text: Mr. Perlman leads software development, security, technical integration, and IT. His scope includes software design and development for customer service agent, field technician, and customer self-service applications. Mr. Perlman joined Charter as a Senior Vice President in 2016, initially overseeing Video and Shared Software Services. He added Video Engineering, Voice Engineering, Lab Infrastructure and Deployment Support to his team in 2019. Before joining Charter, Mr. Perlman served as Chief information Officer for Bright House Networks, where he oversaw all of IT including Billing System Management, Software Development, Online Development, Internal IT, Information Security, and other functions. Prior to that, he held various IT roles at CenturyLink. Mr. Perlman holds a bachelor of arts from Brown University and a master of business administration from the University of Colorado – Boulder Leeds School of Business.


text: Mr. Temm joined Charter in 2020 as Group Vice President, IT Security, where he maintained responsibility for cybersecurity across our IT infrastructure, leading cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness. Previously, Mr. Temm was Chief Information Risk Officer for the Financial Services-Information Sharing and Analysis Center (FS-ISAC) where he collaborated with global financial services companies – foremost cybersecurity providers, law enforcement and government agencies – to protect the financial services sector against cyber and physical threats while coordinating responses to sector-wide incidents. Prior to FS-ISAC, Mr. Temm spent nearly two decades with Mastercard, serving in various leadership roles in cybersecurity, corporate security, network operations and debit operations. He holds a bachelor of science in business administration from Lindenwood University, where he graduated with Great Distinction. He is also a Certified Information Systems Security Professional ("CISSP").

companyName: CCO HOLDINGS LLC

secItem: Item 1C


text: Risk Management and Strategy Cybersecurity risks are classified as a Tier 1 risk within our enterprise risk management program. We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments.


text: Our cybersecurity program employs various risk-tracking tools, industry data, monitoring, detection and response tools, vulnerability scanning, security dashboards and scorecards and other tools to support our continued evaluation of cybersecurity threats and regulatory requirements. Our cybersecurity program addresses the continuously evolving and extensive attack vectors and methods through layered security controls informed by constant threat analysis. Threats include a wide variety of perpetrators aiming for political, personal or financial gain, utilizing a broad set of tactics including ransomware, advanced malware, DDoS, account takeover, phishing/SMSing and social engineering, among others. These risks threaten our internal systems as well as third-party systems that we use and rely upon for the delivery of services and support of our operations. Our risk mitigation techniques include technology risk management, network segmentation, deployment of enhanced detection tools across our network, systems, databases, and applications and monitoring compliance with security standards.


text: Various security standards provide guidance to telecommunications companies in order to help identify and mitigate cybersecurity risks, including the voluntary framework released by the National Institute for Standards and Technology ("NIST") in 2014 and updated in 2018, in cooperation with other federal agencies and owners and operators of U.S. critical infrastructure. The NIST cybersecurity framework provides a prioritized and flexible model for organizations to identify and manage cyber risks inherent to their business. Our security infrastructure is comprised of multiple security capabilities designed with a defense-in-depth model informed by the NIST cybersecurity framework, as well as a variety of other industry standards and best practices. The risk-based approach of the NIST cybersecurity framework has enabled us to implement cybersecurity programs tailored to our particular network architectures, customer environments and institutional resources.


text: Our cybersecurity risk management program also attempts to assess third-party vendor, service provider, business partner and supply chain risk management issues. Our efforts aim to better understand the cybersecurity posture of our third-party vendors, service providers, business partners and suppliers by analyzing their cybersecurity risk management programs. Our third-party cybersecurity risk management processes include reviewing and revising our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, our agreements require our third-party providers to abide by specific privacy, confidentiality and security processes, particularly for third-party data-processing activities. For vendors that offer software as a service solutions involving personal information, our third-party risk management program generally requires third-party attestation of their security practices such as a System and Organization Controls 2 report or ISO 27001 certification. Our due diligence and selection processes also require third parties to complete a cybersecurity and data privacy questionnaire that includes questions about contractor track record. Our third-party security reviews are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. For further discussion of cybersecurity risks, see "Part I. Item 1A. Risk Factors – Risks Related to Our Business – Various events could disrupt or result in unauthorized access to our networks, information systems or properties and could impair our operating activities and negatively impact our reputation and financial results."


text: Our organizational objectives are aligned to address our cybersecurity risks and management plays a pivotal role in assessing and managing our material risks from cybersecurity threats. Management's role in assessing and managing material cybersecurity risks includes various management positions and committees responsible for assessing such risks. Our internal processes require escalation of material cybersecurity risks to our executive leadership and Charter's Board of Directors, as well as management and committees who are tasked with the prevention, detection, mitigation and remediation of cybersecurity incidents. These processes provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification to a state and/or federal agency or affected customers.


text: Charter's Board of Directors has delegated to the Audit Committee oversight of our privacy and data security, including cybersecurity, risk exposures, policies and practices, including the steps management have taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. Charter's Audit Committee receives quarterly updates on the enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates or internal audit observations, if applicable.


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and technology operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.


text: Our Executive Vice President, Technology Operations and our Executive Vice President, Software Development & IT collectively oversee our cybersecurity program. Our Executive Vice President, Technology Operations is responsible for operating our customer product technology infrastructure across our 41-state footprint. He has served in various network operations roles at Charter since 2016 and previously held various engineering roles at other large public companies. Our Executive Vice President, Software Development & IT leads software development, security, technical integration, and IT. He has served in various software and engineering roles at Charter since 2016, and has previously held various IT roles, including chief information officer, at other telecommunications companies.


text: Our Chief Information Security Officer ("CISO") is a Certified Information Systems Security Professional and has served in various roles in information security at Charter since 2020. He has over two decades of experience in cybersecurity, corporate security and network operations, including cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness.


text: Board of Directors The Board of Directors ("the Board") has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Board and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The Board and Audit Committee are updated on a quarterly basis by Vice President, Corporate Services on the Company's internal information technology ("IT") security testing, any unauthorized attempts to access the Company's network, any significant developments in cyber security risks and threats, and updates on the Company's policies and procedures for protecting the Company's data. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee. All incidents are reported to the Executive Officers (including the President and Chief Executive Officer, Chief Financial Officer and the Chief Operating Officer) who assess the severity and what measures and procedures are necessary.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE

stage1Category: Board Governance

stage1Method: majority


text: As part of the Company's enterprise risk management, the Board of the Company receives, reviews and assesses reports from the Board's committees and from management relating to enterprise-level risks. The Audit Committee reports its cybersecurity risk assessments to the full Board at each regularly scheduled Board meeting.

stage1Method: unanimous


text: The Executive Officers and Vice President, Corporate Services are involved in all significant and appropriate cybersecurity decisions on the implementation and design of our IT architecture. Vice President, Corporate Services, along with support from the Director of IT, is responsible for the assessment and management of risks from cybersecurity threats and oversees the implementation of IT processes, which includes cybersecurity, into the core business of the Company. The Director of IT has extensive cybersecurity knowledge and skills gained from over 20 years of relevant work experience. The Director of IT discusses all potential changes to the Company's controls or detection systems with the Vice President, Corporate Services prior to implementation. The Vice President, Corporate Services is updated by the Director of IT on a regular basis regarding trends in technology and cybersecurity threats or any potential changes to the Company's cybersecurity program. The Director of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a number of experienced direction systems and third party cybersecurity providers. The Vice President, Corporate Services also attends certain meetings of the Audit Committee to report information on material risks from cybersecurity threats. None of our critical core business activities that impact production, transportation or sales of oil and gas are remotely controlled.

stage1Category: Management Role


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, mitigate and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. As part of this program, we have processes in place that include a variety of controls, systems, and technologies designed to prevent or mitigate data loss, theft, misuse, or other cybersecurity incidents affecting the data we collect, process, store, and transmit as part of our business. We conduct penetration testing and cybersecurity audits, and require all employees to undertake data protection and cybersecurity training on an annual basis. We also use systems and processes designed to oversee and identify risks associated with our use of third-party service providers, including with respect to the occurrence of a cybersecurity incident at a third-party service provider or that otherwise implicates a third-party technology or system we use. We contract cybersecurity specialists to review and implement controls and structural mechanisms in order to enhance our cybersecurity program, and protect against and detect cybersecurity threats.

stage1Category: Risk Management Process


text: Board of Directors The Board of Directors ("the Board") has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The Board and Audit Committee are updated on a quarterly basis by Vice President, Corporate Services on the Company's internal information technology ("IT") security testing, any unauthorized attempts to access the Company's network, any significant developments in cyber security risks and threats, and updates on the Company's policies and procedures for protecting the Company's data. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee. All incidents are reported to the Executive Officers (including the President and Chief Executive Officer, Chief Financial Officer and the Chief Operating Officer) who assess the severity and what measures and procedures are necessary.


text: The Executive Officers and Executive Vice President, Corporate Services are involved in all significant and appropriate cybersecurity decisions on the implementation and design of our IT architecture. Executive Vice President, Corporate Services, along with support from the Director of IT, is responsible for the assessment and management of risks from cybersecurity threats and oversees the implementation of IT processes, which includes cybersecurity, into the core business of the Company. The Director of IT has extensive cybersecurity knowledge and skills gained from over 20 years of relevant work experience. The Director of IT discusses all potential changes to the Company's controls or detection systems with the Executive Vice President, Corporate Services prior to implementation. The Executive Vice President, Corporate Services is updated by the Director of IT on a periodic basis regarding trends in technology and cybersecurity threats or any potential changes to the Company's cybersecurity program. The Director of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a number of experienced direction systems and third party cybersecurity providers. The Executive Vice President, Corporate Services also attends certain meetings of the Audit Committee to report information on material risks from cybersecurity threats. None of our critical core business activities that impact production, transportation or sales of oil and gas are remotely controlled.


text: To our knowledge, we have not experienced any risks from cybersecurity threats or incidents through the date of this annual report that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operation or financial condition. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. In particular, sophisticated nation state actors have targeted critical infrastructure, and may continue to do so in the future.

stage1Category: Strategy Integration


text: Additional information on cybersecurity risks we face is discussed in "Risk Factors" in Item 1A, which should be read in conjunction with the foregoing information.


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business processes and decision-making across the Company. Our information technology is connected to support the flow of information across our business processes. As such, our information technology infrastructure is susceptible to cybersecurity threats. We monitor our information security procedures and risk management systems and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, and managing information security risks include: • Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity solution plans, identifies opportunities for the implementation of additional cybersecurity procedures and provides cybersecurity training to our employees and executives. • Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that is inclusive of a cybersecurity risk assessment and provides guidance for remediation of security gaps. • Current Plans and Procedures. The Company has implemented an incident response plan ("IRP") and a Business Continuity Plan ("BCP"). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company's response activities; escalating the Company's response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: • Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks using the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan. • Insurance. We maintain an information security risk insurance policy. • Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis. • Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications. • Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.


text: Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology regularly provides information security updates to named executive officers and briefs our Board of Directors or Audit Committee on relevant information security issues at least twice a year. We also provide periodic cybersecurity training for members of our Board of Directors.


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For further discussion, please see the risk factors titled "Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information and communication systems and system failures and other operational disruptions could significantly disrupt our business, which may, in turn, materially adversely affect our business, financial condition and results of operations and our ability to make distributions to our stockholders" in Part I, Item "1A. Risk Factors" in this Annual Report on Form 10-K.


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business and decision-making across the Company, including supporting the flow of information across our business processes. Our information technology infrastructure is susceptible to cybersecurity threats. We monitor our information technology systems, including through the use of information security procedures and risk management systems, and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, managing and addressing information security risks include: • Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity plans, identifies opportunities for the implementation of additional cybersecurity measures and provides cybersecurity training to our employees and executives. • Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and executive officers and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that includes a cybersecurity risk assessment and provides guidance for remediation of security gaps. • Current Plans and Procedures. The Company has implemented and maintains an incident response plan ("IRP") and a Business Continuity Plan ("BCP"). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company's response activities; escalating the Company's response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.


text: • Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks by using the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan ("DRP"). The DRP prioritizes the swift recovery of information technology systems, data, and infrastructure and the efficient restoration of servers and applications to their normal operational state in the event of a significant disaster. • Insurance. We maintain a breach response insurance policy. • Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis. • Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications. • Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.


text: The security of the Company's products, services and corporate network is a key priority both for the growth of the Company's business and its responsibilities as the leading financial guaranty insurance company. The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. T he Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors.


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our security measures, we cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For further discussion, please see the risk factors titled "Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information and communication systems and system failures and other operational disruptions could significantly disrupt our business, which may, in turn, materially adversely affect our business, financial condition and results of operations and our ability to make distributions to our stockholders" in Part I, Item "1A. Risk Factors" in this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. The Company regularly assesses risks from cybersecurity threats and monitors its computer networks for vulnerabilities. To defend the Company's computer systems from cyberattacks, the Company uses various security tools that are designed to help the Company protect against, identify, monitor, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: The Company maintains an Information Security Policy and Standards that details how material risks from cybersecurity threats are assessed, identified, and managed: • Risk assessment – a periodic risk assessment is performed by the Chief Information Security Officer using the National Institute of Standards and Technology cybersecurity framework and rates risks by criticality. • Risk identification – vulnerabilities and risks are identified through functions performed by the Chief Information Security Officer which includes assessments using automated tools, monitoring activities, reviewing threat intelligence, and responding to incidents. Risks are also identified through independent assessments performed by third-party consultants and the internal audit function. • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board of Directors and management at least semi-annually. The Chief Information Security Officer also presents to the Board of Directors and Risk Oversight Committee on cybersecurity and data privacy matters at least annually.


text: The Company's Information Security Policy and Standards details a process for responding to cybersecurity events. Awareness and alertness are important components of the Company's cybersecurity program; each year employees are required to take the cybersecurity training and the Company conducts regular exercises to educate employees about best practices and help them identify and avoid potential threats.


text: The Company engages third-party consultants to conduct periodic penetration testing designed to identify potential security vulnerabilities. The Company's internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board of Directors.


text: The Company takes measures designed to mitigate risks associated with third-party vendors that have access to confidential information or provide business critical functions. Through its vendor management program, the Company screens these third-party vendors to assess their data security protocols both prior to initial engagement and periodically thereafter for compliance with the program standards.

stage1Category: Third-Party Risk


text: The Company has not experienced any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected, or that it believes are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.


text: The Board of Directors oversees the risk management process, including overall responsibility for overseeing management's establishment and operation of a cybersecurity program. The Board of Directors delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, and to the Audit Committee, whose oversight responsibility includes cybersecurity risks, data privacy and risk management related to the Company's financial systems. The Risk Oversight Committee has specific responsibility for overseeing information technology processes and controls, including for cybersecurity, data privacy, compliance with related policies, and the process to monitor risks to the Company arising from changing technology trends, and coordinates with the Audit Committee, as needed.


text: To that end, the Company has implemented a cybersecurity governance structure. The Board of Directors, some of whose members have broad-based skills in risk and management oversight and/or cybersecurity oversight certifications, oversees the risk management process. The Board of Directors employs an enterprise-wide approach to risk management that supports the Company's business plans within a reasonable level of risk. In the Company's view, risk assessment and risk management entail not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for that company. The Board of Directors annually approves the Company's business plan, factoring in risk management. It also approves the Company's risk appetite statement, which articulates the Company's tolerance for risk and describes the general types of risk that the Company accepts or attempts to avoid. The involvement of the Board of Directors in setting the Company's business strategy is a key part of its assessment of management's risk tolerance and a determinant of what constitutes an appropriate level of risk for the Company.


text: While the Board of Directors has the ultimate oversight responsibility for the risk management process, various committees of the Board of Directors also have responsibility for overseeing the Company's risk assessment and risk management process. The Risk Oversight Committee has specific responsibility for overseeing information technology matters, including assessing and managing cybersecurity and data privacy risks, and coordinates with the Audit Committee, which assesses and manages financial risk exposures, including cybersecurity and data privacy risks, as part of its oversight of the Company's system of internal control over financial reporting. As described above in Cybersecurity – Risk Management and Strategy, the Company's Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board of Directors, Risk Oversight Committee, Audit Committee and management at least semi-annually. The Chief Technology Officer reported to the Board of Directors, Risk Oversight Committee and Audit Committee four times in 2023. The Chief Technology Officer has over 25 years of experience in information technology, technology research and security and operations management, with over 15 of those years focused in financial services and insurance. The Chief Technology Officer holds a Master of Science in Information Systems and a Master of Business Administration with a focus in Management and Operations. The Company has appointed a Chief Information Security Officer, who is responsible for leading the assessment and management of cybersecurity risk. In 2023, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board of Directors and Risk Oversight Committee and made four quarterly reports to the Audit Committee. The Chief Information Security Officer has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA). The Chief Information Security Officer reports to the Board of Directors, its committees, and management on cybersecurity threats on a regular basis.


text: The Company uses various tools to prevent, detect, and mitigate cybersecurity incidents. The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of Directors of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company's financial systems.


text: Risk Management and Strategy The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of the Company's decision-making processes. The Company regularly assesses risks from cybersecurity threats and monitors its computer networks for vulnerabilities. To defend the Company's computer systems from cyberattacks, the Company uses various security tools that are designed to help the Company protect against, identify, monitor, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: The Company maintains an Information Security Policy and Standards that details how material risks from cybersecurity threats are assessed, identified, and managed: • Risk assessment – a periodic risk assessment is performed by the Chief Information Security Officer using the National Institute of Standards and Technology cybersecurity framework and rates risks by criticality. • Risk identification – vulnerabilities and risks are identified through functions performed by the Chief Information Security Officer which includes assessments using automated tools, monitoring activities, reviewing threat intelligence, and responding to incidents. Risks are also identified through independent assessments performed by third-party consultants and the internal audit function. • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board and management at least semi-annually. The Chief Information Security Officer also presents to the Board and Risk Oversight Committee on information technology, cybersecurity and data privacy matters at least annually.


text: The Company engages third-party consultants to conduct periodic penetration testing designed to identify potential security vulnerabilities. The Company's internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board.


text: The Company takes measures designed to mitigate risks associated with third-party vendors that have access to confidential information or provide business critical functions. Through its vendor management program, the Company screens these third-party vendors to assess their data security protocols both prior to initial engagement and periodically thereafter for compliance with the program standards. The Company seeks contractual obligations from third-party vendors to notify it in the event of a cybersecurity incident, and monitors threat intelligence reports as well as current reports of SEC-registered vendors and their sub-service providers that have access to confidential information or provide business critical functions for cybersecurity incidents.


text: Under the Company's cybersecurity governance framework, the Board has overall responsibility for overseeing management's establishment and operation of a cybersecurity program. Members of the Board have broad-based skills in risk management oversight and/or cybersecurity oversight certifications. The Board delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, including assessing and managing cybersecurity and data privacy risks, and to the Audit Committee, whose oversight responsibility includes, as part of its oversight of the Company's system of internal controls over financial reporting, assessing and managing financial risk exposures, including information technology, cybersecurity and data privacy risk related to the Company's financial systems. The Risk Oversight Committee has specific responsibility for overseeing information technology processes and controls, including for cybersecurity, data privacy, compliance with related policies, and the process to monitor risks to the Company arising from changing technology trends, and coordinates with the Audit Committee, as needed.


text: The security of the Company's products, services and corporate network is a key priority both for the growth of the Company's business and its responsibilities as the leading financial guaranty insurance company. The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations. As described above in Cybersecurity – Risk Management and Strategy, the Company's Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board, Risk Oversight Committee, Audit Committee and management at least semi-annually. The Chief Technology Officer reported to the Board, Risk Oversight Committee and Audit Committee four times in 2024. The Chief Technology Officer has over 25 years of experience in information technology, technology research and security and operations management, with over 15 of those years focused in financial services and insurance. The Chief Technology Officer holds a Master of Science in Information Systems and a Master of Business Administration with a focus in Management and Operations. The Company has appointed a Chief Information Security Officer, who is responsible for leading the assessment and management of cybersecurity risk. In 2024, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board and made four quarterly reports to the Risk Oversight Committee and the Audit Committee. The Chief Information Security Officer has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA). The Chief Information Security Officer reports to the Board, its committees, and management on cybersecurity threats on a regular basis.


text: The Company uses various tools to prevent, detect, and mitigate cybersecurity incidents. The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company's financial systems.


text: First Solar maintains a cyber risk management program designed to identify, assess, and manage cybersecurity risks. The underlying controls of the cyber risk management program incorporate recognized best practices and standards for cybersecurity, including guidance from the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cyber risk management program includes various risk assessments that are completed on a regular basis, including (i) information security controls assessments with internal and external audit partners, (ii) architectural and technical assessments with third-party experts, (iii) internal and external penetration testing with third-party service providers, (iv) continuous cyber risk register reviews, and (v) risk prioritization with our executive officers. The identification of cybersecurity risks is aided by a technical toolset as well as threat hunting and counterintelligence services provided by third-party service providers. These risk assessments and the technical toolset inform our information security roadmap, which allocates resources toward strategic initiatives to mitigate, transfer, and/or reduce cybersecurity risks. Our associates engage in annual cybersecurity training and periodic phishing simulation exercises with targeted training. Additionally, confidential information protection training is regularly provided to associates who have access to personally identifiable information, reside in certain jurisdictions, or have privileged access.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: Third-party risk management at First Solar includes screening processes to evaluate the information security programs and capabilities of our vendors, including periodic reviews of vendor control assessments, such as System and Organization Controls ("SOC") 2 Type 2 reports, which are supplemented by end-user controls performed by First Solar associates. These processes enable us to oversee and identify potentially material risks from cybersecurity threats associated with our use of third-party service providers.


text: The Head of Information Security oversees the Information Security team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Information Security and our Information Security team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Information Security, who has over 20 years of information technology experience, including over 10 years in leadership roles at First Solar, reports to the Chief Information Officer and regularly briefs the Chief Financial Officer and the audit committee of the board of directors on cybersecurity matters. The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar's major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of senior management from various departments, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

companyName: EXAGEN INC.

ticker: XGN


text: The Information Security team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar's Information Security team to protect our information technology environment. Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.


text: As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, "Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations."


text: First Solar maintains a cyber risk management program designed to identify, assess, and manage cybersecurity risks. The underlying controls of the cyber risk management program incorporate recognized best practices and standards for cybersecurity, including guidance from the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cyber risk management program includes various risk assessments that are completed on a regular basis, including (i) information security controls assessments with internal and external audit partners, (ii) architectural and technical assessments with third-party experts, (iii) internal and external penetration testing with third-party service providers, (iv) continuous cyber risk register reviews, and (v) risk prioritization with our executive officers. The identification of cybersecurity risks is aided by a technical toolset as well as threat hunting and counterintelligence services provided by third-party service providers. These risk assessments and the technical toolset inform our information security roadmap, which allocates resources toward strategic initiatives to mitigate, transfer, and/or reduce cybersecurity risks. Our associates receive cybersecurity awareness communications, engage in annual cybersecurity training, and are exposed to periodic phishing simulation exercises with targeted training. Additionally, confidential information protection training is regularly provided to associates who have access to personally identifiable information, reside in certain jurisdictions, or have privileged access.


text: The Head of Information Security oversees the Information Security team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Information Security and our Information Security team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Information Security, who has over 20 years of information technology experience, including over 10 years in leadership roles at First Solar, reports to the Chief Information Officer and regularly briefs the Chief Financial Officer and, at least quarterly, briefs the audit committee of the board of directors on cybersecurity matters. Effective March 16, 2025, our Head of Information Security will be departing the Company and, as a result, our Chief Information Officer will act as our interim Head of Information Security while we conduct a search for a permanent replacement. Our Chief Information Officer has 25 years of information technology experience, including 18 years in leadership roles at First Solar.


text: d.provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: e.conduct regular phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct monthly cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar's major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of senior management from various departments, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.


text: The Information Security team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar's Information Security team to protect our information technology environment. Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our Information Security team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar's incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.


text: As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations during the period covered by this filing. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, "Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations."


text: We recognize the critical importance of maintaining the trust and confidence of physicians, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by NIST and other applicable industry standards, as well as the HIPAA Security Rule and other recognized frameworks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats in addition to other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President of Information Services.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as performing intrusion detection and prevention. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: g.leverage internal and external resources to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure in our information technology, telephone or other systems could significantly disrupt our operations and adversely affect our business and financial condition," which disclosures are incorporated by reference herein.

stage1Category: None/Other


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our Audit Committee to oversee risks from cybersecurity threats.


text: Upon detection of a material cybersecurity threat, our Audit Committee receives an update from management of the cybersecurity threat, risk management and strategy processes, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our Audit Committee and board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Information Services, with support from our entire Information Services department. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications. These Information Services team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these Information Services team members report to our Chief Executive Officer, and ultimately to the Audit Committee of our board of directors about material cybersecurity threats.


text: b.through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: NOODLES & Co

ticker: NDLS


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 16 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Board receives updates from management and the Audit Committee on cybersecurity risks.


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 17 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Audit Committee also reviews reports from third party service providers and discusses the findings with management. The Board receives updates from management and the Audit Committee on cybersecurity risks.


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities, and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Information Security Acceptable Use Policy, which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident occur with the relevant security coordinator according to our Incident Response Procedures.


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Chief Information Security Officer ("CISO") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The CISO also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The CISO and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to President and Chief Executive Officer, while the CISO reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The CISO has over 10 years of industry experience including management of security and vendor relationships as well as possesses several industry certifications, including certification as a Certified Information Systems Security Professional from the International Information System Security Certification Consortium and as a Certified Information Security Manager from the Information Systems Audit and Control Association.


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third party service providers in the ordinary course of business, including to assist us in performing information security assessments for third party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our CISO oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives quarterly updates from the CISO regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding the risk we face from cybersecurity threats, see the risk factor entitled "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation, damage to our reputation, and other potential losses." included in Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities; and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the Bank is subject to SEC rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company, including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Director of Information Security ("DIS") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond to, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The DIS also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The DIS and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program; coordinating or contributing to reviews, audits, risk assessments, and other risk management material; development of departmental policies and procedures for board approval; and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships. The DIS also possesses several industry certifications, including certification as a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.


text: With the approval of the Audit Committee, we also engage third-party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third-party service providers in the ordinary course of business, including to assist us in performing information security assessments for third-party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third-party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.