilize new technologies to deliver its products and services, which could require significant resources and expose Trustmark to additional risks, including cyber-security risks" included in Part I. Item 1A. – Risk Factors of this report.


text: We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, detect, escalate, investigate, and remediate identified risks and security incidents in a timely manner. We also maintain a third-party security program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we often rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security controls and leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an independent industry recognized security service provider to conduct an annual red team assessment of our security controls, as well as third-party penetration testing of our information systems. The results of these assessments are reported to senior management and the Audit Committee of the Board of Directors.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations and the services we provide to clients as well as loss, misuse or theft of personal information (candidates, associates, vendors, clients and employees) and other data, confidential information or intellectual property, and we have experienced data exposures in the past. However, to date these incidents have not had a material impact on our services, information systems or business. Any significant disruption to our services or access to our systems could result in a loss of clients and adversely affect our business and results of operations. Further, a penetration of our information systems or a third-party's information systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See Item 1A of Part I, "Risk Factors," under the heading "We could incur liabilities or suffer reputational damage from a cyberattack or improper disclosure or loss of personal or confidential data, and our use of data is subject to complex and ever-changing privacy and cybersecurity legal requirements that could negatively impact our business or subject us to claims and/or fines for non-compliance," which should be read in conjunction with the information above.


text: The Audit Committee of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board of Directors oversees our cybersecurity risk and regularly receives reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Our Processes Regarding Cybersecurity Threats We apply a layered approach, or a defense-in-depth strategy to cybersecurity. This layered approach to security leverages governance, people, processes, and technology to provide our information technology ("IT") teams with preventative measures and strategies such that they are prepared to respond to cybersecurity threats and incidents.

companyName: HERBALIFE LTD.

ticker: HLF


text: We have process, controls and technology infrastructure to maintain, protect, and enhance existing systems and design new systems to keep pace with continuing changes in technology, evolving industry and regulatory standards, and emerging cybersecurity and data security risks.


text: We collect, process, and analyze threat intelligence data from a variety of sources to understand motives, targets, and attack behaviors.


text: Another aspect of our security program is vulnerability management, which includes, among other things, asset discovery and inventory, third-party vulnerability scanners, patch management and remediation, configuration management, as well as penetration testing.


text: We have monitoring systems which are designed to identify potential cybersecurity events, including threats and incidents. These monitoring systems are managed by our Global Security Operations Center, which employs cybersecurity professionals in the United States and in certain foreign countries in which we operate to provide better coverage and response actions.


text: We also use a Security Information and Event Management (SIEM) platform, providing real-time analysis of security alerts generated by applications and network hardware. This platform helps the Global Security Operations Center in monitoring and responding to security events.


text: We have a multi-functional incident response plan which provides guidance in the event of a cybersecurity incident. The plan is managed by our Incident Management Team, which includes representation from our Global Security, Cybersecurity, Legal, and Finance departments, among others. The Incident Management Team is responsible for responding to an incident, including tasks such as identifying and assessing the nature of the incident, containing the incident, and coordinating with relevant departments. Depending on the nature or severity of the event, the Incident Management Team may escalate the matter to our Executive Leadership Team, which includes the Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and other executives. If necessary, the matter could be escalated to our Board of Directors or any appropriate Board committees, including the Audit Committee, which has oversight responsibility for cybersecurity risk. This structured governance approach is designed to manage cybersecurity incidents with participation and involvement with the appropriate levels of our organization.


text: External and internal audits are conducted periodically to assess the effectiveness of our cybersecurity measures. These audits include an annual technology risk assessment by our Cybersecurity and IT departments. Our Internal Audit team also conducts cybersecurity risk assessments which include, among other things, evaluating governance of our cybersecurity processes and functions, assessing our ability to identify, validate and remediate vulnerabilities, and evaluating penetration studies. Results of our Internal Audit assessments are shared with our Enterprise Risk Management ("ERM") team, our Technology Risk Committee, and in accordance with our governance structure which includes, among other things, the Audit Committee of our Board of Directors.


text: We conduct vendor security assessments for key service providers including as part of our vendor onboarding process and as part of our contract review process. The cybersecurity assessment process includes considerations from an industry leading third-party vendor security ratings company.


text: Our standard agreements with third parties may include, among other provisions, compliance requirements, data protection standards, audit rights, and security incident notification requirements. A dedicated email account and hotline is in place for third parties to report security incidents. The email account and hotline are monitored 24/7/365 by our Global Security Operations Center. Notice of a third-party security incident could trigger the activation of our incident response plan, as further described above.


text: Cybersecurity Governance and Risk Management Systems Our risk management system includes several risk management functions that support our processes for identifying, assessing, and controlling risks to our business, including cybersecurity risks.


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our senior management team regarding cybersecurity matters.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our cybersecurity risk management process is integrated with our overarching risk management system, led by our ERM team, and further guided by our Technology Risk Committee. Our Technology Risk Committee is responsible for reviewing and approving the effectiveness of our cybersecurity risk framework and assisting with the oversight of decisions that affect compliance with applicable legal and regulatory matters and corporate policies. As part of the management oversight structure, the ERM team provides our Management Risk Committee with periodic updates on key risk conditions, strategy and mitigation efforts.


text: Our cybersecurity risk management process, which encompasses regular monitoring and periodic assessments, is designed to identify and mitigate cybersecurity threats and vulnerabilities. These efforts are aligned with the broader objectives of our ERM team and are regularly reviewed and refined in consultation with our Technology Risk Committee.


text: A key aspect of this integrated framework is the role of our Internal Audit team, which serves as an independent, objective assurance function tasked with evaluating the effectiveness of risk management, internal controls, and our governance processes.


text: Communication channels between our cybersecurity teams and other risk management personnel are established to facilitate the timely sharing of information about potential cyber threats. For example, our Data Protection and Information Security working group, which includes representation by our Chief Information Security Officer, and our Legal, ERM, Information Governance and Finance departments, among others, meets regularly to discuss key risks, strategies and threats related to information security.


text: Our Board of Directors administers a risk oversight function through its Audit Committee, and is supported by our ERM team, including on matters related to cybersecurity risks. This management reporting is designed to give our Board of Directors visibility over our operations and activities to adequately identify key risks, including among other things, cybersecurity risks, and understand management's risk mitigation strategies.


text: Our Cybersecurity department is staffed with professionals holding a variety of IT, cybersecurity and audit best practice certifications, including, among others, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), International Organization for Standardization 27001 Lead Auditor Certification (ISO 27001 LA), Certified Information Privacy Professional (IAPP CIPP/CIPM), Alibaba Cloud's Cloud Security Certification (Ali-ACP), and Certified in Risk and Information Systems Control (CRSC). Our Cybersecurity department also has a training and development program in place so that appropriate skillsets are maintained and/or acquired, and professional certifications remain current.


text: Our cybersecurity teams are supported by training programs and a dedicated learning management system, Herbalife University, whereby all Herbalife employees receive mandatory security awareness training. Specialized training is also assigned to certain functions based on job responsibilities. Training content is purchased from multiple well-recognized third parties. In addition to assigned training, Herbalife University offers additional information security related courses available to all employees on demand.


text: Our cybersecurity program also engages a variety of consultants, auditors and other third parties to support and assist with implementing and maintaining appropriate security measures. Any number of third parties may be engaged to assist in response actions, including, among others, intelligence providers, product, software and service providers and advisors. Professional services, or consultants, are engaged as needed to help implement, support or advise on a variety of technical matters. Legal counsel, law enforcement and external auditors are also consulted as needed.


text: We have identified and, in some cases, engaged, third-party experts to allow for quicker engagement if a cybersecurity incident occurs in the future.


text: Risks from Cybersecurity Threats As of December 31, 2024 and as of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or nancial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees. As part of a larger digital technology program, we have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber-attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive cybersecurity program assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy training included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • third-party cyber risk program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a security operations center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.


text: We have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers. As part of these processes, we conduct cybersecurity due diligence where deemed advisable with respect to third-party service providers that will be accessing our information technology systems, including access to view or store sensitive data, prior to their engagement. Moreover, we have processes designed to oversee and identify material cybersecurity risks associated with the information systems of third-party service providers. In addition, third-party service providers that have access to our information technology systems, including access to view or store sensitive data, are contractually obligated to report cybersecurity incidents to us so that we can assess the impact of any such incident on our business.


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time.

stage1Category: None/Other


text: We do not believe that risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially affects us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, privacy and data protection laws and regulations, consumer protection laws, common law or other theories, subject us to litigation and federal and state governmental inquiries and actions, damage our reputation, adversely impact our financial results and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.


text: We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board of Directors' oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Digital and Information Officer, or CDIO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CDIO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CDIO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.


text: At a management level, our cybersecurity risk management efforts are led by our Chief Information Security Officer, or CISO, who reports directly to the CDIO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2024, and brings more than 25 years of experience in cybersecurity, technology and risk management. He has more than 15 years of experience in the healthcare industry, including his service with the Company since 2022. Prior to joining us, he served as Deputy Chief Information Security Officer at another large healthcare organization. Further, our CDIO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service as the Company's CISO from 2021 to 2024 and his service as CISO at another large organization prior to being employed by us. In addition to our CISO and CDIO, other individuals on our cybersecurity team have cybersecurity experience or certifications relevant to their respective role.


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our board of directors.

companyName: MEDICINOVA INC

ticker: MNOV


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the cybersecurity team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.


text: Cybersecurity Risk Management and Strategy Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and our critical information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Our Manager uses the Center for Internet Security Critical Security Controls as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that our Manager meets any particular technical standards, specifications, or requirements.


text: Our Manager's cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, services, and our Manager's broader enterprise information technology ("IT") environment; • a team comprised of IT and Legal & Compliance personnel of our Manager principally responsible for directing (1) the cybersecurity risk assessment processes, (2) our Manager's security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes or those of our Manager; • cybersecurity awareness training of employees with access to our Manager's IT systems; • a cybersecurity incident response plan; and • a third-party risk assessment process for key service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses and limit our growth."


text: Cybersecurity Governance Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of our Board's continuing education on topics that impact public companies.


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our board of directors.


text: Risk Management and Strategy As of December 31, 2024, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors receive annual cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, financial, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. Our cybersecurity program is informed in part by industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This program is managed and monitored by a dedicated information technology team, including a Senior Director of Information Security, and is led by our Senior Vice President, Chief Information Officer, or CIO. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our program includes, for example: • Regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments; • Engagement of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model; • Cybersecurity awareness training for our employees, contactors, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and annual tabletop exercises with participants from cross functional teams; • A third-party risk management process for service providers, suppliers, and vendors including due diligence prior to engagement and ongoing periodic review of our key technology vendors, and other contractors and suppliers.

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: Our CIO, together with our Senior Director of Information Security and other members of the IT leadership team, are responsible for assessing and managing cybersecurity risks. Our CIO has over ten years of experience managing information technology and cybersecurity. Our Senior Director of Information Security has over 25 years of experience managing information technology and cybersecurity matters and is certified as a Certified Information Systems Security Professional (CISSP). We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Since the beginning of the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CIO. The Board also receives updates from the Audit Committee on cybersecurity risks on a regular basis.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development and manufacturing, to communicate internally and externally, to operate our accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Gentherm Inc

ticker: THRM


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and our proprietary, strategic or competitive data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have an incident response process that relies on a multidisciplinary team for assessing and managing cybersecurity incidents, including an escalation framework based on the materiality of incidents. The multidisciplinary team includes members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions and third party service providers of technical, legal and insurance services, as well as coordination with law enforcement as appropriate. Our IT security function also addresses cybersecurity threats through regular vulnerability reviews, risk registry reviews and global team meetings.


text: Our information security processes are integrated into our overall enterprise risk management ("ERM") process and system. Our ERM process relies on designated risk managers to identify and assess material risks from cybersecurity threats. The risk managers form a multidisciplinary group including members of our IT security, finance, human resources and legal functions, operations and executive management, and are responsible for timely reporting of risks on an ongoing basis. Our ERM process includes an annual evaluation and ranking of the top risks captured in our ERM system against leading third party benchmark reports on global risks.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to support a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. These attacks are increasing in frequency, uniqueness and sophistication to evade detection and remove forensic evidence of the incident, including due to emerging technologies such as artificial intelligence and machine learning, which may cause cybersecurity incidents to be more difficult to detect for periods of time or at all. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the quality and effectiveness of the control and enterprise risk management processes of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives reports and engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and reasonably manage these risks, including those that may result from material cybersecurity threats. The Audit Committee also receives reports on material cybersecurity and data privacy incidents (if any), which would include plans to mitigate and respond to such incidents, and status on key information security initiatives. These discussions include the Company's enterprise risk assessment and risk management policies.


text: The Technology Committee of the Board of Directors oversees the management of risks associated with the Company's products and technologies, including cybersecurity risks related to new product technologies or significant innovations to existing product technologies, in accordance with its charter.


text: Our Vice President & Chief Information Officer (the "CIO") leads our global information security organization and reports to the Board of Directors on matters related to cybersecurity on behalf of the Company's management. Our CIO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large industrial and technology companies.


text: Our CIO leads an internal IT Security Committee that meets regularly to oversee company-wide efforts to address cybersecurity threats, to assess the effectiveness of our information security program and to prioritize efforts to improve our security measures and planning. Our IT Security Committee includes members of our IT security function and executive management of our legal, finance and internal audit/risk, human resources and corporate communications and technology functions.


text: Risk Management and Strategy City Office REIT recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: City Office REIT, Inc.


text: The Company has integrated cybersecurity risk management into our overall risk assessment framework to identify, evaluate and manage cybersecurity threats and risks. Our CFO works closely with our IT service provider and internal auditors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.