text: Our Information Security Policy is designed to align with certain best practices, including GDPR. This policy promotes the management and execution of our information security framework for preserving the confidentiality, integrity, availability and privacy of our information assets, including by helping enable us to better oversee, monitor and identify certain risks related to the processing of information by authorized third-party service providers. We also have an Information Technology ("IT") Steering Committee to help ensure security and compliance across our IT services. We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. We implement a layered strategy for overseeing and identifying material risks from cybersecurity threats associated with our use of third party service providers, including: (i) the use of a suite of Microsoft tools (including Microsoft Defender); (ii) a cloud IT strategy that eliminates any central platform; (iii) engaging a cybersecurity firm that monitors our systems 24/7 and provides daily alerts and updates; (iv) regular cybersecurity training for all employees and contractors; and (v) policies and procedures that govern employee activities along with technical controls in place to enforce those policies and procedures.


text: During 2024, we refreshed our business continuity program to assess the resilience of our processes and systems against potential threats, including cyber-attacks. Our refreshed crisis management and business continuity program establishes crisis management instructions with a detailed plan for each business department outlining critical processes, internal and external dependencies and recovery strategies. In addition, routine information security training and updates are regularly rolled out to our employees, and we track certain metrics that we believe help ensure we have a strong security posture.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. See "We rely significantly on information technology and any failure, inadequacy, or security lapse of that technology, including any cybersecurity incidents, could harm us" in the "Risk Factors" section of this Annual Report for further information.

stage1Category: Strategy Integration


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board administers the risk oversight function directly through the Board, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. The Board at least annually reviews management's annual enterprise risk assessment, business continuity process and cybersecurity posture. Our Audit Committee is responsible for overseeing the management of risks associated with our financial reporting, accounting and auditing matters, as well as business-related risks (such as leadership, continuity, cybersecurity and matters relating to our commercial activities), reviewing as required our processes around the management and monitoring of such risks, as well as conducting a risk assessment review. Our Audit Committee charter sets forth the responsibilities of the Audit Committee consistent with applicable SEC and Nasdaq rules, including reviewing our approach to risk mitigation with respect to IT and cybersecurity. An information security update is provided quarterly, or as needed, to the Audit Committee, with a detailed review provided at least annually, or as needed.

stage1Category: Board Governance


text: In addition, our Chief Information Officer ("CIO") is responsible for leading the assessment and management of cybersecurity risks. Our CIO, who has held this position since 2021, has over 20 years of experience in information security and holds an MBA from The George B. Delaplaine School of Business and Economics. He was previously CIO at Autolus Therapeutics from 2018 to 2021, and CIO at Sucampo Pharmaceuticals from 2015 to 2018. Prior to that, he was a Director, IT at AstraZeneca from 2008 to 2015. Our CIO regularly receives reports from our Head of Enterprise Technology along with our cybersecurity partners on cybersecurity threats and incidents, as applicable.

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity Risk Management and Strategy The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and Service Providers. The Company's subsidiaries lease to and, in some instances, manage for our tenants the properties we own, but we do not have actual or contractual access to the systems or information maintained or used by our tenants. Our tenants are directly or indirectly (through their own service providers) responsible for maintaining programs and processes to protect their systems and information from various risks from cybersecurity threats.

companyName: Peakstone Realty Trust

ticker: PKST


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.


text: We design and assess our program based on the information security standards published by the International Organization for Standardization 27002 ("ISO 27002"). This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the ISO 27002 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—General Risks—Cybersecurity risks and cyber incidents or the failure to comply with laws and regulations concerning data privacy and security may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, any of which could have a material adverse effect on us."


text: Cybersecurity Governance Our executive management team, along with our managed information technology Service Provider, Strebe Corporation, a California corporation d/b/a Connetic ("Connetic"), is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with Connetic, which has provided information technology support, security audit and on-call services to financial industry participants for more than 25 years.


text: Our management team meets with Connetic regularly to discuss then-current cybersecurity issues, which may include efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including threat intelligence and other information obtained from governmental, public or private sources, and external service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment including a spear-phishing report.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. In addition, the executive management team is responsible for updating the Audit Committee, as necessary, regarding significant cybersecurity incidents.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives period reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. The full Board members receives presentations on cybersecurity topics from Connetic as part of the Board's continuing education on topics that impact public companies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We design and assess our program based on industry standard cybersecurity frameworks published by the International Organization for Standardization and the National Institute of Standards and Technology. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we may source controls applicable to our industry from these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of Service Providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness and spear-phishing resistance training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a vendor management policy for Service Providers that provide an automated service or system that stores, transmits or processes our Confidential Information.


text: Cybersecurity Governance A security team consisting of our executive management team, other members of senior management, and our managed information technology Service Provider, Connetic, LLC, a Delaware limited liability company ("Connetic") is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Connetic has provided information technology support, security audit and on-call services to financial industry participants for more than 25 years.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives period reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. Our Board receives presentations on cybersecurity topics from Connetic as part of the Board's continuing education on topics that impact public companies.


text: We are committed to protecting the security of our systems and the data we handle. We are currently designing a program to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Our Board of Directors has ultimate oversight over cybersecurity risk assessment and management, which it administers through the Audit Committee. The Audit Committee oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity matters from the leaders of our management team.


text: As part of our overall enterprise risk management processes and to better evaluate our cybersecurity risks, we are conducting a business impact analysis by leveraging what we anticipate being an annual company-wide enterprise risk management assessment to understand the relationship between our critical business operations and our information technology systems. We are partnering with third party service providers to assist us in achieving our cybersecurity goals. We also have a cyber risk insurance policy designed to help us mitigate risk exposure by offsetting costs involved with recovery and remediation after a cybersecurity breach or similar event.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations, or financial condition. For a discussion of how material risks from cybersecurity threats could materially affect us, see "Risk Factors—Risks Related to Privacy, Cybersecurity, and Infrastructure—If sensitive information about our sellers and buyers or other third parties with whom we transact business is disclosed, or if we or our third-party providers are subject to cyber-attacks, use of our online marketplace could be curtailed, we may be exposed to liability, and our reputation would suffer."


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as our business depends on both buyers and sellers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework in many ways, including (i) our regular updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.


text: We view cybersecurity as a shared responsibility across the Company. All employees are required to complete yearly security training, and we periodically perform tabletop exercises with management participation. Further, our cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection tools and a vulnerability identification program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third party risks, and require security and privacy addenda to our contracts where applicable.

stage1Category: Third-Party Risk


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. As of the date of this Annual Report on Form 10-K, we are not aware of any material incidents or risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations, or financial condition. For a discussion of how material risks from cybersecurity threats could materially affect us, see "Risk Factors—Risks Related to Privacy, Cybersecurity, and Infrastructure—If sensitive information about our sellers and buyers or other third parties with whom we transact business is disclosed, or if we or our third-party providers are subject to cyber-attacks, use of our online marketplace could be curtailed, we may be exposed to liability, and our reputation would suffer."


text: Our Board of Directors is ultimately responsible for the Company's risk oversight, including cybersecurity and privacy risks. Our Board of Directors has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee comprises board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity, and technology risk exposures and the steps our management has taken to monitor and control these exposures. A t the management level, our Head of Engineering and the system operations team are primarily responsible for identifying, assessing, monitoring, and managing cybersecurity. Our team also regularly partners with a firm with cybersecurity specialists, implementing best practices and building a cybersecurity framework around identifying, protecting, detecting, responding, and recovering from cybersecurity threats. The Audit Committee receives reports from senior management, including our periodic committee meetings, which include, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates. In addition to our scheduled meetings, our Global Incident Response Plan ensures that significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee is appropriate, ensuring the committee's and the Board of Directors' oversight is timely and responsive. Our Global Incident Response Plan also includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risk Management and Strategy Our overall information security program applies an enterprise-wide, risk-based approach to information security that enables us to assess, identify and manage risk exposures, including material risks from cybersecurity threats, in a timely manner. Our information security operations and procedures provide a comprehensive Information Security Management System (''ISMS'') that enable us to maintain the confidentiality, integrity, and availability of information and systems in our environment. Our information security policies are based on National Institute of Standards and Technology ("NIST") Special Publication ("SP") 800-171 framework and apply to the entire enterprise.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: We have a dedicated Information Security and Compliance organization ("ISC") that owns and operates the ISMS. The ISC organization reports directly to Keysight's Chief Information Security Officer ("CISO") and includes functions such as information security policy management, risk management, vulnerability management, compliance assurance, identify and access management, incident management, security awareness and education and information technology ("IT'') disaster recovery. Our management team has relevant expertise and experience in understanding risks from cybersecurity threats and overseeing risk management processes. Our CISO is an experienced cybersecurity senior executive with more than 25 years experience in building and leading cybersecurity, risk management and information technology teams.


text: As part of the above processes, we regularly engage with third-party cybersecurity vendors to provide a range of services in furtherance of our cybersecurity program, including monitoring our cybersecurity systems and processes to help identify areas for continued focus, improvement and compliance. In addition, we also have a process to assess and review the cybersecurity practices of third-party vendors and service providers, including through the use of contractual security requirements and performing diligence, as appropriate.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors has delegated the oversight of cybersecurity risks to our Audit Committee, which oversees management's implementation of our cybersecurity program.


text: Our cybersecurity risk management program includes: • Cybersecurity incident detection and response plan to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. • Risk Assessment: Our enterprise-wide risk management programs and Information Security Review process is designed to identify, assess, document, monitor and report information security risks. Based on this information, we evaluate the likelihood and impact of harmful events and deliver recommendations regarding a response to risks presented. Feedback from internal audits, external assessments, and industry benchmarks is used to improve our cybersecurity posture. • Training and Awareness: Implementation of enterprise-wide mandatory annual security awareness training for employees, including cybersecurity and data privacy training. We regularly deploy enterprise-wide phishing simulation tests with mandatory follow-up training and education, which are reviewed at least annually and are updated as needed. Additionally, we provide an easy mechanism for employees to report suspicious email messages to the information security team for additional investigation. • Security Tools Optimization: Utilize a variety of tools designed to protect our network and systems, including firewalls, intrusion detection and prevention systems, web content filtering protection, anti-virus and malware detection tools, system scans and full disk encryption. • Third Party Risk: Keysight's Third Party Cyber Risk Management ("TPCRM") is a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes, and procedures.


text: In addition, Keysight maintains information security risk insurance to offset the costs of an information security breach. The policy is reviewed annually and updated as needed. We also engage with approved third-party companies that review our regulatory compliance, validate control performance, perform penetration testing and provide impartial risk assessments.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. For more information on how cybersecurity risk could materially affect the company's business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors."


text: Governance and Oversight Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit and Finance Committee, which is comprised entirely of independent directors with information security experience, oversees and monitors the company's information security programs. Additionally, one of our independent directors has a CERT Certification in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute. The Chief Information Officer (''CIO'') meets with the Audit and Finance Committee regularly to report on risks, mitigation, initiatives, compliance and outcomes and the Audit and Finance Committee reports relevant information to the full Board.


text: The CISO is responsible for the ISMS and reports directly to the CIO. The CIO is the head of the company's global IT team which has an integrated governance structure consisting of a Senior Executive Committee, a Cyber Executive Committee and Cyber Leaders. The Senior Executive Committee meets quarterly, prioritizes the information technology components of strategic business imperatives and oversees IT capability and security programs. The Cyber Executive Committee meets monthly, reviews identified risks, sponsors initiatives to address risk and oversees security and compliance responses. Cyber Leaders are management representatives from all functions and lines of business who are responsible for executing programs and initiatives sponsored by the Senior Executive Committee.


text: Risk Management and Strategy Our overall information security program applies an enterprise-wide, risk-based approach to information security that enables us to assess, identify, and manage risk exposures, including material risks from cybersecurity threats, in a timely manner. Our information security operations and procedures provide a comprehensive Information Security Management System ("ISMS") enabling us to maintain the confidentiality, integrity, and availability of information and systems in our environment. Our information security policies are based on National Institute of Standards and Technology Special Publication 800-171 framework and apply to the entire enterprise.


text: We have a dedicated Information Security and Compliance organization ("ISC") that owns and operates the ISMS. The ISC organization reports directly to Keysight's Chief Information Security Officer ("CISO") and includes functions such as information security policy management, risk management, vulnerability management, compliance assurance, identity and access management, incident management, security awareness and education, and information technology ("IT") disaster recovery. Our management team has relevant expertise and experience in understanding risks from cybersecurity threats and overseeing risk management processes. Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience in building and leading cybersecurity, risk management, and information technology teams.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section in our risk factors under the heading "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, loss of data, and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." which disclosures are incorporated by reference herein.

stage1Category: None/Other


text: Our cybersecurity risk management program includes: • Cybersecurity incident detection and response plan to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. • Risk Assessment: Our enterprise-wide risk management programs and Information Security Review process is designed to identify, assess, document, monitor, and report information security risks. Based on this information, we evaluate the likelihood and impact of harmful events and deliver recommendations regarding a response to risks presented. Feedback from internal audits, external assessments, and industry benchmarks is used to improve our cybersecurity posture. • Training and Awareness: Implementation of enterprise-wide mandatory annual security awareness training for employees, including cybersecurity and data privacy training. We regularly deploy enterprise-wide phishing simulation tests with mandatory follow-up training and education, which are reviewed at least annually and are updated as needed. Additionally, we provide an easy mechanism for employees to report suspicious email messages to the information security team for additional investigation. • Security Tools Optimization: Utilize a variety of tools designed to protect our network and systems, including firewalls, intrusion detection and prevention systems, web content filtering protection, anti-virus and malware detection tools, system scans and full disk encryption. • Third Party Risk: Keysight's Third Party Cyber Risk Management is a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes, and procedures.


text: In addition, Keysight maintains information security risk insurance, which may help to offset the costs of an information security breach. The policy is reviewed annually and updated as needed. We also engage with approved third-party companies that review our regulatory compliance, validate control performance, perform penetration testing, and provide impartial risk assessments.


text: Governance and Oversight Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit and Finance Committee, which is comprised entirely of independent directors with information security experience, oversees and monitors the company's information security programs. Additionally, one of our independent directors has a CERT Certification in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute. The Chief Information Officer ("CIO") meets with the Audit and Finance Committee regularly to report on risks, mitigation, initiatives, compliance, and outcomes and the Audit and Finance Committee reports relevant information to the full Board.


text: The CISO is responsible for the ISMS and reports directly to the CIO. The CIO is the head of the company's global IT team which has an integrated governance structure consisting of a Senior Executive Committee, a Cyber Executive Committee and Cyber Leaders. The Senior Executive Committee meets quarterly, prioritizes the information technology components of strategic business imperatives and oversees IT capability and security programs. The Cyber Executive Committee meets monthly, reviews identified risks, sponsors initiatives to address risk, and oversees security and compliance responses. Cyber Leaders are management representatives from all functions and lines of business who are responsible for executing programs and initiatives sponsored by the Senior Executive Committee.


text: We recognize the critical importance of protecting the confidentiality, integrity and availability of our business operations and systems. With this in mind, we have implemented and maintain an ongoing cybersecurity risk management program, under the oversight of our Board of Directors that is focused on identifying, assessing, managing, and mitigating cybersecurity risk. Our cybersecurity policies, standards, processes and practices incorporate several standards, specifications, and requirements from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring to inform our risk identification and assessment, as well as undertaking the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, device encryption, multi-factor authentication, advanced threat protection for emails, anti-virus and anti-malware functionality and access controls, which are evaluated and improved from time to time; • conduct regular phishing email simulations and cybersecurity training for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; and • employ multiple backup systems for our data stored on our servers or other information systems.


text: Specifically, our technology team relies on third-party information security experts for risk assessment, monitoring, and system enhancements. In addition, our technology team provides training to all employees periodically, on an ongoing basis.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Our Audit Committee receives periodic updates from management of our cybersecurity program and risks, including, as necessary, any material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. Members of our Audit Committee are also encouraged to engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. The Committee reports to the full Board of Directors regarding its activities and risk management functions, including those related to cybersecurity.


text: Our cybersecurity program, which is discussed in greater detail above, is led by our Chief Financial Officer with the help of our legal and human resources teams. Such individual has prior work experience in various roles involving managing information security and developing cybersecurity strategy and is responsible for supervising both our internal personnel and our retained third-party cybersecurity vendors. As discussed above, this management team member reports to the Audit Committee of our Board of Directors about cybersecurity related matters, periodically.


text: Our management team is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: The Company's Board of Directors (the "Board") through its audit committee (Audit Committee) is responsible for overseeing the Company's risk management program. The Company integrates cybersecurity risk management into its broader risk management framework to ensure that cybersecurity considerations form an integral part of our risk management program. Our Information Technology (IT) department works closely with the risk management team to evaluate and address cybersecurity risks. The Company's cybersecurity strategy and risk management processes align with the National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework.

companyName: V2X, Inc.

ticker: VVX


text: Cybersecurity Risk Management Strategy Identification, Response and Reporting: The Company has adopted a cyber incident response procedure to primarily: • assess, identify and manage material cybersecurity threats and incidents; • comply with our contractual obligation to safeguard covered defense information; and • report on cyber incidents in accordance with the relevant DFARS.


text: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. We have an established incident response team (IRT) comprised of cross-functional leaders from Finance, Human Resources, Legal, Security and IT groups, to identify, assess and address cyber incidents. The IRT coordinates closely with the risk management team on cybersecurity risks and threats facing the Company. The Company conducts regular exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as through external audits and certifications.


text: Third-party Engagements: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by our use of third-party vendors, service providers, and other external users of the Company's systems. We also monitor our use of systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage external experts, including managed security service provider (MSSP) and consultants, to evaluate our cyber governance and monitor our risks. These partnerships enable us to leverage their specialized knowledge to help ensure that our cybersecurity strategies and processes reflect industry best practices.


text: Education and Awareness: The Company provides regular, mandatory training for employees on safeguarding against cybersecurity threats, and communicates the Company's evolving information security policies, standards, processes, and practices.


text: Board of Directors Oversight: The Audit Committee oversees cybersecurity risks. The Audit Committee reviews the Company's cybersecurity program, including the review of reports on cyber incident response processes, emerging cybersecurity developments and threats, and cyber risk assessment. The Audit Committee meets regularly with management to discuss our cybersecurity program.


text: Cybersecurity Oversight and Governance Weatherford is committed to protecting its information systems. These efforts are led by the Chief Information Officer ("CIO"). Our program is designed to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").

companyName: Weatherford International plc

ticker: WFRD


text: Management's Role: Our Chief Information Security Officer (CISO) is primarily responsible for assessing, monitoring and managing our cybersecurity risks. With over 23 years of experience in the field of information technology and cybersecurity, the CISO brings a wealth of expertise to his role. His background includes experience as a military cybersecurity officer and system security engineer, resulting in extensive knowledge and experience in developing and executing cybersecurity strategies. The CISO holds a graduate degree in Information Resource Management from the Air Force Institute of Technology, Wright-Patterson, Air Force Base, Ohio and holds a Certified Information Systems Security Professional certification, awarded and maintained since 2010.


text: The CISO coordinates with senior management, including members of the IRT, to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents or threats in accordance with the Company's incident response procedure. Through ongoing communications between the CISO, IRT and other members of senior management (including the CEO), senior management stays informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports significant threats and incidents to the Audit Committee, when appropriate.


text: Management provides comprehensive briefings to the Audit Committee on a regular basis. These briefings may include topics such as the current cybersecurity landscape and emerging threats, reports on significant incidents and breaches, and compliance with new regulatory requirements.


text: Risks from Cybersecurity Threats Our top cybersecurity threats include phishing, smishing, business email compromise, ransomware, system & human errors, and malware. These types of attacks could have a material impact on the Company. To date, we have not encountered cybersecurity challenges that have materially impacted our operations or results of operations.


text: The Company's Board of Directors (the Board) through its audit committee (Audit Committee) is responsible for overseeing the Company's risk management program. The Company integrates cybersecurity risk management into its broader risk management framework to ensure that cybersecurity considerations form an integral part of our risk management program. Our Information Technology (IT) department works closely with the risk management team to evaluate and address cybersecurity risks. The Company's cybersecurity strategy and risk management processes align with the National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework.


text: Management's Role: Our Chief Information Security Officer (CISO) is primarily responsible for assessing, monitoring and managing our cybersecurity risks. With over 30 years of experience in the field of information technology and cybersecurity, the CISO brings a wealth of expertise to his role. His background includes experience as a cybersecurity professional and system security engineer at the Pentagon, the State Department, and several other Federal agencies, as well as serving as Chief Information Officer (CIO) for international federal contractors and a Maryland state agency, resulting in extensive knowledge and experience in developing and executing cybersecurity strategies. The CISO holds a Doctorate degree in Information Assurance and a Master's degree in Computer Systems Management from the University of Maryland, and holds a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certification, awarded and maintained since 2010 and 2015, respectively.


text: We believe cybersecurity is a critical component of our enterprise risk management function. Our strategy regarding Information Security ("InfoSec") includes a comprehensive, proactive, and sustainable risk-based approach, assessing the risk posed to the Company at the strategic, operational, financial, and reputational levels. We take appropriate preventive, detective, and response measures to mitigate these risks on a continuing basis.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Risk Management Process Recursion's approach to InfoSec is informed by the National institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), which is a broad standards framework that provides direction and guidance to assess the Company's InfoSec risk and implement InfoSec capabilities, and also provides measures of progress in areas that are relevant for the organization's business objectives.


text: Risk Identification and Assessment We have a dedicated InfoSec team that regularly reviews threat intelligence from various sources, including third-party InfoSec consultants, assesses the applicability of known threats and threat actor behavior and tactics to the Company, and assesses whether these threats pose risks to the Company. The InfoSec team then evaluates potentially appropriate administrative, technical, and physical controls to mitigate and reduce these risks within the appropriate business context and applies such controls where appropriate. We also have implemented a process to identify and mitigate risks from cybersecurity threats related to our use of third-party service providers.


text: These mitigation measures are detailed in the Company's InfoSec Roadmap. Progress against this Roadmap and potential incidents are reviewed with management and the Company's Audit Committee. Our InfoSec team tests relevant controls and maintains industry standard attestations, including reports prepared by an independent AICPA-accredited auditor.


text: We also run regular cybersecurity exercises, such as penetration tests, to test the effectiveness of our controls. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement through the InfoSec Roadmap.


text: Consequence Mitigation We also test the Company's InfoSec's Incident Response control effectiveness through tabletop exercises facilitated by a third party. These exercises test the Company's ability to detect and respond to cybersecurity incidents in a timely manner with a goal to reduce the impact of the cybersecurity incidents. Our InfoSec policies, processes and procedures are tested for completion and accuracy through these exercises. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement identified through the InfoSec Roadmap.


text: We, like any technology company in the current environment, have experienced cybersecurity incidents in the past, but we have not experienced a cybersecurity incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Risks Related to Our Platform and Data."


text: Cybersecurity Governance Our cybersecurity processes are overseen by the Audit Committee of the Board of Directors. The Audit Committee, through its charter, has express oversight of the Company's cybersecurity processes, controls, and procedures and is responsible for monitoring and reviewing the Company's mitigation efforts. The Audit Committee receives quarterly briefings from senior leadership, including our Chief Information Security Officer, regarding information security risk, strategy, and effectiveness and progress of the InfoSec program. The Audit Committee also reviews with management significant information security incidents for the period and associated remediation plans, and new or emerging information security risks. The Board of Directors is also provided an update quarterly on the Company's cybersecurity risk, processes, and mitigation efforts.


text: The execution of the Company's cybersecurity processes is overseen by a committee that includes our Chief Information Security Officer, Chief Financial Officer, Chief Operating Officer, General Counsel and Chief Technology Officer. This committee is responsible for the overall cybersecurity strategy and approving the cybersecurity processes, policies, and procedures, including the InfoSec Roadmap. The committee receives regular reports on the InfoSec strategy, risks, and mitigation efforts. It is also informed of any potential reportable information security incidents and is responsible for assessing the impact and approving remediation plans, as well as escalating to the Audit Committee or Board of Directors. Overall implementation of the cybersecurity strategy is executed across the enterprise by Recursion's InfoSec team, which is supervised by the Chief Information Security Officer.


text: Risk Identification and Assessment As part of our overall risk management system, we have a dedicated InfoSec team to oversee management's process for effectively monitoring and mitigating risk. The InfoSec team regularly reviews threat intelligence from various sources, including third-party InfoSec consultants, assesses the applicability of known threats and threat actor behavior and tactics to the Company, and assesses whether these threats pose risks to the Company. The InfoSec team then evaluates potentially appropriate administrative, technical, and physical controls to mitigate and reduce these risks within the appropriate business context and applies such controls where appropriate. We also have implemented a process to identify and mitigate risks from cybersecurity threats related to our use of third-party service providers.


text: Consequence Mitigation We also test the Company's InfoSec's Incident Response control effectiveness through tabletop exercises facilitated by a third party. These exercises test the Company's ability to detect and respond to cybersecurity incidents in a timely manner with a goal to reduce the impact of cybersecurity incidents. Our InfoSec policies, processes and procedures are tested for completion and accuracy through these exercises. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement identified through the InfoSec Roadmap.


text: The execution of the Company's cybersecurity processes is overseen by a committee that includes our Chief Information Security Officer ("CISO"), Chief Financial Officer, Chief Operating Officer, General Counsel and Chief Technology Officer ("CTO"). This committee is responsible for the overall cybersecurity strategy and approving the cybersecurity processes, policies, and procedures, including the InfoSec Roadmap. The committee receives regular reports on the InfoSec strategy, risks, and mitigation efforts. It is also informed of any potential reportable information security incidents and is responsible for assessing the impact and approving remediation plans, as well as escalating to the Audit Committee or Board of Directors. Overall implementation of the cybersecurity strategy is executed across the enterprise by Recursion's InfoSec team, which is supervised by the CISO.


text: Our CISO has held various Information Security Leadership and Technology roles over the past 25 years in the biopharmaceutical, life sciences industry, including roles at Genentech (USA), Roche Farma S.A. (Spain), Hoffman - La Roche (Switzerland) and most recently at Jazz Pharmaceuticals (USA) as their Global CISO before joining Recursion in 2021. Our CISO brings extensive risk management experience including developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture.


text: Our General Counsel was a corporate and securities lawyer at Wilson Sonsini Goodrich & Rosati, P.C., where he represented venture-backed technology and life sciences companies through all stages of growth. Additionally, he has played a critical role in building Recursion's public company compliance and corporate governance structure.


text: Our CTO has a versatile background in computer science, machine learning, software engineering and data science with over 15 years of industry experience, building automated machine learning systems and solutions in the ad tech, customer service, and healthcare industries. Prior to joining Recursion, our CTO held various leadership roles providing strategic leadership for the company's IT organization.


text: Given the importance of information security to our stakeholders, our Board of Directors receives regular updates from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness.


text: Cybersecurity Risk Management Strategy Diamondback provides us with personnel and general and administrative services pursuant to the services and secondment agreement, including the personnel and infrastructure that underlie our cybersecurity risk management program. In connection therewith, Diamondback has implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect Diamondback's systems, identify and remediate on a regular basis vulnerabilities in Diamondback's systems and related infrastructure and monitor and mitigate the risk of data loss and other cybersecurity threats. Diamondback has also engaged third-party consultants to conduct penetration testing and risk assessments. Diamondback's cybersecurity program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration.

companyName: VNOM Sub, Inc.


text: Diamondback's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that apply to us.


text: Diamondback's cybersecurity risk management program, which it provides to us under the services and secondment agreement, includes: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise IT environment; • a security team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) its response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of its security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of its employees, including incident response personnel and senior management, including those who provide these services for us; • cybersecurity tabletop exercises for members of its cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor NEP's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and NEP to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: Evolent Health, Inc.

ticker: EVH


text: Cybersecurity Governance Diamondback's cybersecurity governance program is led by its Vice President and Chief Information Officer, with support from the internal information technology department. Diamondback's Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. Diamondback's Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, Diamondback's cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with its Computer Security Incident Response Plan. Progress and developments in Diamondback's cybersecurity governance program are communicated to members of its and our executive team. The audit committee of the board of directors receives quarterly updates on the status of Diamondback's cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur, to the extent relevant to our program. Board members receive presentations on cybersecurity topics from Diamondback's Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, Diamondback's code of business conduct and ethics expects all employees to safeguard the electronic communications systems and related technologies of Diamondback and its subsidiaries, including us, from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to Diamondback's Chief Legal and Administrative Officer and Vice President and Chief Information Officer. Diamondback's cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party vendors and suppliers.


text: Risks from cybersecurity threats have not materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. Risk Factors of this report for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Diamondback's cybersecurity risk management program, which it provides to us under the services and secondment agreement, includes: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise IT and operational technology ("OT") environments; • a security team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) its response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of its security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of its employees, including incident response personnel and senior management, including those who provide these services for us; • cybersecurity tabletop exercises for members of its cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity Governance Diamondback's cybersecurity governance program is led by its Senior Vice President and Chief Information Officer, with support from the internal information technology department. Diamondback's Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. Diamondback's Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, Diamondback's cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with its Computer Security Incident Response Plan. Progress and developments in Diamondback's cybersecurity governance program are communicated to members of its and our executive team. Diamondback's and our management takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by Diamondback; and alerts and reports produced by security tools deployed in the enterprise IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in the risk management strategy and continues to be an area of increasing focus for our board, the audit committee and management.


text: NEE operates U.S. critical infrastructure for XPLR. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor XPLR's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and XPLR to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.


text: The audit committee of the board of directors receives quarterly updates on the status of Diamondback's cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur, to the extent relevant to our program. Board members receive presentations on cybersecurity topics from Diamondback's Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, Diamondback's code of business conduct and ethics expects all employees to safeguard the electronic communications systems and related technologies of Diamondback and its subsidiaries, including us, from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to Diamondback's Chief Legal and Administrative Officer and Senior Vice President and Chief Information Officer. Diamondback's cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Diamondback's vendor management process may include reviewing the cybersecurity practices of such providers, contractually imposing obligations on the providers, conducting security assessments and conducting periodic reassessments during their engagement.


text: Risk Management and Strategy Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to NEP of substantially all of NEP's information technology functions, including those relating to cybersecurity. NEP's board oversees the provision of these services.


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to NEP, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to NEP. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to NEP, which is led by a cybersecurity incident response team. NEE uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems and monitors for impacts to external vendors or suppliers, including those related to NEP. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of NEP.


text: NEE conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE also participates in industry forums and trade groups, as well as, in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to protect against cybersecurity threats to its and NEP's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or accessing NEE's systems or data, including those related to NEP, is evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or NEP's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: NEE's chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats, including those related to NEP, and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including NEP's chief financial officer, general counsel, and president and the Cybersecurity Governance Executive Committee comprised of various members of management, including NEE's vice president of internal audit and executive director of emergency preparedness. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as NEP.


text: The NEP board is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity updates from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. Significant active cybersecurity incidents and threats are communicated to board personnel as they occur.


text: Risk Management and Strategy Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to XPLR of substantially all of XPLR's information technology functions, including those relating to cybersecurity. XPLR's board oversees the provision of these services.


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to XPLR, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to XPLR. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to XPLR, which is led by a cybersecurity incident response team. NEE uses these resources, and leverages third party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to their vendors or suppliers, including those related to XPLR. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of XPLR.


text: NEE conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to defend against cybersecurity threats to its and XPLR's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing services to NEE or accessing NEE's systems or data, including those related to XPLR, are evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or XPLR's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: Our Chief Financial Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to identify, protect against, detect, respond to, and recover from current and emerging cybersecurity risks, and plans and strategies to address those risks and mitigate harm caused by cyber incidents.

companyName: Axonics, Inc.


text: NEE's vice president and chief information officer, vice president cybersecurity and executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats, including, through the MSA, those related to XPLR. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee and the Cybersecurity Governance Executive Committee. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as XPLR.


text: The XPLR board is responsible for the oversight of risks from cybersecurity threats. XPLR continues to utilize, through the MSA, NEE's cybersecurity program and capabilities. Significant active cybersecurity incidents and threats are communicated to XPLR's board as they occur.


text: Risk management and strategy We have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and established policies and processes for assessing, identifying, and managing material cybersecurity risks based upon cybersecurity threats, vulnerabilities, likelihood, and impact, and have integrated these processes into our overall risk management systems and processes, which are overseen by our Chief Operating Officer and Chief Financial Officer. We routinely assess cybersecurity risks that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct annual assessments to identify cybersecurity risks based on known threats and vulnerabilities, as well as assessments after any material change in our business practices that may affect information systems exposed to such cybersecurity risks. These risk assessments include identification of reasonably foreseeable internal and external threats and vulnerabilities, the likelihood that such threats will occur, and the impact on our business that could result from such occurrences. We then evaluate the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we adjust existing and implement new controls responsive to changes in the risk environment and maintain those controls to mitigate and minimize identified risks. This process includes reasonably addressing any identified gaps in existing safeguards and regularly monitoring the effectiveness of our controls over time. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director of IT who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our controls and train our employees on these controls, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties, in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats and vulnerabilities. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our audit committee is responsible for evaluating our cyber security program, cyber risk environment, and related risks and, with management, reporting findings and actions under our cyber security program and cyber risk environment to the full board of directors.


text: Our Chief Financial Officer, Chief Operating Officer and Director of IT have substantial relevant expertise in the life sciences industry and formal training in the areas of information security and cybersecurity risk management, and are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer provides periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Weatherford's cybersecurity has been developed by the CIO and the information security team, in coordination with our Board and key members of our finance, assurance and legal teams. The information security team, which has years of experience selecting, deploying, and operating cybersecurity technologies and initiatives around the world, uses a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.


text: Information security is a key part of the Company's Enterprise Risk Management ("ERM") program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. The Company has established an ERM Committee that meets regularly to evaluate risks and coordinate a consistent approach to risk mitigation across the enterprise, including risks related to cybersecurity. The ERM Committee is comprised of certain members of our cross-functional executive leadership team.


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training occurs during onboarding and refresher courses are taken annually. Weatherford performs simulated phishing campaigns to raise employee awareness and provide guidance on recognizing and reporting potential threats. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.


text: Weatherford also provides guidance to support employees on acceptable use, remote access, encryption, cloud security, and anti-virus best practices. Weatherford has long included a safety moment at the beginning of major internal meetings, and cyber safety is an occasional topic.


text: We believe our ongoing training and awareness campaigns reinforce the importance of employees in preventing cybersecurity incidents, and further the goal of continuously promoting Weatherford's culture of safety, security and compliance.


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, multi-factor authentication and strong passwords are used across all major Weatherford systems in an effort to prevent unauthorized access.


text: Weatherford personnel perform risk assessments on third-party products and platforms through a checklist-based review and interview process that aim to validate security controls. Third parties are often asked to provide additional documentation on security architecture, certifications and results of assessments. Cybersecurity approval is a key factor in approving a new third-party product or platform.


text: Detection and Response Weatherford uses multiple internal and external resources to continuously monitor our information systems for evidence of a threat, breach or other incident.


text: When a threat or other issue is identified, the information security team follows an incident response plan that outlines the process for investigating and addressing the issue. The incident response plan is focused on prompt interdisciplinary communication and coordination between the information security team and key members of the finance, legal, and communication teams, as well as senior management. The information security team also utilizes specific runbooks for various types of threats that are updated and expanded based on lessons learned and emerging best practices. Our incident response plan also provides for consideration of whether an incident is material, requiring disclosure to shareholders in SEC filings. Our team also has a disaster recovery plan, under which recovery testing occurs annually.


text: Weatherford expects to continually invest in the improvement of cybersecurity infrastructure, as systems and needs evolve and as the threat landscape changes. Because we employ a prevention-based improvement cycle that requires the response team for each threat or incident to consider the root cause of the issue and any lessons learned throughout the response process, we strive to make corrections and improvements in our policies and procedures that are designed to safeguard against future threats.


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to affect us, including our business strategy, results of operation or financial condition.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.


text: Cybersecurity Oversight and Governance Weatherford is committed to protecting its information systems. These efforts are led by the Chief Information Officer ("CIO"). Our program is designed to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").


text: Weatherford's cybersecurity program has been developed by the CIO and the information security team with oversight from our Board of Directors and in coordination with key members of our finance, assurance and legal teams. The information security team is comprised of specialists with a mix of government and public-sector cybersecurity experience, combined, they have years of experience selecting, deploying and operating cybersecurity technologies and initiatives globally. Many of our professionals hold university degrees in cybersecurity, information technology, management of information systems and related fields, along with industry-recognized certifications such as CISSP, CASP+, CEH and other related certifications. The team leverages a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board of Directors periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training is an integral part of our employee development program, beginning with comprehensive onboarding sessions to establish foundational knowledge. To ensure ongoing awareness and preparedness, employees complete annual refresher courses, which reinforce best practices and address emerging cybersecurity threats. Additionally, Weatherford performs periodic phishing simulations and training to enhance employee vigilance against social engineering attacks. We also provide industry-specific cybersecurity training to relevant employees to address sector-specific risks and strengthen our organization's overall security posture. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, we use a comprehensive suite of cybersecurity tools and software, aligned with government and industry best practices, including multi-factor authentication, complex passwords and advanced security controls, across all major Weatherford systems in an effort to strengthen defenses and prevent unauthorized access.


text: Weatherford personnel conduct risk assessments on third-party products and platforms through a structured checklist-based review and interview process that aim to validate implemented security controls and mitigate risk to our organization. This process includes evaluating security architecture, verifying certifications and reviewing results of external security assessments. Additional documentation may be requested to clarify technical measures, compliance reports or risk treatment plans. Cybersecurity approval is a key factor in approving a new third-party product or platform.


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. To date, no cybersecurity incident or issue has had a material impact on us. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2023. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board of Directors also receives briefings from management on our cybersecurity risk management program and presentations on cybersecurity topics from external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our external cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Financial Officer has been managing our information technology resources for over 16 years and has overseen our cybersecurity risk assessment and the implementation of our cybersecurity risk management program since its inception.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2024. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."