text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO") and supervised by its Chief Information Officer ("CIO"). The Company's cybersecurity program is a component of its overarching enterprise risk management program and interfaces with other functional areas within the Company, including, but not limited to, legal, accounting, risk management, human resources, internal audit, as well as external third-party partners, to identify, understand, and combat potential cybersecurity threats. Our cybersecurity program is aligned with three recognized control frameworks: ISO 27001; 2013, NIST SP 800 – 52; and the Center for Internet Security Top 20 Critical Security Controls. We conduct ongoing and robust testing of our systems, including penetration testing, internal and external audits, tabletop incident response exercises, and an annual Cyber Risk Assessment, the results of which are shared with the Audit Committee.

companyName: GMS Inc.

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We provide regular awareness training to our employees and contractors, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems. The Company also maintains a cybersecurity insurance policy and has engaged a third-party incident response consultant and legal counsel.

stage1Method: majority


text: Cybersecurity Incident Response Process We maintain and actively update our Cybersecurity Incident Response Plan to triage, contain, and mitigate any issues as quickly as possible. Our Cybersecurity Incident Response Plan includes steps to analyze, and as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on the type and severity of the specific incident. Our Cybersecurity Incident Response Policy ensures that our CIO, and, as appropriate, our senior management team, members of our legal staff and outside legal counsel, our disclosure committee, and members of our Audit Committee or Board of Directors are timely informed of and consulted regarding cyber incidents.


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

stage1Category: Board Governance


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."

stage1Category: Strategy Integration


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.


text: As part of our overall risk management program, we provide training to employees at all levels on cybersecurity awareness and the protection of confidential information. In addition, we have established a cybersecurity incident response process that includes procedures for detecting and responding to cybersecurity incidents. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks, and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations, and financial results" and "Our business may be impacted by information technology system failures or network disruptions, and lack of redundancy."

stage1Category: None/Other


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.


text: In fiscal 2024 the Audit Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Vice President of Systems Engineering, and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.

stage1Category: Management Role


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Vice President of Systems Engineering, Chief Legal Officer, and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.


text: Risk Management and Strategy We have an established cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cyber risk management program is designed to protect the confidentiality, integrity and availability of our systems and the data of our clients, candidates and company. This program and its processes are an integral component of our enterprise risk management ("ERM") program.

companyName: KORN FERRY

ticker: KFY


text: Our cybersecurity program leverages several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization Information Security Management Systems ("ISO 27001"), and the Center for Internet Security Critical Security Controls. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supporting environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than three decades of technology, security and leadership experience across both the public and private sector. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional ("CISSP"). He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.


text: Korn Ferry has invested in a spectrum of security tools and capabilities designed to prevent compromise of our systems and data. These solutions are selected from well recognized industry leaders and encompass a wide range of security capabilities including, among other things, threat detection, prevention, system monitoring, logging, vulnerability assessment, incident and event management, system and cloud configuration and permission management. To validate the effectiveness of our security capabilities and our supporting environment we assess them across multiple dimensions. This includes the use of independent external third-party security firms to conduct external and internal penetration tests, vulnerability assessments, and audits.


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.


text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management ("TPRM") program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.


text: Integral to our cybersecurity processes is our Security Incident Response Plan ("SIRP"), designed to facilitate the timely and accurate reporting of any material cybersecurity incident. The incident management process is designed so that incidents are appropriately categorized and escalated to the Security Incident Response Team ("SIRT") for action and materiality determination. Our SIRT is comprised of senior executives including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, General Counsel and other members as required depending on the nature of the incident. In addition to managing escalated incidents, the SIRT conducts tabletop exercises to simulate various threat scenarios, and outcomes are used to build experience and to refine the SIRP and response approaches. Korn Ferry has also maintained cyber insurance for more than a decade.


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO/IEC 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.


text: Processes to oversee and identify such cybersecurity threat risks associated with third party service providers The Company performs risk assessments on critical third party service providers, software and other tools used in the Company's operations that may have the potential to create material cybersecurity threats to our business.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: Board of Directors Oversight Our Board is responsible for the oversight of the Company's overall ERM program, which includes cybersecurity risks. The Board is briefed at least annually by the Chief Information Officer on the readiness and efficacy of the cybersecurity program. These briefs include a review of the Company's cybersecurity initiatives, key security metrics, business continuity and disaster recovery plans and updates on evolving cyber threats and mitigation plans. These briefs also review significant updates to procedures, policies, and controls used to identify, manage, and mitigate cybersecurity risks. The Board is supported in this oversight by the Audit Committee, which receives regular updates from members of the executive leadership team including the Chief Financial Officer, General Counsel, Chief Information Officer, and the Senior Vice President Internal Audit on emerging cybersecurity risks and issues.


text: Management Oversight Management regularly assesses and identifies potential cybersecurity risks as a key component of the Company's ERM program. The Company's cyber risks are reviewed and prioritized as part of the annual Enterprise Risk Assessment and ongoing quarterly reviews. Changes in these risks are communicated at least quarterly to the Audit Committee. Management further enables regular reviews of systemic, emerging, and ongoing security and data privacy risks through a standing body, the Privacy and Security Executive Committee ("PEC/SEC") which meets quarterly and whose reporting is used to inform the Audit Committee and annual reporting to the Board of Directors. The PEC/SEC is comprised of senior management including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, Chief Human Resources Officer, General Counsel and other senior leaders as required.


text: Risk Management and Strategy Description of Company's processes for assessing, identifying and managing cybersecurity risks The Company takes an integrated, holistic approach to managing risks that pose a significant threat to the Company's business, which includes, but is not limited to its personnel, assets and revenue, as well as those of its clients and vendors. Those assets include systems, networks and data of our clients and our Company, as well as our employees, our application software, our confidential information and other forms of our intellectual property, among other examples. Cybersecurity threats are an important, but not all-inclusive, risk to the Company's business.


text: The Company's Enterprise Risk Committee provides high-level guidance and direction regarding the assessment, identification and management of cybersecurity risks. Key members of the Enterprise Risk Committee, such as our Chief Executive Officer, Chief Financial Officer and General Counsel, participate in all or substantially all of the meetings of the Committee and make decisions to address cybersecurity and non-cybersecurity risks across the enterprise on a prioritized basis. The Committee meets regularly, usually on a quarterly basis, to reassess the risks facing the Company, as cybersecurity and other risks change from time to time, both in their nature and potential impact to the Company. The Company identifies cybersecurity risks through a layered system of automated and human-staffed monitoring systems and controls, as well as through guidance from internal and external subject matter experts. Potential cybersecurity incidents are subsequently assessed through both automated and human-staffed systems and controls that prioritize event review based on their likelihood or probability of occurrence, together with their potential harm or impact.


text: Beyond identification and assessment, the Company uses automated and human-staffed monitoring and other systems to respond to and otherwise manage cybersecurity threats and potential cybersecurity incidents. The Company has developed and implemented practices and policies that will guide the Company through responding to actual and suspected cybersecurity incidents.


text: Training the Company's personnel is a vital part of how the Company manages cybersecurity threat risks. Effective training can both prevent cybersecurity incidents from occurring and can also enable the Company to rapidly and effectively respond to an actual cybersecurity incident through fast reporting. Company personnel are required to participate in new hire, annual and monthly training. In regular town hall meetings, a member of our information security team speaks to the entire Company, focusing Company personnel's attention on a specific risk or scenario in real-time, with the opportunity for Company personnel to ask questions. In addition, on an on going-basis, the Company's information security team has and will test Company personnel to see how they respond to phish emails or similar communications that originate from the Company.


text: Integration into the Company's overall risk management system or processes To take a holistic perspective on risk, the Company's processes regarding identification, assessment and management of cybersecurity risks are integrated into the Company's overall risk management system and processes. As a result, as examples, the Company's insurance programs, standard and negotiated contract terms with clients and vendors, operational processes, other procedures, and communication protocols in the event of a crisis take into account both cybersecurity threat and non-cybersecurity threat risks, with differentiation based on the nature of the risk.


text: Engagement of assessors, consultants, auditors, or other such processes by the Company The Company engages outside consultants to conduct vulnerability scans and penetration tests to help the Company find and then mitigate cybersecurity threats. As noted above in Item 1 Business under the sub-heading Data Security, the Company also uses an external auditor to conduct an annual SOC 2 Audit.


text: Cybersecurity Risk & Material Effects on the Company The Company does not believe that any risks from past cybersecurity incidents have materially affected the Company or are reasonably likely to materially affect the Company. As to ongoing risks from cybersecurity threats, see Item 1A, "Risk Factors."


text: The Board's oversight of risks from cybersecurity threats The full Board of Directors receives a report from the Company's Enterprise Risk Committee in connection with each of their quarterly, regularly scheduled meetings. Twice a year, an executive employee member of the Committee presents during those Board meetings, with the opportunity for the Board to ask questions and engage in discussions regarding risks and cybersecurity threats, and the Company's plans and efforts to address them. The materials presented to the Board may include, among other topics, updates and information regarding risk controls and related initiatives, cybersecurity monitoring data, cybersecurity threats and related risks, our SOC 2 Audit, and cybersecurity insurance. Our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, who are members of our Enterprise Risk Committee, regularly attend Board meetings and are available to liaise between the Board and the rest of the Enterprise Risk Committee, should the Board have additional questions or concerns that need to be addressed.


text: Management's role in assessing and managing material risks from cybersecurity threats The Company's Enterprise Risk Committee, described above, includes our Chief Executive Officer, Chief Financial Officer, General Counsel and our Chief Technology Officer. Depending on the nature of the risk at issue, other managers and employees of the Company may participate in the work of the Enterprise Risk Committee. As to cybersecurity threat risks, the following individuals play a role: • Chief Financial Officer and Executive Vice President Information, Technology & Risk – The Company's information security and information technology team reports to our Chief Financial Officer ("CFO"). For example, our EVP Information, Technology & Risk reports to our CFO ("EVP, IT & Risk"). Our Chief Financial Officer and EVP, IT & Risk have familiarity with cybersecurity matters, appropriate for their position. Our EVP, IT & Risk is a member of our Enterprise Risk Committee as to cybersecurity threat risks and also participates in Board discussions regarding those risks. • Manager, Information Security – Our Manager, Information Security identifies, assesses and manages our day to day cybersecurity threats and related risks on a daily basis. He reports to the EVP, IT & Risk and is a member of our Enterprise Risk Committee as to cybersecurity threat risks and has eight years of experience as an information security professional. • General Counsel – Our General Counsel has experience advising on cybersecurity-related matters, including cybersecurity incidents, cybersecurity risk program design and execution. He is also experienced in other related cybersecurity risk management practices, such as engaging with outside advisors and risk managers, among other examples.


text: How the Enterprise Risk Committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents The Enterprise Risk Committee meets on a regular basis at least quarterly to review and assess the Company's cybersecurity threat risk and other risk posture, new controls and initiatives to prevent or mitigate cybersecurity threat risks and potentially evaluate relevant Company policies. Where appropriate, other managers and personnel participate in Committee meetings. Members of the Committee inform the Board, as noted above.


text: Risk Management and Strategy We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. Our cybersecurity policies and processes are integrated into the Company's enterprise risk management program. We have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology is responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.


text: To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: Our cybersecurity risk management program includes: • dedicated third-party cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents; • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required); • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident; • annual information security training program for all employees, including phishing awareness training; • working closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology; • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing; and • a third-party risk assessment process for service providers, suppliers, and vendors.


text: Risks from cybersecurity threats are integrated into AngioDynamics' enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, A cyber-attack or other breach of our, our distributors, or our supply chain partners' information technology systems could have a material adverse effect on our business, financial condition and/or results of operations.


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Board of Directors receives regular updates on the Company's cybersecurity risk management program from the SVP of IT.


text: The Company maintains a cybersecurity program that is designed to identify, detect, assess and manage cybersecurity risks. The Company's senior management and its Board are actively involved in the oversight of the Company's risk management program, of which cybersecurity is an important part. The Company's cybersecurity program, which aligns to the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") includes, among other things: • regular internal and external penetration testing of our technology environments at the application, infrastructure and network level, covering the systems, products and practices collecting or storing confidential business and personal information— including user data—in accordance with the Company's security policies. This testing is conducted multiple times a year by third-party firms; • third-party provider security assessments to evaluate associated risks and appropriate internal and third-party provider security controls; • processes to manage security risks and vulnerabilities; • mandatory company-wide cybersecurity compliance and information handling training; • a documented cybersecurity incident response plan that establishes procedures, roles, responsibilities and communication protocols for internal staff and external resources in the event of a cybersecurity incident; • cybersecurity tools that assist with the automation and orchestration of security alert response based on the relative risk; and • threat intelligence sharing relationships with industry partners, peers, and government agencies, as needed and appropriate.

companyName: Fox Corp

ticker: FOXA


text: FOX's cybersecurity program is based on recognized best practices and standards applicable to our industry. The Company engages a third-party firm to assess the overall maturity of its program against the NIST Framework on a bi-annual basis. This evaluation includes an assessment of how the program evaluates and mitigates risk, as well as how it compares against industry benchmarks. The results of this evaluation are provided to the Audit Committee of the Board.


text: The Company's Chief Information Security Officer ("CISO") leads the Company's dedicated information security department, which monitors FOX's prevention, detection, mitigation and remediation efforts related to cyber threats. The CISO regularly consults with the Company's Co-Chief Privacy Officers, and the Company's Chief Technology Officer ("CTO") provides additional oversight of the cybersecurity program, and previously served as the Company's CISO. The CISO has over 15 years of experience in cybersecurity, information security and technology, including a background in broadcast media and networking and systems engineering, and has held numerous industry certifications.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems, internal networks and information.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: The CISO is in regular communication with senior management regarding cybersecurity matters and provides frequent routine (generally weekly) updates to the Company's Executive Chair and Chief Executive Officer, Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), CTO and Chief Legal and Policy Officer. As part of the Company's incident response plan process, cybersecurity risk events of a certain criteria are communicated in a timely manner to the Company's incident response governing body, which is comprised of members of senior management, including the COO, CTO, and CFO. The Company tests the effectiveness of the incidence response plan and assesses its response capabilities by conducting executive tabletop exercises involving detailed topical cybersecurity scenarios with these executives, as well as technical tabletop exercises including technical and operational personnel. The Company also has processes in place that are designed to ensure that decisions regarding public disclosure and reporting of cybersecurity incidents can be made in a timely manner.


text: The Company's Board has an active role, as a whole and at the committee level, in overseeing the management of the Company's risks. The Audit Committee of the Board is responsible for (i) overseeing the Company's policies and practices with respect to risk assessment and risk management, including with respect to cybersecurity and the use of AI, (ii) overseeing the Company's financial and other major risk exposures and the steps taken to monitor and control them, and (iii) providing guidance to the Board on such matters.


text: The Audit Committee regularly reviews and discusses FOX's cybersecurity risks and receives updates from the CISO on how the Company identifies, assesses and mitigates these risks. The CISO provides the Audit Committee with quarterly reports regarding cybersecurity issues and risks, including information regarding progress on efforts to strengthen and enhance the Company's cybersecurity program. The Audit Committee also periodically devotes additional meeting time, as needed, to in-depth discussions on a particularly relevant cybersecurity topic, including industry trends and relative risks. In addition to the quarterly reports, cybersecurity incidents meeting certain criteria are reported to the Audit Committee outside of regularly scheduled quarterly updates as necessary.


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has been material to the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."


text: Risk Management and Strategy Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), which is an executive management-level cross-functional group.


text: We regularly engage independent third parties to assess our cybersecurity program and practices, and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is appropriate.

stage1Category: Third-Party Risk


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information systems have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board oversees our enterprise risk management program and practices, and the Audit Committee assists the Board in its oversight of cybersecurity matters. Quarterly updates are presented to our Audit Committee by our Chief Information Security Officer ("CISO") on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess, and manage our key cybersecurity programs and risks, and, as necessary, responses to any significant cybersecurity incidents.


text: Our cybersecurity program is led by our CISO who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and hold professional certifications, including Certified Information Systems Security Professional ("CISSP").


text: As noted above, we also maintain a Cybersecurity Steering Committee, or CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Executive Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Senior Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC group has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of the cybersecurity initiatives within Lumentum and is responsible integrating cybersecurity risk management practices with critical business processes so that cybersecurity is appropriately addressed throughout Lumentum.


text: Risk Management & Strategy Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers. While cybersecurity is a dynamic and constantly evolving field, we strive to minimize the occurrence and impact of unauthorized access, disruption to our information systems and are committed to staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessment and incidents. We deploy and manage both preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. We also deploy and manage preventive and detective controls and processes related to the mitigation of risks from our use of third-party service providers.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Our organization undergoes annual reviews by third-party consultants to help assess the implementation and operational effectiveness of the security controls implemented in our service environment which is in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC").


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. Results of this testing is included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO, CIO and CTO as appropriate.


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). He worked in various information security roles at other large public traded companies.


text: The CISO and CTO report to the Board of Directors who have ultimate responsibility in overseeing enterprise risks, including cybersecurity threats.


text: We have aligned our cybersecurity risk management program with recognized security frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and ISO standards. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use these frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • an information security incident response plan that includes procedures for responding to cybersecurity incidents; • an incident response team (the "Response Team") principally responsible for managing our response to cybersecurity incidents; and • a third-party risk management process for key IT vendors based on our assessment of their criticality to our operations and respective risk profile.


text: During 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected us, including our business strategy, results of operations or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, and if realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in "Item 1A. Risk Factors."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity and Technology Risk Management Committee of the Board of Directors (the "Cybersecurity Committee") oversight of cybersecurity and other information technology risks. The Cybersecurity Committee oversees management's implementation of our cybersecurity risk management program.


text: The Cybersecurity Committee receives regular reports from our Chief Information Officer ("CIO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO periodically reports to the Board of Directors regarding cybersecurity risks and our cybersecurity risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has over two decades of IT experience, including in applications, infrastructure, development, security and governance, and has presented as a featured speaker at numerous IT and security conferences. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Response Team, including our CIO and other members of our management team, has primary responsibility for assessing and managing our response to cybersecurity incidents.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We are committed to reducing the risk of cybersecurity compromise, either intentional or unintentional, to our customers, employees, and company proprietary information resources.

companyName: JABIL INC

ticker: JBL


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses routine risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results. • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems.


text: • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.


text: The Board oversees risk management directly and through its committees. Generally, the Board oversees risks that may affect the business of Jabil as a whole, including operational matters. The Cybersecurity Committee ("the Committee") assists the Board in fulfilling its oversight responsibilities with regard to the Company's cybersecurity programs and risks, including the cybersecurity practices, procedures, and controls management uses to identify, assess, and manage the Company's key cybersecurity programs and risks, to protect the confidential intellectual property information and data of the Company and its customers and to comply with applicable data protection laws and regulations.


text: The Committee of the Board meets quarterly. At each meeting, it receives reports from the Chief Information Security Officer ("CISO").


text: As part of its role in overseeing risk management, the Committee periodically reports to the Board regarding briefings provided by management and advisors as well as the Committees' own analysis and conclusions regarding cybersecurity risks faced by the Company. The Committee will review with management and the Board, and advise them regarding the following matters, as necessary: • Management's implementation of cybersecurity programs, policies, and procedures and management's actions to safeguard their effectiveness; • The effectiveness of the Company's cybersecurity programs and its practices for identifying, assessing, and mitigating cybersecurity risks across all business functions; • The Company's controls to prevent, detect and respond to cyber-attacks or information or data breaches involving the Company; • Cyber crisis preparedness, incident response plans, and disaster recovery capabilities; • Reports and presentations received from management and the Company's advisors regarding the management of cybersecurity programs and risks, including protection of confidential intellectual property, information, and data.


text: The CISO leads the Corporate Information Security organization which oversees the security posture of Jabil's data, networks, and resources. The CISO is responsible for notifying and providing updates on cybersecurity incidents to the Chief Information Officer ("CIO"). The CIO is responsible for overseeing global IT operations and digital transformation across the Company and leads the strategic direction on IT polices to safeguard company and client assets against cybersecurity threats.


text: The CISO has over 38 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 32 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and managed through a multi-faceted approach including third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: We employ an experienced team of cybersecurity professionals with a variety of backgrounds. We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including: SOC 1, SOC 2 Type II, ISO 27001, CSA STAR Level 2, PCI-DSS and others.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Audit Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also makes available to clients attestations of its various certifications, audits, and penetration tests.


companyName: Tesla, Inc.

ticker: TSLA


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. Additional information on the cybersecurity risks that could materially affect us is discussed in Part I, Item 1A, "Risk Factors."


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the Executive Vice President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents if and when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems it controls from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including any required public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board of Directors' responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board of Directors is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board of Directors.


text: As part of its oversight of the Company's risk management noted above, the Audit Committee oversees, reviews and discusses with management the Company's risks from cybersecurity threats and management's role in assessing and managing such risks. The Audit Committee receives regular presentations, reports and updates from the CISO and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics.


text: The Company's processes also allow for the Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management at any time it deems appropriate to discuss matters relevant to the Audit Committee. The Company's policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is involved in the oversight of the Company's enterprise risk management program, including risks of cybersecurity threats. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on ensuring the implementation of effective and efficient controls, technologies, and other processes to assess, identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: Steel Connect LLC


text: Cybersecurity risk management and strategy As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program includes: • Collaboration: Through ongoing communications with management and the IT department of Steel Holdings, the Company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Data Breach Response Team, who will then report to the Audit Committee when appropriate. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Managed Security Service Provider ("MSSP"): The Company has an Agreement in place with a third-party managed security service provider. They provide strategic and technical services helping our business manage cyber risk and improve security posture. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Data Breach Response Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company or its financial position, results of operations and/or cash flows.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's overall cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness. The Company's management reports to the Audit Committee as part of every quarterly scheduled meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad enterprise risk management program.


text: The Company's IT department, in coordination with the Company's legal department, Chief Financial Officer ("CFO"), and as needed Steel Partners Holdings' IT department (collectively, the "Data Breach Response Team"), works collaboratively to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Policy. The Company's response planning is reviewed annually and kept up to date with industry developments.


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 26 years. Additionally, he stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques as staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.


text: Risk Management and Strategy We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. This includes multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify cybersecurity risks in our IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.


text: A multi-functional enterprise cyber security and Infrastructure team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the CFO and Senior Vice President ("SVP"), IT, and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.


text: Our Chief Information Officer ("CIO") together with our Senior Director of IT Infrastructure, Security and Compliance and other members of the Information and Business Technology ("IBT") Security team, are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our Security Incident Response Policy ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.

companyName: Twist Bioscience Corp

ticker: TWST


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a combination of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber threat intelligence, insights and assessments of its cybersecurity risk posture and governance.


text: The Company's third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, the Company's cybersecurity team conducts reviews of its third-party vendors depending on the vendor's risk profile as determined by its cybersecurity team.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. However, as of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we have faced in the past and expect to continue to face in the future, please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST 2.0 cybersecurity framework.


text: Our Board of Directors are part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.


text: Management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks.


text: Internal Cybersecurity Team The Information Security organization reports into the SVP, IT and includes a dedicated team of centralized information security experts with extensive cybersecurity knowledge and experience to manage the cyber risk under the leadership of the Director of Information Security.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy Network security configurations Risk Management and oversight of third parties


text: Incident Response We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. Internal reporting and escalation protocols are in place to ensure the involvement of the SVP, IT, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: Risk Assessment and Management We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data.


text: Furthermore, we maintain a process to evaluate and manage risks associated with third-party service providers. We conduct cybersecurity assessments of our key vendors before engagement, maintain continued monitoring during the engagement, and maintain the ability to discontinue our engagement with a key vendor if their cybersecurity posture fails to meet pre-established standards.

companyName: MEDIFAST INC

ticker: MED


text: Our cybersecurity program is based on the International Organization for Standardization ("ISO") 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 "Guide for Conducting Risk Assessments" that provide guidelines and principles for information technology security risk management.


text: Incident Response We have a dedicated Information Security team within the IBT team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including Legal and Finance, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape. We refine and mature our cybersecurity roadmap and strategy based on findings and their risk standing.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company maintains a formal risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring.


text: Material Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems, or fail to implement new systems and software successfully, our business could be adversely affected. Cyberattacks and security vulnerabilities could lead to reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Board would be informed of an incident by our executive team.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 13 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: RISK MANAGEMENT AND STRATEGY Our approach to cybersecurity risk is based on processes that monitor threats, adapt our capabilities and services, and align our practices with business goals in order to provide security controls that reduce information security risk to the organization and customers.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: We implement and maintain controls and capabilities for identifying, assessing, and managing risk from cybersecurity threats to the confidentiality, integrity, or availability of our information systems or any information residing therein. We also carry out broad-scope initiatives and project-specific initiatives aimed at continuously improving our cybersecurity posture. Our risk assessments and initiatives include identification of reasonably foreseeable internal and external risks, assessing the likelihood and potential impact that could result from such risks, and planning and implementing risk management controls as applicable. As a result, we adapt safeguards and processes in order to reduce identified risks in our security posture. Our cybersecurity processes form a part of our overall risk management practices and inform our annual enterprise risk assessment conducted by our internal audit team.


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby Millicast in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. We also take part in periodic security audits by our clients and partners.


text: As part of our overall risk management processes, our employees at all levels are trained on foundational cybersecurity practices annually, and periodically participate in various activities aimed at increasing their awareness of cybersecurity threats and reinforcing their understanding of our security policies.


text: Periodically, we engage consultants and other third party service providers in connection with our cybersecurity practices. These service providers assist us in event monitoring, conduct testing and provide feedback on our readiness and compliance, conduct tabletop exercises, and are "on-call" in the event of a significant event. We have implemented a third-party risk management process that we use to evaluate the capabilities and security posture of third-party service providers. As part of that process, we review third-party service providers to ensure that they have implemented appropriate security measures in connection with their work with us. We have not encountered any cybersecurity incident that had a material impact on our operations or financial standing.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, under the heading "Operations".


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee, which has responsibility for overseeing the adequacy and effectiveness of our cybersecurity and information security programs and policies according to its charter.


text: Our CISO is primarily responsible for assessing and managing our risks from cybersecurity threats. Our CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity strategy and operations, incident response, cybersecurity education and awareness, threat management, insider threats and regulatory compliance. Our CISO has over 25 years of experience in technology, with more than 15 years in information security, holding multiple roles including five years as a CISO for a health insurance company. Our CISO reports on cybersecurity risk management and other matters to our CIO, who in turn reports to our Chief Executive Officer. Along with our CISO our security, privacy, audit, risk and compliance council ("SPARC Council"), which is a collection of stakeholders from various functions including cybersecurity, legal, IT, engineering, finance, procurement and audit, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our CISO and our SPARC Council review the results of assessments, including security simulations and tabletop exercises, and discuss and recommend improvements to our policies and processes. In addition to the general reporting structure applicable to our CISO, the other members of the SPARC Council report on those activities through the reporting lines applicable to them, as needed.


text: Our CISO along with our CIO typically provide quarterly briefings to the Audit Committee regarding our company's cybersecurity risks and activities, including recent cybersecurity incidents and strategy development. The findings from our annual enterprise risk assessment are also presented to the Audit Committee by our internal audit team. Our Audit Committee provides regular updates to the Board of Directors on such reports. In addition, our CISO along with our CIO typically provide annual briefings directly to the Board of Directors on cybersecurity risks and activities.


text: Cybersecurity continues to be a particularly acute area of risk for companies of all sizes and in all industries, including us. Our management and board of directors recognize the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Both management and our board of directors are actively involved in our enterprise risk management, and cybersecurity represents an important component of our overall approach to enterprise risk.

companyName: AZEK Co Inc.


text: Cybersecurity Risk While we have not experienced a material impact on our business strategy, results of operations or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws, which could have a material adverse effect on our business, results of operations and financial position.


text: We expect risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransomware attacks, other cyber-attacks, or other similar threats, to continue as events of this nature become more sophisticated and potentially more frequent, and the techniques used in such attacks change rapidly.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.