text: Management's Role in Assessing and Managing Cybersecurity Threats: Management's role in assessing and managing our material risks from cybersecurity threats is documented in the Company's IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of all of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents.


text: Upon the discovery of a potential or actual cybersecurity incident, the detecting party is obligated to inform the CISO, or deputy CISO if the CISO is unavailable, as an initial step. We also employ the services of an outside vendor that is tasked with contacting the CISO, or the CISO's delegee, upon learning of an incident. Subsequently, our CISO will guide the initial analysis of the cybersecurity incident, and depending on the nature of the incident, these cybersecurity incidents may be escalated to our CIO and above according to the guidelines set forth in the IRP. Analysis of the potential impact of the cybersecurity incident is one of the primary objectives of our initial response. Once the severity level and appropriate management protocol for responding to the cybersecurity incident have been determined in accordance with our Cybersecurity Plan and IRP, the CIO, or the CIO's delegee, may elevate the incident to the CEO, Chief Legal Counsel, Board, and Audit Committee as needed (depending on the nature and severity of the incident) for further investigation and response, including for an assessment of materiality. Depending on the nature of the incident, the CIO or Chief Legal Counsel will coordinate a notification and communications plan and event analysis across the appropriate teams, which may involve updates to our cybersecurity management team, the Board, the Audit Committee, the ERC and the CROC.

companyName: Vertiv Holdings Co

ticker: VRT

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Relevant Expertise of Management: Our CISO has more than 20 years of intelligence, information technology and cybersecurity experience, and holds a Masters degree in the area of Cybersecurity and Information Sciences from The Pennsylvania State University. His prior roles include senior level positions in Defense, Financial Services and High Technology industries. Our CIO has more than 30 years of information technology and cybersecurity experience at various levels. She holds an executive MBA from the Quantic School of Business and Technology, a Graduate Certificate in SAP from Central Michigan University, a Masters in computer information systems from Grand Valley State University and a BA from the University of Michigan. Her prior roles include positions as Chief Information Officer and Vice President of Information Technology and Digital Office of Adient plc, a global automotive seating manufacturer, and Chief Information Officer and Vice President of Information Technology, Power Solutions of Johnson Controls.

stage1Category: Management Role

stage1Method: majority


text: Risk Management and Strategy Our cybersecurity program is designed from a risk- and compliance-based approach to achieve systemwide resilience and protection across our operations. We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We utilize the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with our information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications.


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Refer to "Item 1A. – Risk Factors" in this annual report on Form 10-K, including, "We may be subject to interruptions or failures in our information technology systems," for additional discussion on our cybersecurity related risks.

stage1Category: Strategy Integration


text: Cybersecurity Governance Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board and management. Our Audit Committee is responsible for reviewing and monitoring our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security. Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.

stage1Category: Board Governance


text: Our cybersecurity risk management and strategy activities are overseen by executive management, made up of the IT Steering Committee and Chief Information Officer. Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function. The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee on any appropriate items.


text: We manage risks from cybersecurity threats through our overall enterprise risk management process. Management has created an information security program, which encompasses a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. We "proactively" assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include internal audits, external audits, penetration tests, and engagement of third parties to conduct analyses of our information security program.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: While to date, we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "Our business and operations could suffer in the event of cybersecurity breaches and we may incur significant legal and financial exposure." for further discussion of potential risks related to cybersecurity incidents.

stage1Category: None/Other


text: Our Senior Vice President of Technology and Innovation and Vice President of Network Infrastructure and Cyber Strategy oversee our cybersecurity program. They hold degrees in industrial engineering and computer science and information systems and decision science, respectively. The team responsible with administering our cyber security program have a combined 35 years of experience in cybersecurity, information security & information technology risk management, governance, risk, and compliance. Our board of directors and our audit committee are regularly updated on cyber security as part of their oversight of relevant cybersecurity risks. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents.


text: Risk Management and Strategy Cyber security risk management at Noble, along with all enterprise risks, is part of the Company's Enterprise Risk Management Program and risks from cyber security threats are assessed, identified, and managed by our Information Security Team. The Information Security Team reports to the Chief Information Officer ("CIO"). The Information Security Team is composed of information security managers and security analysts.

companyName: Noble Corp plc

ticker: NE


text: The Information Security Management Team is responsible for all of Noble's cyber security-related activities such as advising on governance requirements, setting cyber security policies, standards, and procedures, reporting, determining current risk appetite, setting security posture, evaluating security maturity, and ensuring compliance to cyber security frameworks. The team monitors both internal and external threats, potential compromising internet-based attacks, phishing activities, and aims to adapt with protective measures.


text: Information security managers carry broad manager level cyber security certifications, and the technical teams carry relevant specific technical certifications related to both Information Technology and Operational Technology security.


text: Noble's cyber security program encompasses mandatory cyber training, awareness, phishing exercises, and cyber security incident response plan testing to assist with our cyber security risk management process and ensure various applicable implemented cyber controls are working as intended.


text: Noble works with various third-party partners to help execute and advise on cyber security and evaluate maturity assessments as needed.


text: Noble has a process of monitoring all third parties with direct access into the Noble network via various implemented security tools that act as both detective and preventive controls. All third parties with such direct access are also monitored via procurement processes and are subject to specific legal terms and conditions. Noble also engages with various third-party partners, such as ONG-ISAC, DataBreachToday, the US Coast Guard, local FBI, the Norwegian Security Authority, IADC, and IMO, in order to share intelligence regarding external threats. For any cyber incidents, Noble may engage applicable third-party partners for forensic purposes.

stage1Category: Third-Party Risk


text: Noble also engages with various cyber security service providers, such as Crowdstrike, Fortinet, NTT, and Microsoft, which share applicable reports with Noble.


text: Noble is not aware of any current or potential risks from cyber security threats, incidents, or exposures that have or may have materially affected or are reasonably likely to materially impact Noble's business strategy, results of operations, or financial condition. Potential cybersecurity risks to Noble are shared in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the foregoing information.


text: Enterprise risk management is a matter that is reviewed and addressed by the entire Board. The Noble Enterprise Risk Management Program, which includes the Company's cyber security enterprise risk, is updated by management and reported to the Board of Directors quarterly. The quarterly update to the Board of Directors includes information regarding cyber related risks, initiatives, and potential and actual cyber security threats and incidents. The CIO or their dedicated deputy is responsible for reporting cyber security risks and events to executive management as well as the Board of Directors, as appropriate. Specific issues or threats may be escalated to the Chief Executive Officer or the Board of Directors between quarterly updates by the CIO, as appropriate, and the Information Security Team keeps management informed about initiatives, threats, incidents, training, and best practices on an on-going basis via circulated memos or meetings. In addition to reporting through the Enterprise Risk Management Program, the Board of Directors also includes cyber security as an independent agenda item periodically and engages with the CIO and Information Security Team as well as external experts on cyber security matters.


text: The CIO is responsible for the Information Security Team risk strategy, assessment, exceptions, risk acceptance, and management of the Company's material risks from cybersecurity risk appetites. Ongoing assessments cover applicable information technology and operations technology systems, applications, and software used to support Noble's corporate and rig operations. The outcome of these various assessments influences the IT risk appetite and risk identification, and acceptance is discussed and shared with the CIO in preparation for the Board of Directors meeting presentation The CIO has extensive cybersecurity knowledge and skills gained from over ten years of relevant work experience at Maersk Drilling and post-merger Noble. Prior to Maersk Drilling, the CIO served four years as CIO at Adform, a leading global advertising technology company, where he was also responsible for cybersecurity. Prior to serving as CIO of Adform, the CIO served as Chief Development Officer at Sitecore, a leading global marketing and e-commerce software and solution provider, where solution design and cybersecurity awareness was a key area of responsibility. The Information Security Team advises the CIO via cyber reports on prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy The identification and assessment of cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, circulated advisories, detection tools, conducting employee training, monitoring emerging laws and regulation related to data protection and information security. We also maintain a third-party security program to further assist us with the identification, prioritization, assessment, mitigation, and remediation of third-party risks.

companyName: NV5 Global, Inc.


text: As part of our cybersecurity program, we regularly perform risk assessment of cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. On a bi-weekly basis, we assess cybersecurity threats through a third-party cybersecurity vendor. We use a widely adopted risk quantification model to identify, measure, and prioritize cybersecurity and technology risks and develop security controls and safeguards. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. We conduct regular reviews and tests of our information security program, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Our systems have experienced directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of information. To date these incidents have not had a material impact on our service, systems, or business. For more information on how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, refer to "Cybersecurity breaches of our systems and information technology could adversely impact our ability to operate" section included under Item 1A. Risk Factors included in this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates from senior management, including leaders from our Information Security, Compliance, and Legal teams regarding matters of cybersecurity. This includes various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our VP of Information Technology has over 25 years of industry experience involving information technology, including security, auditing, compliance, systems, and programming. Team members who support our cybersecurity program have relevant educational and industry experience.


text: Cybersecurity and Data Privacy Our commitment to cybersecurity risk management and sound governance of cybersecurity and other information security-related risks is reflected at the highest levels of our company. This commitment begins with our Board of Directors, which plays a key role in providing oversight of our business practices and related risks, while remaining informed as we evolve and new risks emerge over time.

companyName: WORLD KINECT CORP

ticker: WKC


text: Governance – Roles of our Board of Directors and Management Our Board has delegated both the Audit Committee and Technology & Operations Committee with responsibility for monitoring and oversight of the information technology and cybersecurity components of our risk assessment and risk management programs. The independent directors comprising our Audit Committee and our Technology & Operations Committee: • regularly review our cybersecurity and related information technology risks, controls and procedures, including data protection and privacy and our plans to mitigate cybersecurity risks and to respond to data breaches; • provide expertise and insight regarding technology and operations systems and processes that relate to or affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and • assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures.


text: We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization, also provide the Audit Committee and Technology & Operations Committee with regular updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.


text: Cybersecurity Risk Management & Strategy We define a cybersecurity event as any anomalous activity on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We have strategically integrated cybersecurity risk management into our broader enterprise risk management program to ensure cybersecurity risks are identified, evaluated and addressed alongside our operational objectives. Overall, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of our data and information by identifying, preventing and mitigating cybersecurity threats and being prepared to effectively respond to cybersecurity incidents when they occur.


text: Our cybersecurity policies, standards, processes, and practices are robust and comprehensive, aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification, demonstrating our commitment to security. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad and thorough approach to managing cyber risks.


text: We proactively conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.


text: We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct thorough security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Through our cybersecurity training program, employees and contractors are provided with cybersecurity training upon hire and thereafter on an annual basis. In addition, training and awareness campaigns continue throughout the year, where we employ various methods such as conducting mock phishing tests, live training sessions and informational articles.


text: As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union's General Data Protection Regulation ("GDPR"), UK Data Protection Act and the California Consumer Privacy Act ("CCPA"). To that end, to protect our data, including personal data, we maintain comprehensive information security and data privacy programs, with a balanced portfolio of defenses designed to prevent, detect and respond to cybersecurity threats.


text: Notwithstanding our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. – Risk Factors for a discussion of cybersecurity risks.


text: CBIZ maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, which is integrated into the Company's enterprise risk management system, includes the development, implementation, and maintenance of security measures and controls, as well as policies and procedures governing the operation of these security measures and controls.

companyName: CBIZ, Inc.

ticker: CBZ


text: The underlying controls of the cyber risk management program are based on recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27002 framework and code of practice for information security controls to establish, implement, and improve an Information Security Management System focused on cybersecurity.


text: Cyber partners are a key part of CBIZ's cybersecurity infrastructure. CBIZ partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. CBIZ engages with these partners to monitor and maintain the performance and effectiveness of third-party products and services that are deployed in CBIZ's environment, to scan for potential vulnerabilities and to conduct penetration testing.


text: CBIZ's IT Security Director reports to CBIZ's Chief Information Officer and is the head of the Company's cybersecurity team. The IT Security Director is responsible for assessing and managing CBIZ's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes. Additionally, members of the cyber security team have extensive information technology and program management expertise and have earned various cybersecurity certifications. Finally, the cybersecurity team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by CBIZ.


text: The Board of Directors oversees CBIZ's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Board of Directors on the status of CBIZ's cyber risk management program, typically on a semi-annual basis.


text: CBIZ faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations or cash flows. CBIZ has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on CBIZ's business, financial condition, results of operations or cash flows. See "Risk Factors – Risk Factors Related to Our Business and Industry – Cyber-attacks or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business."


text: The Company has implemented controls based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and the Sarbanes-Oxley Act of 2002. Our Information Technology organization is led by the Chief Information Officer ("CIO") who is responsible for cybersecurity risk management. The Audit Committee is tasked with oversight of our overall enterprise risk management program, including cybersecurity, and receives recurring cybersecurity updates throughout the year with one full cybersecurity report to the Board of Directors. Directors with experience in cybersecurity and technology play crucial oversight roles for our digital and cybersecurity strategies.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Our cybersecurity program is overseen by the Company's Chief Information Security Officer ("CISO") and is designed to protect and preserve the confidentiality, integrity and availability of our information technology assets. Risks and controls are monitored by the CISO and CIO and their evaluation of our overall program drives the nature and scope of our cybersecurity investments. Our CISO reports directly to the CIO and has 20 years of IT experience including leadership roles at various companies with enterprise responsibility for IT audit, IT infrastructure, and cybersecurity. The CISO reports to the Audit Committee on the effectiveness of the Company's cybersecurity program controls aligned to the NIST CSF framework. We periodically engage external subject matter experts who provide independent qualitative and quantitative assessments of the cybersecurity program maturity and response readiness. We also use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. In addition, the Company leverages a monthly cybersecurity awareness training program for all employees that is further reinforced through frequent phishing simulations.


text: Quarterly updates are provided by the CISO to the Cybersecurity Governance Committee comprised of cross functional senior management regarding the effectiveness of cybersecurity program and its ability to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Cybersecurity Governance Committee is responsible for monitoring and coordinating enterprise cybersecurity policy and strategy, and for providing guidance to key management and oversight bodies. Our cybersecurity program includes a risk-based incident response plan that provides a documented framework for handling incidents including coordination across multiple parts of the Company.


text: For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.


text: Our business is highly dependent on electronic information resources used for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our and our clients' information, which we refer to as "information systems", including our computer systems, hardware, software and networks and those of our third-party vendors and service providers. Our operations rely on the secure processing, storage and transmission of confidential and other information by our information systems and those of third parties.

companyName: Lazard, Inc.

ticker: LAZ


text: Lazard maintains a formal, robust cybersecurity and information security program that is aligned with the National Institute of Standards and Technology Cybersecurity Framework ("CSF") and integrated into our overall risk management process. Our Information Security Program, Policies and Standards are also designed to comply with the financial regulations and cybersecurity laws in the jurisdictions in which we operate. By focusing on the following four interconnected pillars, we aim to reduce the impact of cybersecurity incidents, safeguard our digital assets and foster a proactive and comprehensive approach to cybersecurity within our organization.


text: • Risk assessments and mitigation strategies Conduct regular risk assessments to identify and prioritize critical assets and vulnerabilities, both internally and with respect to third-party risks. Develop and implement appropriate mitigation strategies based on risk assessments. Monitor and evaluate the effectiveness of risk mitigation measures. • Professional cybersecurity staff Retain and recruit skilled cybersecurity professionals. Provide regular training and development opportunities. Foster collaboration and knowledge sharing among cybersecurity team members. • Security-aware organizational culture Maintain policies and procedures for reporting and responding to cybersecurity incidents. Empower employees to take ownership of their cybersecurity responsibilities. Promote a security-aware culture throughout the organization through regular training and awareness programs. • Security technology Implement and maintain robust cybersecurity technologies, including advanced threat detection, prevention and response tools. Regularly evaluate and update our suite of cybersecurity technology to address emerging threats and vulnerabilities. Integrate cybersecurity technologies with other systems and processes.


text: Third-Party Monitoring and External Reviews As noted above, our business regularly uses and relies on third-party information systems and services to process, store and transmit confidential and other information. To support our cybersecurity oversight of third-party information technology providers, we have integrated automated processes to manage third-party cloud security. We also use an enterprise-wide third-party technology provider to assist in our identification and assessment of cybersecurity risks to the Company presented by third parties, and our contracts are vetted by our internal legal and compliance departments as part of a process designed to ensure that we are provided the right to audit and test the security and quality of each of our vendors. As part of our screening and evaluation processes, we conduct due diligence on our potential vendors, as well as regular assessments of current vendors, regarding compliance with law (including financial regulations, sanctions regimes and data privacy regulations) and cybersecurity standards, including background checks and system tests.


text: Our Chief Information Security Officer ("CISO") regularly engages independent third parties to assess the performance of our cybersecurity risk management systems and procedures and to help test and identify cybersecurity risks to the Company. Annually, we engage an independent third-party to perform a comprehensive review of our cybersecurity programs, with the aim of ensuring alignment with the current version of the CSF. In addition, we engage several other third parties at regular intervals for targeted assessments of specific cybersecurity risk management systems, tools, vendors and processes. Among other things, tests include simulations of communications shared with affected stakeholders on security events and identification of vulnerabilities. These third-party audits and assessments are used by management to review, update and improve our cybersecurity risk management systems and identify vulnerabilities. Results and recommendations are reported to our CISO, who reports to our General Counsel. Material findings are presented to the Global Risk Committee ("GRC"), Audit Committee and the full Board as discussed below.


text: Cybersecurity Management Team and Board Oversight Lazard's cybersecurity program, which includes information security, is the primary responsibility of our CISO, who oversees our global information security strategy and program and is supported by our Information Technology and Information Security departments. The Company's current CISO has held the position since 2015 and has been working in technology risk management since 1991. The CISO holds a bachelor's degree from New York Institute of Technology and is an accredited Certified Information Systems Security Professional. Our CISO leads our Cybersecurity Incident Handling Team ("CSIHT"), to which cybersecurity threats and cybersecurity incidents are reported. The CSIHT manages the Company's response to cybersecurity threats and cybersecurity incidents, including the prevention, detection, analysis, containment, eradication and recovery thereof.


text: The CISO reports monthly to the GRC, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, among other members of senior management, regarding cybersecurity incidents from the preceding month.


text: Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company's cybersecurity risk profile and risk management strategies at regular intervals. Our CFO reviews with the Audit Committee categories of risk the Company faces, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board's Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard's cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.


text: Incident Response and Assessment Policies and Procedures Lazard has implemented policies and procedures to protect the firm from any interruptions to the availability of our data and our systems and to protect the firm's and our clients' data from intentional and unintentional disclosure, including disclosure arising from a range of cybersecurity threats. These policies and procedures outline actions to be taken after identifying suspected cybersecurity threats and cybersecurity incidents and designate the persons responsible for managing those actions.


text: In 2023, we launched an ongoing enterprise-wide communication initiative focused on cyber threats, which aims to educate Li-Cycle employees on recognizing and responding to potential cyber threats effectively, and serves as a reminder of the critical role each individual plays in ensuring the safety of our organization.

companyName: Li-Cycle Holdings Corp.


text: Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, including without limitation: • the probability of an adverse outcome; • the potential impact on financial results; • the likelihood of litigation or regulatory investigations; and • the potential impact on the Company's reputation and competitiveness.


text: A determination that a cybersecurity incident has, or is reasonably likely to have, a material impact on the Company is reported by the Assessment Committee to the CEO and the Board's Audit Committee without delay. The Assessment Committee also provides a summary of all incidents that are determined to be immaterial to the Board's Audit Committee at the next scheduled meeting.


text: For additional information regarding how cybersecurity threats or incidents are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors—A failure in or breach of our information systems or infrastructure, or those of third parties with which we do business, including as a result of cybersecurity incidents or threats, could disrupt our businesses, lead to reputational harm and legal liability or otherwise impact our ability to operate our business" and "Risk Factors—Other operational risks may disrupt our businesses, result in regulatory action against us or limit our growth."


companyName: Lazard Group LLC


text: Cybersecurity Risk Management and Strategy Cybersecurity is an integral part of our enterprise risk management. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our Digital Systems. Our cybersecurity risk management program includes a cybersecurity incident response plan as well as property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: HESS CORP


text: We design and assess our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Chief Risk Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our business risks, including financial, compliance, EHS, compensation and governance matters, among other topics.


text: Collaborative Approach: We have implemented a cross-functional approach involving all employees to help in identifying, preventing, and mitigating cybersecurity threats and incidents. We have implemented processes that provide for the prompt escalation of known cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by our management team, together with the Audit Committee, in a timely manner.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our exploration, development and production activities as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats during the year ended December 31, 2023, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology and infrastructure used by the Corporation or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Our Board of Directors (Board) appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Corporation. The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) primary responsibility for oversight of our risk management practices, including oversight of cybersecurity and other information technology risks.


text: The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and employee training activities. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team – including our Chief Risk Officer, our Head of Information Technology and our Chief Information Security Officer (CISO) – is responsible for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Risk Officer has nearly 20 years of experience in this role at the Corporation and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Our Head of Information Technology and our CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, our CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.


text: Our management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data ("Information Systems and Data").

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Our President, Product and Technology ("President of P&T"), Chief Data Officer ("CDO"), Chief Security Officer ("CSO"), and others in our cybersecurity and audit functions, help identify, assess, and manage cybersecurity threats and risks that may impact us or our business and operations. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating threats reported to us, coordinating with law enforcement, conducting audits and threat and vulnerability assessments, using external intelligence feeds, conducting table top exercises, and operating a bug bounty program.


text: Risks from Cybersecurity Incidents As of December 31, 2023, and for the past four years, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. Cybersecurity Governance We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including appropriate measures suggested by security standards, an incident response plan, incident detection and response, vulnerability management process, disaster recovery/business continuity plans, risk assessments, data encryption, network security controls, access controls, physical security, vendor risk management program, employee training, penetration tests, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall enterprise risk management processes and consider principles from recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity incidents when they occur.


text: From time to time, we use third-party providers to assist us with identifying, assessing, and managing material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, penetration testing firms, and forensic investigators.


text: We use third-party providers for various aspects of our business, such as data-hosting companies. We have a third-party risk management program to manage cybersecurity risks associated with our use of these providers, which includes vendor risk assessments, questionnaires, review of the vendor's security program, and contractual obligations for vendors, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us, see our risk factors under the heading "Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor titled "If our IT systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects."


text: Our Board oversees our enterprise risk management program, including the management of risks arising from cybersecurity threats. The audit committee of our Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. A cross-functional cybersecurity committee (the "Cybersecurity Committee"), which is comprised of members of our management team, reports to the Audit Committee.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and CSO. Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager. Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company. Prior to that, she held various leadership roles at a computer software company. Our CSO has over 30 years of experience in computer science and engineering disciplines, and served as the Chief Information Security Officer at various companies prior to joining Procore.


text: Members of our management team, including our President of P&T, CDO, and CSO, are responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity considerations into our risk management strategy, communicating key priorities, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports. We provide regular training for personnel regarding cybersecurity threats, which are intended to equip them with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our President of P&T, CDO, and CSO. Our President of P&T, CDO, and CSO work with our incident response team to help us mitigate and remediate cybersecurity incidents, as applicable. Our incident response and vulnerability management processes include reporting to the Audit Committee and the Cybersecurity Committee, as appropriate.


text: The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Cybersecurity Committee receives periodic reports from members of our cybersecurity team regarding such threats, risks, and processes. The Audit Committee and the Cybersecurity Committee also receive various reports, summaries, and presentations related to cybersecurity threats, risk, and mitigation.


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.

companyName: Merck & Co., Inc.

ticker: MRK


text: The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.


text: The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop exercises to assess its cybersecurity incident response processes. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.


text: In the event of a cybersecurity incident, the Company has a process in place whereby members of the security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.


text: The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board and our Audit Committee are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, security, and availability of the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the important elements that comprise and has been integrated into our overall enterprise risk management approach, our cybersecurity program includes the following:


text: Governance: As discussed in more detail below under the heading "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews operational risks. Our Chief Information Officer ("CIO"), together with our Head of Information Security ("HIS"), and other members of our management team meet regularly to review current cybersecurity risks. The CIO and management team representatives also meet with the Audit Committee at least on a quarterly basis to discuss and review our cybersecurity program and risk landscape.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, and access controls. We also employ multi-factor authentication and a managed endpoint detection and response solution for malware. These measures are evaluated and improved through vulnerability assessments and penetration testing completed by third party experts, as well as cybersecurity threat intelligence.


text: Incident Response and Recovery: We have established and maintain an incident response plan that addresses our response to a cybersecurity incident. This plan is evaluated regularly.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and third-party systems.


text: Education and Awareness: We provide regular training on cybersecurity threats to equip our personnel with effective tools to address them and to communicate our latest information security policies, processes and practices.


text: We periodically evaluate and test our policies, standards, processes, and practices to address cybersecurity threats and incidents. These efforts include a wide range of activities, including third party assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such assessments and reviews are reported to our management team, the Audit Committee and the Board, and we adjust our cybersecurity program as necessary based on the information provided by these assessments and reviews.


text: Our Board, in coordination with the Audit Committee, oversees our risk management approach, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent expert reviews, the threat environment, technological trends, and any material risks identified with our third parties. The Audit Committee also receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been remediated. Our CIO, Audit Committee and Board review and discuss our approach to cybersecurity risk on an annual basis.


text: The HIS and CIO, in coordination with our management team, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Through an ongoing process, the HIS monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the CIO, management team, and when appropriate, the Audit Committee.


text: Selected Management and Director Qualifications The HIS and CIO have both served in various roles in information technology and information security for many years, including serving in similar roles at other publicly traded companies. The HIS holds several industry accreditations, including being a certified Chief Information Security Officer, and has worked in the information technology field for over 25 years, specializing in Information Security for the last 15 years. The CIO has undergraduate and graduate degrees in technical fields, plus a master's degree in business administration, and has worked in healthcare information technology for over 20 years. Our CEO, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at Vir and at similarly situated companies, including risks arising from cybersecurity threats. For example, our CFO has been responsible for leading and managing Information Technology departments at three separate publicly traded companies, including our Company, and has leadership experience in business continuity planning in various roles. Additionally, one of our directors formerly served as the United States Secretary of Homeland Security, in which capacity she had ultimate responsibility for the cybersecurity of the critical infrastructure of the United States of America, and as President of the University of California with responsibility for cybersecurity matters related to the university's various networks.


text: Risk and Issues Disclosure We describe the risks we face, including cybersecurity risks, in Section 1A above, titled "Risk Factors". For the period covered by this Annual Report on Form 10-K, we are unaware of any specific cybersecurity threats that have materially affected the Company, its business strategy, results of operations or financial condition.


text: In an effort to reduce the likelihood and severity of cybersecurity incidents, we have established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and our business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Risk Management and Strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats include the following: • Ongoing Assessment—The Cybersecurity Risk and Compliance department, led by the Managing Director, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cyber Security Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Third Parties—We engage third parties, such as security service providers, risk management firms and external legal counsels to assess material risks from cybersecurity threats and report on our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration, as well as NERC, inspect applicable components of our cybersecurity program. • Third-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. This includes a risk-based vendor management program, which incorporates robust security contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, anti-malware and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, as well as additional education for personnel with access to industrial control systems or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each October, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout the month from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), as well as a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Such physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC has promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.


text: These processes are integral to our overall risk management system or processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP – Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP – AERC and consists of members of senior management including the CIDO and six other of the CEO's direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from these attacks or other cybersecurity incidents, including as a result of prior cybersecurity incidents.


text: –PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board —The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings a year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risk, a cybersecurity update from the CISO and/or CIDO, and review of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO are regular attendees at IOC meetings. In addition, the IOC meets with the CISO in executive session at each meeting with no other members of management present, and has also met with the CIDO, to whom the CISO directly reports, in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CIDO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC and Audit Committee are informed of cybersecurity risks by way of frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate.


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of materials risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report of the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees twice per year, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity, risk and compliance team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity, risk and compliance team. The CISO has served in this role since September 2018. Our CISO has over 20 years of experience in IT security management and served as the director of information security and chief security architect in the insurance sector prior to joining PSEG. Our CISO has a bachelor's degree in electrical engineering and holds multiple security certifications, including Certificate of Cloud Security Knowledge, Certified Information Systems Security Professional, Certified Information Systems Auditor, Information Systems Security Architecture Professional, and National Institute of Standards and Technology Cyber Security Professional Practitioner.


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and meets with the IOC, without other members of management present, during each meeting's executive session. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity, risk and compliance team, who are tasked with these responsibilities on a day-to-day basis.


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity Risk and Compliance Team cybersecurity managing counsel, and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council.


text: In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks by way of updates shared during Cybersecurity Council meetings, as well as through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: FS KKR Capital Corp

ticker: FSK


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is staffed by a team of highly skilled cybersecurity professionals, including over 24 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts. The program incorporates industry standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information, backed by a suite of best-in-class security technologies and tools to implement and automate security protections for our networks, employees, and customers.

companyName: Crane Co

ticker: CR


text: We utilize a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented an approach to identify and mitigate information security risks that we believe is commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. From the completion of the Company's separation from Crane Holdings on April 3, 2023. Since the separation and during the past five years (as Crane Holdings), no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond.


text: Crane has not experienced a material third-party security breach, but recognizes the inherent cyber risks associated with relying on third-party vendors such as cloud service providers, software vendors, data processors, and IT service providers with access to company information, systems, or processes. Crane is committed to managing these risks responsibly and transparently and has an active process in place to assess and reduce that risk, including performing due diligence on third-party vendors before onboarding and evaluating and assessing their cybersecurity policies, procedures, incident response plans, and relevant certifications (e.g., SOC 2, ISO 27001, etc.). We continuously monitor publicly available information about our third-party vendors for reports of security incidents and fully investigate any reports for impact to Crane systems or information and take appropriate measures to limit the impact to Crane in the event of a third-party security incident.


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all employees on cybersecurity standards and provide monthly training on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. We use advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we periodically engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.


text: Governance Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 15 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Cybersecurity Governance Our approach to cybersecurity begins with our desire to maintain strong governance and controls to effectively manage and reduce security risks. Security begins with our "tone at the top", where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. The cybersecurity program is led by Crane's Chief Information Security Officer, who provides periodic updates to the Audit Committee of our Board of Directors, annual updates to the full Board of Directors, and regular reports to the executive management team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. The entire Board of Directors ultimately is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks, including cyber risks. The Company maintains cyber risk and related insurance policies as a measure of added protection.


text: We embrace a "defense in depth" approach to assess, identify, and manage cybersecurity threats. A defense in depth approach seeks to implement multiple layers of defenses in order to help reduce the risk that a single process or control failure might result in a material incident. We utilize a risk management framework to assess, manage, and report on material risks and threats. In light of the importance of cybersecurity matters, we have developed as part of this framework a risk domain specific to cybersecurity matters, including specifying applicable risk tolerances and metrics. The Executive Vice President, Chief Information Officer (CIO), who has served in information technology leadership roles with the Company since 2007 and has over 20 years of experience with matters related to cybersecurity, including as an executive leader and consultant, and Executive Vice President, Enterprise Risk Management (EVP, ERM), who has served in risk management leadership roles for the Company since 2015, have oversight over information technology and enterprise risk management matters, respectively, and receive monthly reports on cyber-related metrics and activities from their teams. In addition, we have implemented escalation procedures and protocols, including an incident response team that includes key members of management such as the CIO and EVP, ERM, to manage and coordinate responses to potentially significant cybersecurity incidents. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2023, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Company's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Company. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Company further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Company's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on SEE's risks relating to our technologies, systems, and networks.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.