text: As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization ("ISO"), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. The Company's Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in the ordinary course of the business of the Company.


text: Our cybersecurity and information security program is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities: closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews (at least annually) of our consumer facing and internal policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling; conduct annual information security training for all our employees;

companyName: AXON ENTERPRISE, INC.

ticker: AXON

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: recruit and retain highly skilled cybersecurity professionals, and provide regular training and development opportunities for our cybersecurity and information security employees;


text: conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: through policy, practice and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;


text: perform due diligence on third-party vendors and, based on our risk assessment, put in place contractual undertakings and oversight to manage and reduce the risks associated with third-party vendors;

stage1Category: Third-Party Risk


text: Third Party Monitoring and External Reviews Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers' data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.

stage1Method: majority


text: Material findings, notable weaknesses and suggestions are presented to the Enterprise Risk and Compliance Committee of the Company's Board of Directors (the "ERC Committee") as discussed below.

stage1Category: Board Governance


text: Cybersecurity Management Team Our cybersecurity and information security program, which includes data privacy, is the responsibility of our Chief Information Security Officer ("CISO"), who oversees our global information security program. Our current CISO has served in various information technology and information security roles over the past 20 years, having built the Company's information security program over the last 10 years, and serving as CISO since December 2017. We expect our current CISO to transition his responsibilities to our new CISO over the coming quarter. Our new CISO brings diverse perspectives and significant skills and experience leading security organizations across a number of technology companies.

stage1Category: Management Role


text: Our CISO attends quarterly meetings of the Company's Disclosure Committee and provides input on the Company's disclosures in its Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. The Company's CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Financial Officer and, to the extent practicable or relevant, other senior executives.


text: Board of Directors Oversight As a part of its oversight of the key risks facing the Company, our Board of Directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. While the Audit Committee of the Company's Board of Directors (the "Audit Committee") reviews any significant legal, compliance or regulatory matters that may have a material impact on the Company's business, financial statements or compliance policies generally, it does so in consultation with our ERC Committee with respect to any such matters that involve cybersecurity, data privacy or information technology. The Chair of our ERC Committee is also a member of our Audit Committee, which facilitates close coordination between the two committees on cybersecurity, data privacy and information technology matters.


text: Our ERC Committee oversees our overall approach to enterprise risk management, of which cybersecurity is an important component. The ERC Committee and its Chair, in coordination with the Information Security Team and CISO, regularly review the categories of risk the Company faces, including any cybersecurity risk exposures, as well as the likelihood of occurrence, the potential impact of those risks, and the steps management has taken to monitor, mitigate and control such exposures. To facilitate these reviews, the Information Security Team and CISO report at least quarterly to the ERC Committee with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of the Company's cybersecurity and information security program. The ERC Committee makes regular reports to the full Board of Directors regarding updates on cybersecurity and other risks.


text: Incident Response and Assessment Policies and Procedures Axon has implemented our cybersecurity and information security program and cybersecurity incident response plan to protect our and our customers' data from, and mitigate the effects of, unintentional disclosure as well as cybersecurity threats and incidents of all severity levels. Our program and response plan outline actions to be taken after identifying a suspected cybersecurity threat or incident and the people responsible for managing those actions. We have also implemented disclosure controls and procedures for determining the materiality of a cybersecurity incident to outline disclosure and communications responsibilities during cybersecurity incidents of all severity levels.


text: In the event of a possibly material cyber incident, the Security Incident Response Team, under the direction of the Corporate General Counsel and/or the Chief Legal Officer, would collect and document information relevant to materiality and make a threshold determination as to whether such cybersecurity incident (including those occurring on the information systems of third parties) is potentially material. The Security Incident Response Team would meet with the Chair of the ERC Committee to review the preliminary findings of the Security Incident Response Team, including the possible factors in determining materiality. If the Security Incident Response Team and the Chair of the ERC Committee determine that the cybersecurity incident warrants further review after consideration of such findings and factors, the Audit Committee would be convened for a meeting (to which all members of the ERC Committee would be invited) to review the cybersecurity incident and the findings of the Security Incident Response Team and the Chair of the ERC Committee. The Audit Committee would then make a materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, informed by any recommendations of the ERC Committee and/or its Chair.


text: At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See " Risk Factors—If our security measures or those of our third-party cloud storage providers are breached and unauthorized access is obtained to customers' data or our data, our network, data centers and products and services may be perceived as not being secure, customers may curtail or stop using our service and we may incur significant legal and financial exposure and liabilities " and " Risk Factors—Catastrophic events could materially adversely affect our business, results of operations and/or financial condition. "

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.

stage1Category: None/Other


text: As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization ("ISO"), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. Our Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in our ordinary course of business.


text: Our cybersecurity and information security programs are designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews (at least annually) of our consumer facing and internal policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual information security training for all employees; • recruit and retain highly skilled cybersecurity professionals, and provide regular training and development opportunities for our cybersecurity and information security employees; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • perform due diligence on third-party vendors and, based on our risk assessment, put in place contractual undertakings and oversight to manage and reduce the risks associated with third-party vendors; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our technologies, methods and processes; • conduct regular risk assessments of our information systems to identify weaknesses, and develop and implement mitigations to improve our cybersecurity and information security program; • conduct regular security assessments, vulnerability scans, and penetration tests (including by third-party assessment firms) of products systems and internal systems to discover vulnerabilities and apply appropriate mitigations within standardized timelines; • maintain, implement, evaluate and update our cybersecurity technologies to address threats and vulnerabilities; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Third-Party Monitoring and External Reviews Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers' data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.


text: Cybersecurity Management Team Our cybersecurity and information security program, which includes data privacy, is the responsibility of our Chief Information Security Officer ("CISO"), who oversees our global information security program. Our current CISO has served in various information technology and information security roles over the past 20 years including roles at Netflix, Salesforce and Facebook, and has served as CISO since February 2024. He also has relevant degrees and certifications, including a Master of Science degree in Information Assurance from Iowa State University. The information security program has been built over the last 10 years under the leadership of experienced Information Security professionals.


text: Our CISO attends quarterly meetings of our Disclosure Committee and provides input on disclosures in our Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. Our CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Operating Officer & Chief Financial Officer and, to the extent practicable or relevant, other senior executives.


text: Board of Directors Oversight As a part of its oversight of the key risks facing Axon, our Board of Directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. While the Audit Committee of the Company's Board of Directors (the "Audit Committee") reviews any significant legal, compliance or regulatory matters that may have a material impact on our business, financial statements or compliance policies generally, it does so in consultation with our ERC Committee with respect to any such matters that involve cybersecurity, data privacy or information technology. The Chair of our ERC Committee is also a member of our Audit Committee, which facilitates close coordination between the two committees on cybersecurity, data privacy and information technology matters.


text: Our ERC Committee oversees our overall approach to enterprise risk management, of which cybersecurity is an important component. The ERC Committee and its Chair, in coordination with the Information Security Team and CISO, regularly review the categories of risk the Company faces, including any cybersecurity risk exposures, as well as the likelihood of occurrence, the potential impact of those risks, and the steps management has taken to monitor, mitigate and control such exposures. To facilitate these reviews, the Information Security Team and CISO report at least quarterly to the ERC Committee with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of our cybersecurity and information security program. The ERC Committee makes regular reports to the full Board of Directors regarding updates on cybersecurity and other risks.


text: Any materiality assessment that results in a determination that a cybersecurity incident is not material would be reported by the Information Security Team, or appropriate members of management, to the ERC Committee at its next scheduled meeting.


text: At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional details, refer to Item 1A in Part I of this Amended 2024 Annual Report on Form 10-K/A.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan ("IRP"). The purpose of the IRP is to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: We developed and maintain our program as required by applicable laws and regulations, including without limitation Cybersecurity Maturity Model Certification (CMMC) and 17 CFR Part 229.


text: We have designated our Chief Information Officer (CIO) to implement and maintain the IRP. Our CIO has over 20 years of experience in the field of cybersecurity and is responsible for the management of our cybersecurity and data privacy program. Among other information security duties, the CIO is responsible for: • implementing the IRP, • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents, • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents, • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures, • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP, and • reviewing the IRP at least annually, or whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment including risks associated with ransomware; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO regularly informs our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-state actors and other malicious internet-based activity, continue to increase. Cybersecurity threats also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees and other third parties to disclose information, transfer funds or unwittingly provide access to systems or data.


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – Risks Related to Our Operations – "Cybersecurity breaches or disruptions of our information technology systems could negatively impact our operations," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our global enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Governance and Management's Responsibilities Our entire Board considers cybersecurity risk as part of its risk oversight function and our entire board oversees management's implementation of our cybersecurity risk management program.


text: Our entire Board receives regular reports from management on our cybersecurity risks. In addition, management updates our entire Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management program is an integral part of its overall enterprise risk management efforts. The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices. Through this framework, the Company devotes significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.

companyName: BLACKBERRY Ltd

ticker: BB


text: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts vulnerability testing and awareness training. The Company also conducts penetration testing and other risk assessments, implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security compliance standards.


text: The Company's incident response team, comprised of representatives from the Company's information technology, information security, product security, engineering, privacy and legal groups, is responsible for addressing data breaches, intrusions, and other security incidents and implementing the Company's incident response plan. The Company's incident response plan includes processes and procedures for assessing internal and external threats, escalation and activation, crisis management, and post-incident recovery.


text: The readiness of the incident response team is promoted through table-top exercises and threat simulations. The Company also conducts mandatory training of all employees on its security practices and policies and periodically sends simulated phishing emails to employees to build resilience.


text: In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company's systems. At the same time, the Company's control over the security posture of third parties is limited and there can be no assurance that any partner of the Company will not experience a compromise or failure in the information assets under its control.


text: For the years covered by this report, the Company did not identify any security threats or incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations or financial condition. However, like all other enterprises, the Company faces known and unknown cybersecurity risks and threats that are not fully mitigated. While the Company works continuously to enhance its security programs and risk management efforts, it discovers vulnerabilities from time to time and there can be no assurance that the Company has not experienced an undetected cybersecurity incident or that it will not experience material loss or damage from an incident in the future.


text: Cybersecurity Governance The Board has overall responsibility for the Company's enterprise risk management program, and the Audit and Risk Management Committee assists the Board with this oversight. The Company's internal audit function reports to the Audit and Risk Management Committee and, among other things, provides independent assurance on the Company's risk management activities and internal controls related to cybersecurity risk. For more information, see Part 3, Item 10 "Directors, Executive Officers and Corporate Governance – Enterprise Risk Management".


text: Management's cybersecurity programs operate under the leadership of the Company's Chief Information Security Officer ("CISO"), who receives reports from his team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO provides quarterly updates to the Board on the advancing maturity of the Company's cybersecurity program, including reports on security controls coverage and effectiveness, secure software development and product security, vulnerability testing and remediation, and security operations. The updates also include reports on improvements to processes, technology and governance to mitigate residual cybersecurity risk.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management program is an integral part of its overall enterprise risk management efforts. The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices designed to safeguard the confidentiality, integrity, and availability of its information assets. Through this framework, the Company devotes appropriate resources to monitoring, identifying, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.


text: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts awareness training. The Company also conducts penetration and vulnerability testing and other risk assessments, implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security industry standards.


text: The Company's incident response team, comprised of representatives from the Company's information technology, information security, product security, engineering, communications, privacy and legal groups, is responsible for addressing actual and potential security threats and other security incidents and implementing the Company's incident response plan. The Company's incident response plan includes processes and procedures for assessing potential internal and external threats, escalation, activation and notification, crisis management, and post-incident recovery.


text: The readiness of the incident response team is promoted through table-top exercises and threat simulations, including during the fiscal year ended February 28, 2025. The Company also conducts mandatory training of all employees on its security and data privacy practices and policies and periodically sends simulated phishing emails to employees to build resilience.


text: In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company's systems. At the same time, the Company's control over the security posture of third parties is limited and there can be no assurance that any vendor or service provider of the Company will not experience a compromise or failure in the information assets under its control.


text: Cybersecurity Governance The Board has overall responsibility for the Company's enterprise risk management program, including cybersecurity risk, and the Audit and Risk Management Committee assists the Board with this oversight. The Company's internal audit function reports to the Audit and Risk Management Committee and, among other things, provides independent assurance on the Company's risk management activities and internal controls related to cybersecurity risk. For more information, see Part 3, Item 10 "Directors, Executive Officers and Corporate Governance – Enterprise Risk Management".


text: Management's cybersecurity programs operate under the leadership of the Company's Chief Information Security Officer ("CISO"), who oversees a team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO provides quarterly updates to the Board on the advancing maturity of the Company's cybersecurity program, including reports on security controls coverage and effectiveness, secure software development and product security, vulnerability testing and remediation, and security operations. The updates also include reports on improvements to processes, technology and governance to mitigate residual cybersecurity risk.


text: CNX maintains a comprehensive cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including appropriate internal risk assessment and policy implementation, incorporating a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies designed to increase security for our information, facilities, and infrastructure.

companyName: CNX Resources Corp

ticker: CNX


text: CNX maintains a comprehensive cybersecurity program that aims to provide a robust, dynamic, and secure environment that protects the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including appropriate internal risk assessment and policy implementation, incorporating a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.


text: Risk Management and Strategy The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an integral component of our overall risk management strategy. We have adopted the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework (the Framework) to guide our cybersecurity program. Developed in 2013, the Framework is a voluntary set of standards, guidelines, and best practices designed to help organizations better manage cybersecurity risks. CNX's cybersecurity team consists of certain of our executive officers as well as dedicated cybersecurity personnel – including without limitation, our Chief Information Officer (CIO), Director of Cybersecurity, and multiple cybersecurity engineers. The cybersecurity team, led by professionals with deep cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with the Board of Directors (The Board) and our executive management team accordingly on an as-needed basis.


text: We have developed a written incident response plan (IRP) that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for the conducting of legally privileged investigations to enable us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.


text: We have also established a vulnerability management program to address the identification, prioritization, and remediation of potential cybersecurity vulnerabilities. These procedures allocate responsibility among various members of our cybersecurity team to detect vulnerabilities, assess their urgency, backup appropriate systems, and prioritize, select, test, and verify remediation methods. We hold weekly and monthly vulnerability management meetings with our internal technical and business partners and regularly review these procedures to ensure that this vulnerability management program continues to be effective.


text: Third parties also play a role in the Company's comprehensive approach to cybersecurity and its associated risk management framework. CNX leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is currently included in our internal auditing procedures, however, we have plans to further mature these procedures in the current fiscal year.


text: The Board, in coordination with the ESCR Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the ESCR Committee include overseeing policies and management systems for cybersecurity matters and reviewing CNX's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the ESCR Committee receive regular presentations and reports on cybersecurity risks that address a wide range of topics, including recent developments, personnel changes, discussion of testing and vulnerability assessment efforts, technological trends or tools, third party updates, and regulatory standards. The CNX IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with any cybersecurity incidents that may occur. On a periodic basis, the Board and the ESCR Committee discuss our approach to cybersecurity with our CIO and Director of Cybersecurity.


text: Management's role in assessing and managing our material risks from cybersecurity threats, as well as making final materiality determinations and disclosures and other compliance decisions, is documented in the CNX IRP, and our processes for identifying, prioritizing, and remediating vulnerabilities are documented via the Company's vulnerability management program procedures. In connection with and pursuant to the IRP, our dedicated incident response team works collaboratively across CNX to carry out a program that has been designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to potential cybersecurity incidents.


text: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While CNX maintains cybersecurity insurance, the costs related to cybersecurity threats or incidents may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company recognizes the risk that cybersecurity threats pose to our operations and considers cybersecurity an integral component of our overall risk management strategy. We have adopted the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework to guide our cybersecurity program.


text: CNX's cybersecurity team includes executive officers and dedicated cybersecurity personnel, such as our Vice President of Information and Technology, who has approximately 30 years of technical leadership and cybersecurity expertise, and multiple cybersecurity engineers. Led by professionals with deep cybersecurity expertise across multiple industries, the team takes a cross-functional approach to addressing risks and engages in discussions with the Board of Directors and executive management as needed.


text: We have also established a vulnerability management program to address the identification, prioritization, and remediation of potential cybersecurity vulnerabilities. These procedures allocate responsibility among various members of our cybersecurity team to detect vulnerabilities, assess their urgency, backup appropriate systems, and prioritize, select, test, and verify remediation methods. We hold vulnerability management meetings with our internal technical and business partners and regularly review these procedures.


text: Third parties also play a role in the Company's cybersecurity processes and its associated risk management framework. CNX leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is currently included in our internal auditing procedures and we have plans to further mature these procedures in the current fiscal year.


text: The Board, in coordination with the ESCR Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the ESCR Committee include overseeing policies and management systems for cybersecurity matters and reviewing CNX's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the ESCR Committee receive regular presentations and reports on cybersecurity risks that address a wide range of topics, including recent developments, personnel changes, discussion of testing and vulnerability assessment efforts, technological trends or tools, third party updates, and regulatory standards. The CNX IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with potentially significant cybersecurity incidents that may occur. On a periodic basis, the Board and the ESCR Committee discuss our approach to cybersecurity with our Vice President Information and Technology.


text: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While CNX maintains cybersecurity insurance, the costs related to cybersecurity threats or incidents may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.


text: Description of Cybersecurity Risk Management and Strategy To assess, identify and manage material cybersecurity risks, we have endeavored to implement policies, standards and technical controls with the aim of protecting our information and operations systems (collectively, "IT systems"). These standards are guided, in part, by the relevant National Institute of Standards and Technology and American Petroleum Institute frameworks. We use various internal and third-party tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion or disruption. Regular assessments are conducted across our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: We engage assessors, consultants, auditors and other third parties in connection with the above processes. We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we have established a process to assess and oversee the cybersecurity practices of our vendors. Before engaging with third-party service providers, we conduct due diligence to evaluate their cybersecurity capabilities and potential vulnerabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, including adherence to specific security practices and protocols.


text: The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be dynamic and to intersect with various other enterprise risks. As such, cybersecurity is considered an integral component of our enterprise-wide risk management approach. As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership.


text: Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems or those of our vendors could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Cybersecurity Program Governance Our cybersecurity program is led by our Vice President of Information Security, North America, who reports directly to our CFO and oversees the dedicated team responsible for executing our cybersecurity strategy, including the primary assessment and management of cybersecurity risks. Our cybersecurity leadership team also includes our Senior Director, Technology, Infrastructure & Cyber Defense and our Senior Director, Security & Strategy. The Board receives quarterly updates on material security incidents, detection, monitoring, security culture scores, and other key initiatives and notable events from our cybersecurity leadership team.


text: To facilitate effective management, our cybersecurity leadership team holds regular discussions with our dedicated cybersecurity team on cybersecurity risks, threat intelligence, incident trends, security audits, and the effectiveness of our training and testing. Our cybersecurity leadership team convenes regularly to review and monitor programs designed to prevent and detect cybersecurity threats and mitigate and remediate cybersecurity incidents. Our cybersecurity leadership team also receives comprehensive reports on security incidents, threat intelligence, and vulnerability assessments from our cybersecurity team.


text: Index to Financial Statements Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes more than 50 years of collective experience in infrastructure, cybersecurity and telecommunications. In addition to having the requisite training, knowledge, skills and abilities required for their respective positions, the cybersecurity leadership team collectively holds various relevant U.S. and Canadian information security certifications. The cybersecurity leadership team is supported by a dedicated team of skilled cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Cybersecurity Program Governance Our cybersecurity program is led by our Vice President of Information Services, North America, who reports directly to our CFO and oversees the dedicated team responsible for executing our cybersecurity strategy, including the primary assessment and management of cybersecurity risks. Our cybersecurity leadership team also includes our Director, Technology Risk and Cybersecurity, our Senior Director, Strategic Planning, our Senior Director, North American Solution Delivery and our Senior Director, Enterprise Technology. The Board receives quarterly updates on material security incidents (if applicable), detection, monitoring, security culture scores, and other key initiatives and notable events from our cybersecurity leadership team.


text: Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes more than 50 years of collective experience in infrastructure, cybersecurity and telecommunications. In addition to having the requisite training, knowledge, skills and abilities required for their respective positions, the cybersecurity leadership team collectively holds various relevant U.S. and Canadian information security certifications. The cybersecurity leadership team is supported by a dedicated team of skilled cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Risk Management and Strategy The Company prioritizes the security of our banking operations to protect our customers and our reputation, and to preserve our value. While eliminating all risk is unrealistic, we invest heavily in our Information Security program to mitigate cybersecurity risks. Our controls focus on safeguarding information systems, networks, and assets from unauthorized access, ransomware threats, and service disruptions. Third-party vendors are also held to similar standards, with reviews conducted annually.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: The Company's Information Security program establishes policies, procedures, and risk assessments related to effective and efficient controls related to design and operations of the program. The Company also leverages regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and frameworks to develop and maintain the information security program, including, without limitation the: FFIEC Cybersecurity Assessment Tool, National Institute of Standards and Technology (NIST) Cybersecurity Framework, and Section 501(b) of the Gramm-Leach-Bliley Act of 1999. Senior Management also monitors notifications from the U.S. Computer Emergency Readiness Team ("CERT") and the Financial Services Information Sharing and Analysis Center (FS-ISAC). Some of our procedures and controls include, without limitation: • Security Information and Event Management ("SIEM") logging and triggers, alerts, and 24/7 monitoring. • Endpoint Detection and Response ("EDR"), encryption, and backups. • Third party vendor risk management. • Disaster recovery and incident response plans. • Security awareness training, social engineering testing, and remedial training. • Vulnerability scanning, remediation tracking, and reporting.


text: We [regularly] engage certified and reputable consultants and auditing firms to evaluate the maturity and effectiveness of our security, including testing the design and operational effectiveness of controls, penetration testing, engaging in independent reviews of policies and standards, and consulting on best practices.


text: The Board of Directors, Audit Committee and the Information Technology (IT) Steering Committee, which is comprised of members from various departments including IT, Accounting, Compliance, Lending, Credit, Human Resources, Operations, Treasury Management, Treasury Support, Retail, Mortgage Sales, Mortgage Operations, Commercial Operations, and the Executive Team, provide oversight and direction of cybersecurity threats and risk management. The Board of Directors reviews and approves the Company's policies related to Information Security and receives periodic updates from the IT Steering Committee and management in the areas of cybersecurity risks, controls, projects and initiatives, vulnerability assessments, vendor management, and security considerations. The Board of Directors is promptly notified and provided information on any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates of any such incidents until they are resolved.


text: A dedicated team, led by the Senior Vice President of Information Technology and Information Security Officer (the "SVP of IT and ISO") manages the day-to-day cybersecurity risk program and supervises internal personnel and relationships with external technology and security consultants. The SVP of IT and ISO has over 18 years of experience in the banking industry as it relates to strategy and cyber security and reports to the Chief Operating Officer, the IT Steering Committee, the Audit Committee, and the Board of Directors.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management and privacy programs play a central role in the protection of the confidential information of our members, team members, and business partners, and, as such, are critical to the successful operation of our business.

companyName: CENTENE CORP

ticker: CNC


text: While we believe we have implemented robust security procedures and controls to mitigate cybersecurity threats, we cannot be certain that these measures will be successful. The threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Although to date the Company has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Company's systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.


text: We regularly engage certified and reputable consultants and auditing firms to evaluate the maturity and effectiveness of our security, including testing the design and operational effectiveness of controls, penetration testing, engaging in independent reviews of policies and standards, and consulting on best practices.


text: CFBank also has a third-party risk management program. Management performs periodic reviews of third-party vendors on their cybersecurity and business continuity capabilities to ensure they meet contractual requirements and satisfactory audit testing results. Vendors not meeting CFBank's risk requirements are notified to make improvements and, if the vendors cannot mitigate the identified risks, CFBank management looks to identify alternative vendors. Vendor risk assessments are retained by CFBank.


text: Scanning Third-Party Emails and Attachments: To mitigate the risk of email-based threats, all incoming emails and attachments from third parties are scanned for malicious content. This ensures that potentially harmful materials are identified and quarantined before they can reach the end user.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We design and assess our program using components of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: HOST HOTELS & RESORTS L.P.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program is led by our senior vice president of information technology who has over 20 years of experience in information technology development and capabilities. Our cybersecurity risk management program includes the following key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents: • implementing technologies to proactively monitor vulnerabilities and reduce risk, maintaining security policies and standards, and regularly updating our response planning and protocols; • maintaining business continuity, contingency and recovery plans, including a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • retaining a third-party cybersecurity provider for emergency incident response services; • annual assessments of our cybersecurity risk management program by a third-party security firm, as well as semi-annual vulnerability assessments and penetration testing by external service providers; • cybersecurity awareness training for employees as well as senior management, including quarterly refresher training; and • annual cybersecurity assessments of certain third-party service providers with access to our employee data.


text: Our cybersecurity risk management program and processes, as described in this section, do not encompass the information technology systems of our third-party managers. As a REIT, we are required to retain third-party managers to run all operational aspects of our hotels, and our hotel managers are dependent on information technology networks and systems that they procure and manage directly or through their own third-party service providers, to access, process, transmit and store proprietary and hotel customer information. We do not have access to these systems or to hotel customer information, and we rely on the security programs, processes and systems of our managers to protect hotel operations and customer information from cybersecurity threats.


text: As of February 23, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we have not been materially affected by known cybersecurity threats affecting the Company, we and our hotel managers continue to face risks from cybersecurity threats that, if realized, could materially adversely affect us in the future. For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part 1 Item 1A. "Risk Factors — Cyber threats and the risk of data breaches or disruptions of our managers' or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, could materially adversely affect our business and results."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives semi-annual updates on topics related to information security and cyber risks and readiness from our management team, including our senior vice president of information technology. Management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including information security and cybersecurity risks, which are presented to the full Board at least annually as part of the Board's oversight of enterprise risk management.


text: We expect each of our employees to be responsible for the security and confidentiality of our client information and our computer systems. We communicate this responsibility to each employee upon beginning employment with us and regularly throughout their employment. We require new hires to complete training on cyber-crime, social engineering, and cybersecurity awareness, and we also require this training during each year of employment thereafter. Employees are tested on their understanding of these requirements and provide acknowledgement of their responsibilities.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Executive Vice President oversees risks of cybersecurity threats and reports quarterly, and as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. Our Executive Vice President has over ten years of experience with developers of access management, network security and data protection solutions.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program is led by our senior vice president of information technology who has over 25 years of information technology experience that includes application development, information technology infrastructure, security, business continuity, and engineering. He holds a master's degree in computer science and a bachelor of engineering in electrical engineering. Our vice president of cybersecurity reports to the senior vice president of information technology and has over 25 years of operations and security experience backed by an undergraduate degree in computer management and various technology and security certifications. Our vice president of cybersecurity is responsible for the day-to-day assessment and management of cybersecurity risk. Our cybersecurity risk management program includes the following key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents: • implementing technologies to proactively monitor vulnerabilities and reduce risk, maintaining security policies and standards, and regularly updating our response planning and protocols; • maintaining business continuity, contingency and recovery plans, including a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • retaining a third-party cybersecurity provider for emergency incident response services; • annual assessments of our cybersecurity risk management program by a third-party security firm, as well as semi-annual vulnerability assessments and penetration testing by external service providers; • cybersecurity awareness training for employees as well as senior management, including quarterly refresher training; and • annual cybersecurity assessments of certain third-party service providers with access to our employee data.


text: As of February 21, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we have not been materially affected by known cybersecurity threats affecting the Company, we and our hotel managers continue to face risks from cybersecurity threats that, if realized, could materially adversely affect us in the future. For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part I, Item 1A. "Risk Factors — We face the risk of material data breaches and disruptions of our managers' or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, which could materially adversely affect our business and results."


text: Risk Management and Strategy Our ERM program is designed to identify, assess, and mitigate risks across our Company, including financial, operational, reputational, strategic, legal, liquidity, and credit. Cybersecurity is a critical component of this program as it is necessary for supporting our business and protecting our customers in an increasingly complex environment. The cybersecurity component of our ERM program is designed around the FFIEC Information Security IT Examination Handbook, the FFIEC Business Continuity Planning Handbook, and the FFIEC Cybersecurity Assessment Tool, and is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software, and information assets, including client and other sensitive data. Cybersecurity is an ongoing initiative that we monitor very closely. Threats to data security emerge and change rapidly. Cyber threats could include attacks that are common to most industries, such as ransomware attacks, unauthorized access, tampering, malware insertion, or other system integrity events, but could also include attacks from highly organized perpetrators targeting financial services companies.


text: The cybersecurity component of our ERM program consists of several elements including: • A risk assessment process that identifies and prioritizes material cybersecurity risks, defines and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A dedicated information security team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation, and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: Additionally, we regularly provide employees with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to our network, result in the theft of user credentials, and place sensitive data at risk. We regularly test employees to determine their susceptibility to phishing emails and require those more susceptible employees to take additional training.


text: We protect our network and information assets with industry-tested security products and processes. Our information security team actively monitors our networks and systems to detect suspicious or malicious activity. We also conduct vulnerability scans to determine areas that need improvement. Our cybersecurity team maintains their current knowledge through training, obtaining professional certifications, and participating in industry groups. Our information security team expands and tests their knowledge of cyber threats through on-the-job training and periodic simulated exercises to practice responses to potential real-life threats. We also engage expert cyber consultants, as necessary and appropriate.


text: We engage in regular assessments of our infrastructure, software systems, and network architecture, using both our internal information security team as well as third-party consultants to ensure that cybersecurity risks are appropriately identified and that controls are appropriately designed to mitigate such risks. We also maintain a third-party risk management program designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls, and monitoring vendor compliance with our cybersecurity requirements.


text: While cybersecurity risks have the potential to materially affect our business, financial condition, and results of operations, we do not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations, or financial condition. For further discussion of risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Report.


text: Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program. The information security team consists of information security professionals with varying degrees of education and experience. In particular, our IT Director and ISO are both qualified professionals with appropriate education, experience, and professional certifications. Each has more than 20 years of experience in the fields of IT and data security and hold relevant professional certifications that ensure expertise in preventing, detecting, and managing cyber risk.


text: Our board of directors has approved management committees, including the OTC, to provide operational risk oversight for information security risks. The IT Director is the chair of the OTC, and the ISO is a member of the OTC. The OTC generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, and mitigation and prevention efforts employed to manage security risks. It also ensures that our internal control infrastructure is appropriate and commensurate with the growth of, or changes to, our information systems and processes. More frequent meetings may occur as needed to facilitate timely communication and monitoring efforts.


text: In the event of a cybersecurity incident, the IT Director and ISO would become aware of the incident or potential incident through their own detection, detection by us, detection by a third-party consultant, or, in the case of a cybersecurity incident occurring on a system administered by a third party, through notification from that third party. Upon becoming aware of a cybersecurity incident or a potential cybersecurity incident, the IT Director and the ISO, in collaboration with the information security team, other employees, and external consultants as needed, would work to mitigate any impact of the incident or potential incident. The IT Director and the ISO would also inform the OTC of an incident or potential incident.


text: Our board of directors has ultimate authority and responsibility for overseeing our ERM program, including risks related to cybersecurity. Our board oversees our ERM program through the Bank's board, which meets monthly with the exception of August and November. The Bank's board reviews all minutes of the OTC and also receives a report at each meeting regarding cybersecurity risk levels and performance regarding various information security metrics.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use industry standard frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We use an overall risk management process by coordinating with other departments such as human resources, legal, finance, accounting, and business operations.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: As part of our cybersecurity risk management program, we regularly perform a comprehensive risk assessment to help identify material cybersecurity risks, including vulnerability analysis, industry-specific risks, and required regulatory adherence. We also use external third-party service providers, where appropriate, to assess, test or otherwise assist us with aspects of our cybersecurity program. We manage material risk from cybersecurity threats by implementing a three-year strategic plan addressing the design, implementation, monitoring, and maintenance of preventative technologies and controls related to cybersecurity. This plan is reviewed and tailored annually for any relevant changes in business operations or new initiatives. In addition, our cybersecurity risk management program includes (1) a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, our response to cybersecurity incidents, and the performance of our managed security service provider; (2) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (3) a third-party risk management process for service providers, suppliers and vendors. State privacy laws are continually evaluated and applied as required. In addition, the Nevada Gaming Control Board issues information technology internal control standards, which we use to evaluate our internal and external audit procedures on an annual basis.


text: We also maintain cybersecurity awareness and training programs through our learning management platform as well as through our internal policies and certifications, which are subject to review and oversight by our management and our Board of Directors. All newly hired team members are required to take training courses with particular focus on the acceptable use of technology and related cybersecurity risks. E-mail phishing training and testing is performed routinely throughout the year.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board of Directors oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives semi-annual reports from our General Counsel and Chief Technology Officer on our cybersecurity risks and the implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program, including presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team has formed a dedicated group, including our General Counsel, Chief Technology Officer, and key information technology team members from our information technology security, compliance, vendor management office and our project management office, that is responsible for assessing and managing our material risks from cybersecurity threats. This group meets on a monthly basis to discuss the results of our cybersecurity and privacy matters and to evaluate new technologies from a security, operational, and regulatory perspective prior to their implementation. Their findings are summarized in a comprehensive report that is reviewed by our Audit Committee. Our Chief Technology Officer has over 30 years of experience in cybersecurity related to infrastructure (on-premise and cloud based), security (managed both internally and by third-party providers), and development (agile and waterfall methodologies). Our Chief Technology Officer is supported by a team of information security and compliance professionals and third-party partners.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy Maintaining and improving our cybersecurity capabilities is a high priority for our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We also maintain cybersecurity awareness and training programs through our learning management platform as well as through our internal policies and certifications, which are subject to review and oversight by our management and our Board of Directors. All newly hired team members are required to take training courses with a particular focus on the acceptable use of technology and related cybersecurity risks. E-mail phishing training and testing are performed routinely throughout the year.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Our management team has formed a dedicated group, including our General Counsel, Chief Technology Officer, and key information technology team members from our information technology security, compliance, vendor management office and our project management office, which is responsible for assessing and managing our material risks from cybersecurity threats. This group meets on a quarterly basis to discuss the results of our cybersecurity and privacy matters and to evaluate new technologies from a security, operational, and regulatory perspective prior to their implementation. Their findings are summarized in a comprehensive report that is reviewed by our Audit Committee. Our Chief Technology Officer has over 30 years of experience in cybersecurity related to infrastructure (on-premise and cloud based), security (managed both internally and by third-party providers), and development (agile and waterfall methodologies). Our Chief Technology Officer is supported by a team of information security and compliance professionals and third-party partners.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. In addition, subsequent to our fiscal year end, on January 6, 2025, we became a member of the Retail & Hospitality — Information Sharing and Analysis Center, a non-profit organization that will allow us to further strengthen our cybersecurity risk management by gaining gaming industry specific knowledge and intelligence.


text: Our cybersecurity risk management program is part of our enterprise-wide risk management practices. Based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the program utilizes policies, processes, and technologies to assess, identify, and manage the cybersecurity threats that we face. Specifically, we use these policies, processes and technologies to identify internal and external threats, establish access control, data privacy and security measures, detect unauthorized activity, and respond to and recover from, incidents. For example, we leverage external experts and our internal threat and risk teams to assess potential threats, retain external consultants to conduct penetration tests and health checks on our information systems, conduct cyber security and awareness training to help team members identify and manage common categories of cybersecurity threats, utilize multiple protective and detective tools to identify active threats and have a 24/7 Security Operations Center to manage incident response.


text: Our cybersecurity risk management program also includes processes and controls to assess the cybersecurity risk associated with third-party vendors and partners. Following an initial assessment of the level of enterprise risk potentially posed by use of the third-party, the vendor is then subject to further risk-based assessments, the level of which depends upon the assigned risk value of the service being provided, which may include the completion of security questionnaires and the provision of independent security certifications.


text: On a bi-annual schedule, we use an external firm to assess our cybersecurity risk management program using the Capability Maturity Model Integration (CMMI) process and behavioral model. In addition, elements of the program are subject to Service Organization Control Type 2 (SOC 2) and ISO 27001 audits by a third party.


text: While we have not identified any cybersecurity threats that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition, our cybersecurity risk management program cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected material cybersecurity incident or will not experience a material cybersecurity incident in the future. For more information about these risks, please see "Risk Factors - A failure in or breach of our operational or security systems, networks or infrastructure, or those of third parties with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business."


text: Role of our Board of Directors Our Board of Directors has primary responsibility for the oversight of our enterprise-wide risk management and exercises its oversight function in respect of cybersecurity risk through two of its committees. Specifically, our Board Audit and Compliance Committee has oversight responsibility for the Company's enterprise risk management process, including the Company's programs to identify, manage, respond to and mitigate the Company's IT risks, including risks related to cybersecurity, artificial intelligence, privacy, critical infrastructure assets and disaster recovery, as well as identifying the potential likelihood, frequency and severity of cyberattacks and breaches. Our Board Quality Committee has oversight responsibility for overall data and technology strategy. Each committee reports to the full Board on a regular basis.


text: The oversight responsibility of our Board of Directors and its committees is facilitated through quarterly management-reporting processes designed to provide visibility to the Board and its committees on the processes for the identification, assessment, prioritization and management of critical risks and management's risk mitigation strategies. Such reporting includes providing regular updates to the Board Audit and Compliance Committee regarding the evolving cybersecurity threat environment, updates to our cybersecurity risk management program to address and mitigate such threats and providing quarterly reports to the Quality Committee on the Company's execution of its data and technology strategy. Management also escalates significant cybersecurity events to the Audit and Compliance Committee and the Board on a real time basis, as appropriate. Further, our Board also receives enterprise-wide risk management reports, which include significant cybersecurity risks, from our risk department multiple times per year. In addition, our Board and management have conducted tabletop cybersecurity crisis simulation exercises.


text: Role of Management While our Board of Directors has overall responsibility for the oversight of our enterprise-wide risk management, of which cybersecurity risk management is one component, our management team is responsible for day-to-day risk management, including the implementation of our cybersecurity risk management program.


text: Our enterprise risk management committee, which operates within our risk department and comprises certain of our senior leaders including operations, finance, information technology, government relations, legal, marketing, health plan leadership, health operations, and communications meets at least four times per year to discuss significant risks to the Company identified by our enterprise-wide risk management process, including cybersecurity risks identified by our cybersecurity risk management program. The enterprise risk management committee also discusses the steps management has taken to identify, monitor, assess, and control or avoid such exposures and reviews performance measures against the Company's risk appetite and tolerance and provides recommendations of corrective action where appropriate.


text: At an operational level, our Chief Security and Privacy Officer (CSPO) and our Chief Information Security Officer (CISO) lead the management of our cybersecurity risk management program.


text: Our CSPO is responsible for overseeing the day-to-day operation of our cybersecurity risk management program, including reporting systemic cybersecurity risk matters to our senior management and, as appropriate, to the Board of Directors. Our CISO oversees our cybersecurity operations, including all identity and access management functions, cybersecurity incident response operations and the effective operation of the suite of security tools we employ. The CISO and CSPO track key cybersecurity metrics across the enterprise, including metrics related to threat and vulnerability management, cybersecurity incidents and asset management and protection. Our CISO reports the status and efficacy of our cybersecurity operations to our senior management and, as appropriate, to the Board of Directors.


text: Using our cybersecurity incident response plan, each incident receives a severity rating using a scale approved by Management. Based on that rating, we employ an escalation matrix that provides appropriate notifications to Management, as well as to our Board of Directors.


text: The cybersecurity incident response plan is integrated into our overall crisis management plan and process, for which our CSPO has ultimate day-to-day responsibility. Our CSPO and CISO share joint responsibility for providing regular cybersecurity updates to our Audit and Compliance Committee, including updates on our key technology initiatives, including those involving cybersecurity, and their status.


text: Our CSPO, CISO and other dedicated cybersecurity risk management personnel are certified and experienced information systems security professionals and information security managers. Our CSPO has over 30 years of experience in information security having 15 years of experience leading information security programs and obtained the Certified Information Systems Security Professional certification ISC2. Our CISO, who has over 33 years of experience in cyber operations, communications, crisis management and command and control, holds multiple graduate degrees, obtained the Certified Information Systems Security Professional certification from ISC2 and holds the Qualified Technical Expert certification from the Digital Director's Network.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management and privacy programs play a central role in the protection of the confidential information of our members, team members, and business partners, and, as such, are critical to the successful operation of our business.


text: Our cybersecurity risk management program is part of our enterprise-wide risk management practices. Based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the program utilizes policies, processes, and technologies to assess, identify, and manage the cybersecurity threats that we face. Specifically, we use these policies, processes and technologies to identify internal and external threats, establish access control, data privacy and security measures, detect unauthorized activity, and respond to and recover from incidents. For example, we leverage external experts and our internal threat and risk teams to assess potential threats, retain external consultants to conduct penetration tests and health checks on our information systems, conduct cyber security and awareness training to help team members identify and manage common categories of cybersecurity threats, utilize multiple protective and detective tools to identify active threats and have a 24/7 Security Operations Center to manage incident response.


text: While we have not identified any cybersecurity threats that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition, our cybersecurity risk management program cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected material cybersecurity incident or will not experience a material cybersecurity incident in the future. For more information about these risks, please see "Risk Factors - A failure in or breach of our operational or security systems, networks or infrastructure, or those of third-party vendors with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business."


text: Using our cybersecurity incident response plan, each incident receives a severity rating using a scale approved by management. Based on that rating, we employ an escalation matrix that provides appropriate notifications to management, as well as to our Board of Directors.


text: Our CSPO, CISO and other dedicated cybersecurity risk management personnel are certified and experienced information systems security professionals and information security managers. Our CSPO has over 30 years of experience in information security having 16 years of experience leading information security programs and obtained the Certified Information Systems Security Professional certification from ISC2. Our CISO, who has over 34 years of experience in cyber operations, communications, crisis management and command and control, holds multiple graduate degrees, obtained the Certified Information Systems Security Professional certification from ISC2 and holds the Qualified Technical Expert certification from the Digital Director's Network.


text: on our small size (two employees and two consultants), we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. We have recently implemented overall risk procedures which incorporate certain uniform processes. To date, we have not engaged any consultants, auditors or other third parties in connection with our risk management system or processes.


text: connection with our use of third party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. To date, we have not been materially impacted by risks from cybersecurity threats or incidents and we are not aware of cybersecurity threats or incidents that are reasonably likely to materially affect our business. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business.


text: IT Staff Authorization for Software Installations and Updates: To maintain the integrity of our IT environment, only authorized IT staff are permitted to install or update software on the company's computers. This control prevents the introduction of unauthorized or potentially malicious software.


text: The Company, with the assistance of a third party, has policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We engage third party personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to add internal personnel and further investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can found be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. There can be no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: EMPIRE PETROLEUM CORP

ticker: EP