text: The Company maintains a formal and comprehensive enterprise-wide Information Security and Cybersecurity Program (the "Information Security Program") that protects the confidentiality, integrity, and availability of the Company's information assets and to manage reasonably foreseeable cybersecurity risks and threats. The Information Security Program includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, compliance to banking regulations, annual audits, and reviews of vendors who handle sensitive information.


text: As a regulated financial institution, the Company must adhere to the security requirements and expectations of the applicable regulatory agencies, which include requirements related to cybersecurity, data privacy, vendor security risk management, systems availability, and business continuity planning, among others. The regulatory agencies have established responsibility guidelines for the Board of Directors and senior management, which include establishing policy, appointing and training personnel, implementing review and testing functions, and ensuring an appropriate frequency of reporting. The Company is examined annually, and its Information Security Program, policies and standards are designed to meet regulatory requirements and industry standards to implement physical, administrative, and technical controls to comply with the Gramm-Leach-Bliley Act ("GLBA"), Sarbanes-Oxley Act ("SOX") of 2002, and industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC").

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Legal Officer, Chief Technology Officer, and Information Security Manager more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.

stage1Category: Board Governance

stage1Method: majority


text: Risk Management and Strategy The Company has complex information systems used for a variety of functions by customers, employees, and vendors. In addition, third parties with which the Company does business or that facilitate business activities (e.g., vendors, exchanges, clearing houses, central depositories and financial intermediaries) could also be sources of cybersecurity risk to the Company, including breakdowns or failures of their systems, misconduct by the employees of such parties, or cyberattacks which could affect their ability to deliver a product or service to the Company.

stage1Category: Third-Party Risk


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Our systems are regularly targeted by attacks aimed at disrupting services, misusing or accessing customer data without authorization, seeking financial extortion, or executing fraudulent activities. To date, no such incidents have significantly impacted the Company's operations or adversely affected our customers, nor have they materially influenced our operational results. Nevertheless, it is important to acknowledge that we cannot guarantee the prevention or detection of sophisticated cyber-attacks. In the event of significant service disruptions, unauthorized access leading to the misuse of customer information, or fraudulent activities affecting our or third-party systems, the Company may face operational, regulatory, legal, and reputational challenges, which could adversely affect our business and financial conditions.

stage1Category: Strategy Integration


text: The Company's Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company's Information Security Program through ongoing initiatives. The Company's Information Security Program focuses on the following key areas to mitigate cyber risks: i. Risk Assessment – At least annually, a risk assessment is conducted that incorporates security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.


text: ii. Technical Safeguards – Multi-layered controls, defenses, and continuous monitoring tools are used to protect, detect, and respond to cyber threats and incidents. External independent assessments, regular threat intelligence review, and lessons learned from incident response drive continuous tool and process improvements.


text: iii. Incident Response and Recovery - The Company's formal Incident Response and Business Continuity Programs establish a clear, consistent, standard, and organized process by which cybersecurity incidents will be promptly responded to by the Company's incident response teams.


text: iv. Third-Party Risk Management – The Company's formal vendor management program includes security risk assessments requiring the vendor to meet or exceed appropriate security requirements prior to the hosting or sharing of sensitive information by third parties. The Company's standard contract provisions obligate third-party compliance with industry standard security protections.


text: v. Education and Awareness - The Company conducts cybersecurity training, both formally through mandatory courses and informally through written communications and other updates. Employees are tested periodically with phishing tests to reinforce training. The Company has held webinars and also sends periodic emails to its customers with tips and suggestions to protect themselves against cybersecurity incidents.


text: External Assessments The Company's Information Technology and Information Security Departments are examined annually by our financial institution regulator, which includes reviewing our risk management activities to ensure we are properly and adequately managing our risks appropriate to the size and complexity of our business and operations. In addition to annual examinations, the Company's Information Security Program, policies and practices, and cyber posture is subject to regular external independent reviews including annual audits, annual penetration tests, and quarterly third-party cyber risk assessments.


text: Cybersecurity remains a top financial services industry risk due to increases in the quantity and sophistication of cyberattacks, which include ransomware, malware, credential theft, supply chain, and other prevalent attack methods resulting in unauthorized access to systems or sensitive data.

stage1Category: None/Other


text: The Company maintains a formal and comprehensive enterprise-wide Information Security and Cybersecurity Program (the "Information Security Program") that protects the confidentiality, integrity, and availability of the Company's information assets and to manage reasonably foreseeable cybersecurity risks and threats. The Information Security Program, which is in compliance with banking regulations, includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, annual audits, and reviews of vendors who handle sensitive information.


text: The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, and Information Security Director more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.


text: The Company's Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company's Information Security Program through ongoing initiatives. The Company implements a formal Information Security Program aligning to industry best practices and focuses on the following key areas to mitigate cyber risks: i. Risk Assessment – At least annually, a risk assessment is conducted that incorporates other security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.


text: External Assessments The Company's Information Technology and Information Security Departments are examined annually by our financial institution regulator, which includes reviewing our cyber risk management activities to ensure we are properly and adequately managing our risks appropriate to the size and complexity of our business and operations. In addition to annual examinations, the Company's Information Security Program, policies and practices, and cyber posture are subject to regular external independent reviews including annual audits, annual penetration tests, and quarterly third-party cyber risk assessments to ensure cybersecurity controls are adequately designed and are operating effectively.


text: Cybersecurity Governance Our Audit Committee has primary oversight of the Company's information security programs, including cybersecurity. Our internal audit department, together with third parties that we engage, report to our Audit Committee and audit the Company's information security programs. Our Chief Digital Officer, who oversees our information security training and awareness program, also updates the Audit Committee on a quarterly basis regarding information security matters. Our Audit Committee and Chief Digital Officer also provide the full Board of Directors with updates no less than annually, relating to information security and cybersecurity risks. These updates include a review of the appropriateness of our various procedures related to the security of our network and data, as well as the evaluation of new and existing technologies and their effectiveness in meeting our business objectives.

companyName: Six Flags Entertainment Corp/OLD


text: We appreciate the importance of cybersecurity in maintaining the trust and confidence of our guests, employees, and business partners, and we are committed to upholding the highest standards of network and data security throughout our operations to protect our various stakeholders. Our cybersecurity risk management program is integrated into our overall enterprise-level risk management system and shares common communications channels and response processes that apply to other legal, compliance and operational risk areas addressed by our enterprise-level risk management program. Our technology infrastructure and information systems are central to our sales of admissions products, such as single day tickets, season passes, and Six+ memberships, as well as in-park offerings of food, beverages and merchandise. We also use our technology platforms to interact with suppliers and make payments. Our technology infrastructure and information systems also forms the foundation for our accounting and finance systems and our disclosure and accounting control environment. Our internally developed technology systems, as well as those we license from third-parties, could each face breaches from cybersecurity threats. These threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, theft of intellectual property or other security breaches. Such attacks have become increasingly sophisticated, and we expect that will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.


text: To protect against cybersecurity threats to our business, our Board of Directors and management team take a comprehensive approach to cybersecurity risk management as part of our overall enterprise-level risk management program. Our Board and our management actively oversee the management of cybersecurity risks and have established processes for identifying, assessing and managing material risks from cybersecurity threats.


text: We design and assess our cybersecurity risk management program in accordance with National Institute of Standards (NIST) standards and guidelines to protect all proprietary and guest data. Key components of our cybersecurity risk management program include the following:


text: Mandatory Cyber Training – All Six Flags team members complete a mandatory Cybersecurity Training during the onboarding process on how to identify, assess, and manage risks from cybersecurity threats. Mandatory ongoing cybersecurity training is also conducted throughout the year for all team members.


text: Response Readiness and Incident Response Plan – we have developed a comprehensive Incident Response Plan which documents and describes our Cybersecurity Response Readiness and includes detailed procedures to help guide our team members in the event of a Cybersecurity Incident. This includes incident response report templates, which are readily available to document and report to management on incident response activities. The response plan details processes, responsibilities, escalations and other communication channels for reporting, evaluating and responding to cybersecurity incidents. Reporting paths range from addressing an incident within our IT team to escalating incidents to our Audit Committee and to our board of directors, as appropriate.


text: Internal and External Penetration Testing – we conduct regular Internal and External Penetration Testing to identify and assess network security vulnerabilities. Six Flags IT evaluates and remediates vulnerabilities based upon business impact and exploitability.


text: Vulnerability Scanning and Automated Cyber Risk Management and Compliance – we conduct monthly proactive vulnerability scanning to detect and address security weaknesses within IT systems. We have partnered with a third-party solution to identify and provide visibility and insight into existing risks. The solution collects data from our vulnerability scanning process to identify and analyze risks, prioritize remediation based upon business goals, and provide robust reporting and visual dashboards.


text: Disaster Recovery Plan – our Disaster Recovery Plan is documented to provide guidance and outline processes used to recover or continue operations of critical IT infrastructure, and systems in the event of natural or human disasters.


text: Third-Party Security Risk Management – we use a Vendor Risk Management Questionnaire to document third-party vendors' security controls and governance policies. The questionnaire allows us to systematically assess risk which may be introduced by third-party vendors and ensures alignment with our security and compliance standards.


text: As of the date of this Annual Report on Form 10-K, the Company has not experienced any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company. However, we face ongoing risks of cybersecurity threats that, if realized, could result in the loss of sensitive business or customer information, disruption to our systems and operations, expose us to litigation and reputational risk and adversely affect our guests, employees or business partners. For additional information on the risks we face from cybersecurity threats, see Item 1A. Risk Factors – "Cyber-attacks could have a disruptive effect on our business."


text: We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Finally, management and other departments involved in our cybersecurity program participate in industry groups related to cybersecurity risk management and our IT Security Team employs third party services to gain independent perspectives of our cybersecurity program. For example, our IT Security Team belongs to various Cybersecurity Threat Advisory Committees to keep up to date on the latest threats and vulnerabilities. Technical details regarding risks and exposures associated to vulnerabilities are shared via subscription emails by these committees. In addition, we conduct annual Third-Party Posture Assessments to review the security processes and procedures that we have in place. The assessment is an unbiased review which provides credibility and trust in regards to Six Flags security posture. We also ensure our Payment Card Industry (PCI) compliance by working extensively with an external independent advisor to review and audit our systems, security measures and processes to protect cardholder data. We maintain cybersecurity insurance that we believe is appropriate for the size and complexity of our business which provides protection against the potential losses arising from a cybersecurity incident. However, there is no guarantee that our insurance coverage limits will sufficiently protect us against any future claims.


text: The Company has developed an information security program to address material risks from cybersecurity threats, which is integrated within our overall enterprise risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. Under the information security program, the Company performs one or more cyber risk assessments each year based on recognized industry best practices and standards and cyber threat intelligence. The risk assessments, together with risk-based analysis and judgment, are used to determine security controls to address identified risks. The Company considers the following factors, among others, during its risk and control implementation assessments: the likelihood and severity of the risk; the impact on the Company, the Company's customers, associates and stockholders, and others if a risk materializes; the feasibility and cost of controls; and the impact of controls on operations and others.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: The Company's information security program currently includes the following controls, which are deployed as the Company deems applicable: • endpoint threat detection and response; • identity and access management; • privileged access management; • logging and monitoring involving the use of security information and event management; • multi-factor authentication; • firewalls and intrusion detection and prevention; • web application firewalls and bot security tools; and • vulnerability and patch management.


text: All of the Company's office-based associates and certain distribution and fulfillment center associates undergo mandatory security awareness training at the time of hiring and on an annual basis thereafter. The Company's store-based associates receive ad hoc awareness communications and are provided with cybersecurity awareness materials as part of the store operating manual.


text: The Company uses third-party security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. Third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations and performance monitoring.


text: As part of the Company's overall enterprise risk management program, the Company has developed business continuity and disaster recovery plans, which include measures to respond to potential disruptions to our information technology systems (or information technology systems of third parties on which we rely). The Company also maintains a written information security incident response plan and conducts tabletop exercises to enhance incident response preparedness. The Company is also a member of an industry cybersecurity intelligence and risk sharing organization.


text: The Company (or third parties on which it relies) may not be able to fully, continuously and effectively implement security controls as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security controls to implement, and it is possible that the Company may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties it relies upon).


text: The Company, like many retailers, relies upon third-party service providers, such as payment processors and network providers, that have faced risks from threat actors and cybercriminal groups that seek to steal payment card data, consumer data, and other sensitive information; disrupt critical information technology systems; and/or demand ransom payments. Although the Company has implemented controls to address these risks, if these risks were to materialize, such as in the event of a cybersecurity incident causing the networks of a third-party payment processor to not be operational, the impact to the Company could be material.


text: PNC's inherent information security risks, the maturity and completeness of the control environment, and measurements against our risk appetite are presented quarterly to the Technology Committee by the firm's Chief Technology Risk Officer. Overall risks across the Enterprise Risk Framework are then reported quarterly to the Risk Committee by the Chief Risk Officer.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we continue to face risks from cybersecurity threats that, if realized, may have such material effect. Despite our ongoing efforts, we cannot provide complete assurance that our cybersecurity risk management processes will be effective in detecting, preventing, or mitigating such cybersecurity risks. See also "We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers', ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability" and "Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity risks that could have a material impact on the Company, which sections should be read in conjunction with this Item 1C.


text: The Company's Chief Information Security Officer ("CISO") is the member of the Company's management team with primary responsibility for the development, operation and maintenance of the Company's information security program. The CISO holds a master of science degree in information assurance and has approximately 24 years of cybersecurity experience with Fortune 500 financial, defense, consulting and retail companies. The Company's Audit Committee oversees the Company's information security program at the Board level. The Audit Committee, which is composed entirely of independent members of the Board, receives reports directly from the CISO at least twice per year regarding the Company's cybersecurity program, including reports regarding items such as cybersecurity policies and practices, cybersecurity program resources, third-party assessments of the Company's information security program, key risks related to the Company's information security program and the Company's mitigating controls. As described above, the Company maintains an information security incident response plan that includes processes and procedures for evaluating and escalating cybersecurity incidents to, as determined to be appropriate, the Company's executive management team and members of the Board. The initial impact level of each cybersecurity event is evaluated by a designated team of information security specialists using risk criteria that have been defined and approved by the Company's executive management team and reviewed with the Company's Audit Committee. If escalated, the incident is evaluated by a cross-functional core and extended team, as applicable, of Company managers that includes the Company's CISO and the Company's designated internal legal counsel, as well as identified associates from across the Company's business and functions, as applicable. Cybersecurity incidents are assigned incident impact levels based on the core team's determination of potential impact to the Company. The core team employs defined risk criteria to classify incidents and escalate incidents accordingly. Based on the severity classification assigned by the core team, incidents may be escalated to representatives of the Company's executive management team (which includes the Company's Disclosure Committee), the Chairs of the Board and the Audit Committee, other members of the Audit Committee and/or the full Board. The incident response plan, which also incorporates processes to engage identified third-party cybersecurity consultants, advisors and response services, provides for continuous re-evaluation of identified cybersecurity incidents by the appropriate levels of management to ensure that the Company is able to satisfy its disclosure obligations under relevant rules and regulations.

stage1Category: Management Role


text: The Company has an Enterprise Risk Management function that oversees the identification prioritization and mitigation of the Company's enterprise risks, and cybersecurity is a risk category addressed by that function. The Company also has a Cybersecurity and Privacy Risk Council, which is composed of representatives of the Company's senior management and operates to deliver management-level oversight of cybersecurity matters. The Company uses governance, risk and compliance tools to assess, identify and manage its cybersecurity risks.


text: The Company has developed an information security program to address material risks from cybersecurity threats and incidents, which is integrated within its overall enterprise risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. Under the information security program, the Company performs one or more cyber risk assessments each year based on recognized industry best practices and standards and cyber threat intelligence. The risk assessments, together with risk-based analysis and judgment, are used to determine security measures and controls to address identified risks. The Company considers the following factors, among others, during its risk and control implementation assessments: the likelihood and severity of the risk; the impact on the Company, the Company's customers, associates and stockholders, and others if a risk materializes; the feasibility and cost of security measures and controls; and the impact of security measures and controls on operations and others.


text: The Company's information security program currently includes the following security measures and controls, which are deployed as the Company deems applicable: • endpoint threat detection and response; • identity and access management; • privileged access management; • logging and monitoring involving the use of security information and event management; • multi-factor authentication; • firewalls and intrusion detection and prevention; • web application firewalls and bot security tools; and • vulnerability and patch management.


text: The Company uses third-party security firms in different capacities to provide or operate certain security measures and controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company also uses a variety of processes designed to address cybersecurity threats and incidents related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations and performance monitoring.


text: Communication to the Board occurs more frequently than quarterly, when dictated by incident and event management policies and procedures based on the criticality and urgency of the communication.


text: As part of the Company's overall enterprise risk management program, the Company has developed business continuity and disaster recovery plans, which include measures designed to respond to potential disruptions to its information technology systems (or information technology systems of third parties on which it relies). The Company also maintains a written information security incident response plan and conducts tabletop exercises to enhance incident response preparedness. The Company is also a member of an industry cybersecurity intelligence and risk sharing organization.


text: The Company (or third parties on which it relies) may not be able to fully, continuously and effectively implement security measures and controls as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security measures and controls to implement, and it is possible that the Company may not implement appropriate security measures and controls if management does not recognize, or underestimates, a particular risk. In addition, security measures and controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Cybersecurity threats and incidents, even when detected or foreseeable, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).


text: The Company, like many retailers, relies upon third-party service providers, such as payment processors, network providers and application providers, that have faced risks from threat actors and cybercriminal groups that seek to steal payment card data, consumer data, and other sensitive information; disrupt critical information technology systems; and/or demand ransom payments. Although the Company has implemented security measures and controls designed to address these risks, if these risks were to materialize, such as in the event of a cybersecurity incident causing the networks of a third-party payment processor to not be operational, the impact to the Company could be material.


text: The Company has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, the Company continues to face risks from cybersecurity threats and incidents that, if realized, may have such material effect. Despite its ongoing efforts, the Company cannot provide complete assurance that its information security program will be effective in detecting, preventing, or mitigating such cybersecurity risks. See also "We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers', ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability" and "Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity risks that could have a material impact on the Company, which sections should be read in conjunction with this Item 1C.


text: The Company's Chief Information Security Officer ("CISO") is the member of the management team with primary responsibility for the development, operation and maintenance of the Company's information security program. The CISO holds a master of science degree in information assurance and has over 20 years of cybersecurity experience with Fortune 500 financial, defense, consulting and retail companies. The Audit Committee oversees the Company's information security program at the Board level. The Audit Committee, which is composed entirely of independent members of the Board, receives reports directly from the CISO at least three times per year regarding the Company's information security program, including reports regarding items such as cybersecurity policies and practices, cybersecurity program resources, third-party assessments of the Company's information security program, key risks related to the Company's information security program and the Company's security measures and controls. As described above, the Company maintains an information security incident response plan that includes processes and procedures for evaluating and escalating cybersecurity threats and incidents to, as determined to be appropriate, the Company's executive management team and members of the Board. The initial impact level of each cybersecurity threat or incident is evaluated by a designated team of information security specialists using risk criteria that have been defined and approved by the Company's executive management team and reviewed with the Audit Committee. If escalated, the threat or incident is evaluated by a cross-functional core and extended team, as applicable, of managers that includes the CISO and designated internal legal counsel with extensive cybersecurity experience, as well as identified associates from across the Company's business and functions, as applicable. Cybersecurity threats and incidents are assigned incident impact levels based on the core team's determination of potential impact to the Company. The core team employs defined risk criteria to classify incidents and escalate incidents accordingly. Based on the severity classification assigned by the core team, incidents may be escalated to, as applicable, representatives of the Company's executive management team (which includes the Disclosure Committee), the Chairs of the Board and the Audit Committee, other members of the Audit Committee and/or the full Board.


text: The Company has an Enterprise Risk Management function that oversees the identification, prioritization and mitigation of the Company's enterprise risks, and cybersecurity is a risk category addressed by that function. The Company uses governance, risk and compliance tools designed to assess, identify and manage its cybersecurity risks.


text: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the NIST. The NIST CSF is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: Identify


text: We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors. Any cyber act is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or its value.


text: We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or realize its value, or a threat actor's ability to gain access to an asset or its value. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation.


text: We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value. We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.


text: We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.


text: Integration into our Risk Management Framework Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework, which includes technology as one of the five primary risk categories addressed by the ERM framework, with cybersecurity risks being one of the three subcategories within the technology risk category. As a result, our ERM leadership team works with the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our ERM framework and mapped to the NIST CSF. Our internal ERM leadership also meets on a quarterly basis with our technology risk working group, comprised of leaders across the information technology, information security and law departments, to monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.


text: Third-Party Engagement We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Finance and Risk Management Committee (F&RM Committee) of the Board. These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.


text: Oversight of Third-Party Providers Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws, and implementation of administrative, physical and technical safeguards to protect our data, including how our data is stored, accessed and transmitted. In addition, all providers within these service categories must sign our data security attachment that articulates the specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.


text: Please see Item 1A. Risk Factors – Operational Risks – "A significant cybersecurity incident or other disruption to our technology infrastructure could disrupt our business operations" for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.


text: As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.


text: Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).


text: While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.


text: Our Director of Operations is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the board of directors. Nuwellis leverages 3rd party IT service provider and specifically their cybersecurity team's expertise.

companyName: Nuwellis, Inc.

ticker: NUWE


text: The Norfolk Southern Board, through the F&RM Committee, has direct oversight of cybersecurity risks. The F&RM Committee receives periodic reports from the CIO and CISO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.


text: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CISO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.


text: Management's Role The CISO, reporting to the CIO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our CISO has significant relevant experience in the area, including graduate and postgraduate engineering technology degrees, along with 20 years of information security experience in critical infrastructure, as well as seven years with Norfolk Southern where he guided the Company through the implementation of our multi-layered defensive cybersecurity strategy that aligns with the NIST CSF. As noted above, our technology risk working group, comprised of leaders across the information technology, information security and law departments, including our CIO, CISO and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.


text: Management and Board Reporting Cybersecurity incidents are reported directly to the CISO in accordance with the applicable incident response plan. The CISO, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Executive Vice President Corporate Affairs and Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.


text: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by our CISO and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.


text: In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use and mobile security, and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.


text: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: Identify


text: We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors. Any cyber act is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or its value.


text: We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or realize its value, or a threat actor's ability to gain access to an asset or its value. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation.


text: We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value. We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.


text: All employees are required to complete cybersecurity training as part of on-boarding process and on-going training both online and in-person. IT department assigns position specific security level encryption to manage information security.


text: Integration into our Risk Management Framework Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework. Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk. Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Senior Director of Information Security (SDIS) and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF. Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks. Any changes to the threat landscape are discussed and considered as adjustments to our risk profile.


text: Third-Party Engagement We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Finance and Risk Management Committee (F&RM Committee) of the Board. These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.


text: Oversight of Third-Party Providers Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted. In addition, all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.


text: Please see Item 1A. Risk Factors – Technology Risks – "A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations" for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.


text: As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.


text: Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).


text: While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.


text: The Norfolk Southern Board, both directly itself and indirectly through the F&RM Committee, has oversight of cybersecurity risks. The F&RM Committee receives periodic reports from the CIDO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.


text: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CIDO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in training, including phishing exercises, monthly safety meetings, and an annual cybersecurity awareness update. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.

companyName: IPALCO ENTERPRISES, INC.


text: Management's Role Our SDIS, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Such individual has significant relevant experience in the area, including over 27 years of technology experience in various industries with 17 years focused on information security, as well as significant experience working closely with government agencies including the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security. As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, SDIS, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.


text: Management and Board Reporting Cybersecurity incidents are reported directly to the SDIS in accordance with the applicable incident response plan. The SDIS, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.


text: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the SDIS and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.


text: In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use, and mobile security and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.


text: Risk Management and Strategy The Company takes a risk-based, proactive approach to its management of cybersecurity threats inherent in our business. Our existing cybersecurity policy includes ongoing monitoring and detection programs, network security precautions, encryption of certain critical data, in depth security assessment of vendors and incident response guidelines. We continue to invest and improve in the protection of systems, sensitive data, technology, and processes using third-party and in-house tools and resources. We remain vigilant in staying ahead of new and emerging risks utilizing our in-house tools, and security teams review and make strategic investments in our systems to keep the Company, our guests and our team members' data secure. The Company's Vice President of Information Technology and Security is responsible for developing and implementing these controls and processes.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: We subscribe to multiple feeds and associations that discuss and monitor risks of any technology compromise at our business partners where relevant. Relevant restaurant level personnel and employees at the restaurant support center receive periodic training to bring awareness on how they can help prevent and report potential cybersecurity incidents. We also provide credit card handling training following Payment Card Industry guidelines to team members that handle guest payment information. In addition, key stakeholders involved with our cybersecurity risk management programs receive additional training and regularly participate in scenario-based training exercises to support the effective implementation of our programs. We maintain a disaster recovery plan and protect against business interruption by backing up our major systems. We routinely scan our environment for any vulnerabilities and perform penetration testing. In addition to our internal processes and controls, we engage multiple third parties to assess the effectiveness of our data security practices, including through an annual risk assessment. We conduct annual cybersecurity audits using a reputable third-party security auditor. A third-party conducts regular network security reviews, scans and audits. We require third-party vendors and service providers to complete a security questionnaire or provide a security compliance report performed by a reputable third-party to assess their risk.


text: We maintain a Risk Register documenting identified risks, including those from cybersecurity threats, their potential impact, and mitigation strategies. Through our internal audit function, we also perform an annual risk analysis using a risk matrix to prioritize risks based on their potential impact and likelihood.


text: There can be no guarantee that our policies and procedures will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A - Risk Factors for additional discussion of our cybersecurity risks. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, including the 2018 malware incident, have not materially affected our results of operations or financial condition, including our business strategy, for the periods covered by this Annual Report on Form 10-K, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management processes and managed by a cross-functional team, comprised of IT leadership, Internal Audit and Legal. Our IT leadership team is comprised of our Chief Information Officer and Vice President of Information Technology and Security, each with over two decades of experience in information technology and cybersecurity. Our processes are designed to create a comprehensive, cross-functional approach to identify and mitigate cybersecurity risks as well as to prevent cybersecurity incidents in an effort to support business continuity and achieve operational resiliency. The Audit Committee of the Board of Directors has overall oversight responsibility for data security practices and controls to monitor and mitigate the Company's technology risk exposure.


text: IT leadership, along with Internal Audit and our Legal teams, receive reports on present cybersecurity threats from a number of experienced information security specialists or other relevant parties responsible for various parts of the business on an ongoing basis. Management, including the Vice President of Information Technology and Security and Chief Information Officer, reports quarterly, or more frequently if needed, to the Board of Directors, including the Audit Committee, on the effectiveness of our cybersecurity and data protection practices. The Audit Committee reviews the findings of the Company's annual risk assessment and penetration test. Further, our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.


text: The Company's incident response team is comprised of leaders from our information security team, risk, legal and audit departments. We have established and regularly test incident response processes and controls that identify and risk-rank incidents through a centralized system to promote timely escalation of cybersecurity incidents that exceed a particular level of risk. Incidents of sufficient magnitude or severity are escalated to the appropriate Company officers.


text: We subscribe to multiple feeds and associations that discuss and monitor risks of any technology compromise at our business partners where relevant. Relevant restaurant level personnel and employees at the restaurant support center receive periodic training to bring awareness on how they can help prevent and report potential cybersecurity incidents. We also provide credit card handling training following Payment Card Industry guidelines to team members that handle guest payment information. In addition, key stakeholders involved with our cybersecurity risk management programs receive additional training and regularly participate in scenario-based training exercises to support the effective implementation of our programs. We maintain a disaster recovery plan and protect against business interruption by backing up our major systems. We routinely scan our environment for any vulnerabilities and perform penetration testing. In addition to our internal processes and controls, we engage multiple third-parties to assess the effectiveness of our data security practices, including through an annual risk assessment. We conduct annual cybersecurity audits using a reputable third-party security auditor. A third-party conducts regular network security reviews, scans and audits. We require third-party vendors and service providers to complete a security questionnaire or provide a security compliance report performed by a reputable third-party to assess their risk.


text: There can be no guarantee that our policies and procedures will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. We describe the risks from cybersecurity threats in Item 1A - Risk Factors, "Information and Technology Related Risks". We believe that risks from prior cybersecurity threats have not materially affected our results of operations or financial condition, including our business strategy, for the periods covered by this Annual Report on Form 10-K.


text: Risk Management & Strategy We are focused on addressing the growing threat of cybersecurity risks that we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and is focused on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information. We have an established cyber incident response plan to respond to cyber incidents.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: We continue to improve our cybersecurity program and processes by investing in preventative measures. We engage consultants and third-party service providers in connection with our cybersecurity risk testing and assessment. These third-party service providers assist us in evaluating our cybersecurity program, provide support for threat monitoring and detection, and scan for vulnerabilities and other cybersecurity events which may pose a significant risk to the Company. We also engage in cybersecurity training, with the employees of certain of our operating companies undergoing compulsory training that enables them to detect and report malware, ransomware and other malicious software or social engineering attempts that may compromise the Company's information technology systems, and those employees are routinely assessed on this training. Employees are also generally required to complete compulsory training covering the handling of sensitive data. As the cyber landscape evolves, both in our technology systems and in the broader context of the internet and expanding connectivity, management continually updates its cybersecurity approach as part of its effort to safeguard the Company's sensitive information and assets.


text: We have not experienced any cybersecurity incidents in the last two years, including as a result of the Cyber Incident, that have materially affected the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see "Cyber-attacks or other information security incidents could have a material adverse effect on our business strategy, results of operations or financial condition and subject us to additional legal costs." in Item 1A. Risk Factors.


text: Corporate Governance Our Board of Directors has overall responsibility for risk oversight and has delegated the oversight of risks associated with cybersecurity to the Audit Committee. The Audit Committee reports to the Board on our cybersecurity risk management practices and performance, generally on a quarterly basis. The Audit Committee receives reports from senior members of management, including from each of our Chief Information Officers ("CIOs") (which include the CIO of each of our principal operating companies: Lawson, TestEquity and Gexpro Services), and the internal audit department regarding the cybersecurity risk management program. Among other things, these reports have focused on the following: • recent cyber risk and cybersecurity developments; • cyber risk governance and oversight; • assessments by third-party experts; • key cyber risk metrics and activities; and • major projects and initiatives.


text: We have also established a governance structure under each of the CIOs that oversee investments in systems, resources, and processes as part of the continued maturity of our cybersecurity posture. Our CIOs have collectively over seventy years of service in various roles in the cybersecurity and information technology areas, including over forty years in their current roles or within the industry.


text: We have not experienced any cybersecurity incidents in the last three years, including as a result of the Cyber Incident, that have materially affected the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see "Cyber-attacks or other information security incidents could have a material adverse effect on our business strategy, results of operations or financial condition and subject us to additional legal costs." in Item 1A. Risk Factors.


text: Risk Management Strategy Given the increasing reliance on technology and potential of cyber threats, we have integrated a cybersecurity component into our risk management program, which is designed to identify, assess and mitigate risks across various aspects of the Company. We have a dedicated Information Security Department, which is led by our Chief Information Security Officer. The Information Security Department serves to protect the security and confidentiality of customer information, protect against any threats or hazards to the security or integrity of Company information and protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to our customers.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Our information security program strives to protect the confidentiality, integrity and availability of information and information systems and is aligned to the Company's business and risk management strategies. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk. Key elements of our cybersecurity risk management program include: • IT risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • Information Security Department responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to a cybersecurity incident; • Cybersecurity Assessment Toolkit (developed by the FFIEC) is assessed annually, tracks program maturity, changes in risk profile, and reviews security controls critical to reduce cybersecurity risk. Results are presented to and approved by the Board; • Ransomware Assessment Toolkit (developed by the Bankers Electronic Crimes Task Force, state bank regulators and the U.S. Secret Service) is assessed biannually to capture any gaps and address any potential control deficiencies; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to a cybersecurity incident; and • a third-party risk management process for service providers, suppliers, and vendors, including those external service providers we engage in our cybersecurity risk management processes.


text: Risks from cybersecurity threats are assessed with existing controls and residual risk is monitored. We have not experienced any material cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. We cannot provide full assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Part I - Item 1A. Risk Factors – Risks Related to Our Business" in this report for a discussion of risks related to cybersecurity.


text: We also have a trained response team lead by the CISO, consisting of key individuals from executive management, finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate. Additionally, we engage a third party that offers cybersecurity solutions, monitoring and incident response services for additional support.


text: Management's Role Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has 18 years of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate. The CISO provides an annual report of the information security program and monthly reports to the Audit Committee, including any security incident or notable security event for the period. The CISO also reports to the Company's Risk Committee on risk assessments annually and key risk indicators at least quarterly.


text: We also have a trained response team lead by the CISO, consisting of key individuals from our finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate.


text: Board Oversight of Cybersecurity The Company's Audit and Risk Committees oversee cybersecurity risk and the information security program which includes overseeing management's actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives an annual report of the information security program and monthly reports from the CISO on notable security events for the period. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives annual reports from the CISO on risk assessments and reports on key risk indicators at least quarterly. The Company's Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.


text: Both the Bank's internal Risk Committee and the Company's Risk Committee review all risk assessments and remediations annually. The information security program includes policies and standards that define the risk assessment procedures, reporting and an incident response plan. The incident response plan defines escalations to senior management and the Board, as well as required notifications and timeframes to customers and regulatory authorities.


text: Our information security program strives to protect the confidentiality, integrity and availability of information and information systems and is aligned to the Company's business and risk management strategies. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk. The information security program includes policies and standards that define the risk assessment procedures, reporting and an incident response plan. Key elements of our cybersecurity risk management program include: • IT risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • Information Security Department responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to a cybersecurity incident; • Cybersecurity Assessment Toolkit (developed by the FFIEC) is assessed annually, tracks program maturity, changes in risk profile, and reviews security controls critical to reduce cybersecurity risk. Results are presented to and approved by the Board. We are currently in the process of transitioning to the Cybersecurity Framework developed by the National Institute of Standards and Technology as the FFEIC Cybersecurity Assessment Toolkit will sunset on August 31, 2025; • Ransomware Assessment Toolkit (developed by the Bankers Electronic Crimes Task Force, state bank regulators and the U.S. Secret Service) is assessed biannually to capture any gaps and address any potential control deficiencies; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to a cybersecurity incident; and defines escalations to senior management and the Board, as well as required notifications and timeframes to customers and regulatory authorities, • a third-party risk management process for service providers, suppliers, and vendors, including those external service providers we engage in our cybersecurity risk management processes.


text: Management's Role Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate.


text: Board Oversight of Cybersecurity The Audit and Risk Committees of the Board oversee cybersecurity risk and the information security program which includes overseeing management's actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives, from the CISO, an annual report of the information security program and monthly reports of any security incident or on notable security events for the period. The Board Chairman and Vice Chairman are notified of any high criticality security incidents within 24 hours. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives, from the CISO, annual reports on risk assessments and at least quarterly reports on key risk indicators. The Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.


text: Both the Bank's management level Risk Committee and the Risk Committee of the Board review all risk assessments and remediations annually.


text: The Board established the Cyber Security Committee of the Board in December 2022 to augment the Board's oversight with cybersecurity focus and expertise and to complement the risk framework activities of the Enterprise Risk Management and Credit Policy Committee. The Cyber Security Committee considers risks associated with Horizon's overall cyber security and information technology programs; information technology audits; the security risk insurance that Horizon maintains for information technology, cyber security and privacy risks; Horizon's information security training programs; and compliance with all rules and regulations and risk control policies and procedures relating to information technology and cyber security. Pursuant to the Cyber Security Committee Charter, the Cyber Security Committee is required to meet at least three times per year and report to the Board annually. The Cyber Security Committee met three times in 2023. In addition, the Cyber Security Committee Charter provides that a majority of the Cyber Security Committee's voting members must qualify as independent directors under SEC rules and NASDAQ listing standards. During 2023, 80% of the Cyber Security Committee's members qualified as independent.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Horizon's senior management briefs the Cyber Security Committee at each Cyber Security Committee meeting (see below for detailed discussion). In 2023, Horizon's information technology/cyber security program was audited by Horizon's internal and external auditors. The Cyber Security Committee Charter is posted on Horizon's website at www.horizonbank.com in the section headed "About Us – Investor Relations – Corporate Information" under the caption "Corporate Governance."


text: Through Horizon's enterprise risk management framework and reporting functions, the Board, its Committees and Management assess and manage cybersecurity risks created by cybersecurity threats. Horizon's Vice President, Information Security and Audit Information Security officer ("Information Security Officer") provides an annual Information Security Program report to the Board and as needed when cybersecurity risk is elevated. Horizon's Senior Vice President, Senior Technology Officer is a member of the Cyber Security Committee and reports on cyber security risks at each meeting a minimum of three times a year. The Senior Vice President, Senior Technology Officer reports to the Executive Vice President, Senior Operations Officer, who also is a member of the Cyber Security Committee. For independence, the Information Security Officer reports to Horizon's Senior Vice President, HORIZON BANCORP, INC.


text: Senior Auditor and Compliance Officer. Horizon's risk escalation framework requires progressive escalation of cyber security risks to Management and its Committees, then to Board Committees and, ultimately, to the Board.


text: Management's Operations Committee meets monthly and provides oversight and governance of the technology and cyber security programs. The Senior Vice President, Senior Technology Officer and Information Security Officer are members of this committee and report monthly on the technology and cyber security programs. The Senior Vice President, Senior Technology Officer also is a member of Management's Enterprise Risk & Disclosure Committee, which meets a minimum of four times a year, to report on the technology and cyber security programs.


text: Horizon engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third–party specialists. It also maintains a third–party risk management program designed to identify, assess, and manage risk, including cybersecurity risks, associated with external service providers and our supply chain.


text: The Executive Vice President, Senior Operations Officer has 34 years of experience in operations and technology with an educational background in Business Administration. In the role of Senior Bank Operations Officer and Executive for the past 23 years, she oversees and works closely with Horizon's technology and security teams to develop and implement robust security measures to protect the Bank's systems, networks, and customer data. The Senior Bank Operations Officer stays current on the latest industry trends and emerging cyber threats through publications, webinars, seminars and banking association training around cyber security. She also collaborates with external agencies, such as law enforcement and regulatory bodies, to address cyber threats and ensure compliance with industry best practices.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: The Senior Vice President, Senior Technology Officer has 27 years of experience in information technology, with the last 12 as the information technology leader for the Bank. He holds a Bachelor's Degree in Computer Science. He is an active member of FS–ISAC's Mergers an Acquisition Working Group, and a named author of their 2023 "Cybersecurity Best Practices in Mergers, Acquisitions and Divestiture Deals" publication. He also serves as an advisory member of the Indiana Governor's Executive Council on Cybersecurity. He attends numerous industry training sessions including those put on by the SANS Institute, PaloAlto, Cisco, Microsoft, the Cybersecurity and Infrastructure Security Agency (CISA), and FS–ISAC.


text: The Vice President, Information Security and Audit Information Security Officer has 27 years as an IT Professional, with the last 8 as the cybersecurity leader for Horizon Bank with an education background in Technology. He has achieved numerous certifications throughout his career including the Microsoft Certified Systems Engineer (MCSE) and Certified Novell Engineering (CNE 5/6), and has demonstrated a continued commitment to excellence and has attained certification as a Certified Information Systems Security Professional (CISSP) issued by ISC2 in 2022. Through continuous learning and professional development, the Information Security Officer has honed his expertise in cybersecurity frameworks, threat detection, incident response, and risk management. He also serves as a member of the Indiana Bankers Association (IBA) Cyber Security Committee and attends numerous industry training sessions including those put on by Microsoft, FS–ISAC, SANS Institute.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber–attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. See Item 1A. Risk Factors for further discussion of risks related to cyber security in Horizon's 2023 Annual Report on Form 10–K filed with the Securities and Exchange Commission. HORIZON BANCORP, INC.


text: The Board established the Cyber Security Committee of the Board in December 2022 to augment the Board's oversight with cybersecurity focus and expertise and to complement the risk framework activities of the Enterprise Risk Management and Credit Policy Committee. The Cyber Security Committee considers risks associated with Horizon's overall cyber security and information technology programs; information technology audits; the security risk insurance that Horizon maintains for information technology, cyber security and privacy risks; Horizon's information security training programs; and compliance with all rules and regulations and risk control policies and procedures relating to information technology and cyber security. Pursuant to the Cyber Security Committee Charter, the Cyber Security Committee is required to meet at least three times per year and report to the Board annually. The Cyber Security Committee met three times in 2024. In addition, the Cyber Security Committee Charter provides that a majority of the Cyber Security Committee's voting members must qualify as independent directors under SEC rules and NASDAQ listing standards. During 2024, 3 of the Cyber Security Committee's members qualified as independent.


text: Horizon's senior management briefs the Cyber Security Committee at each Cyber Security Committee meeting (see below for detailed discussion). In 2024, Horizon's information technology/cyber security program was audited by RSM and internal audit. The Cyber Security Committee Charter is posted on Horizon's website at www.horizonbank.com in the section headed "About Us – Investor Relations – Corporate Information" under the caption "Corporate Governance."


text: Through Horizon's enterprise risk management framework and reporting functions, the Board, its Committees and Management assess and manage cybersecurity risks created by cybersecurity threats. Horizon's Vice President, Information Security and Audit Information Security officer ("Information Security Officer") provides an annual Information Security Program report to the Board and as needed when cybersecurity risk is elevated. Horizon's Senior Vice President, Senior Technology Officer is a member of the Cyber Security Committee and reports on cyber security risks at each meeting a minimum of three times a year. The Senior Vice President, Senior Technology Officer reports to the Executive Vice President, Senior Operations Officer, who also is a member of the Cyber Security Committee. For independence, the Information Security Officer reports to Horizon's Senior Vice President, Senior Auditor and Compliance Officer. Horizon's risk escalation framework requires progressive escalation of cyber security risks to Management and its Committees, then to Board Committees and, ultimately, to the Board.


text: Management's Operations Committee meets quarterly and provides oversight and governance of the technology and cyber security programs. The Senior Vice President, Senior Technology Officer and Information Security Officer are members of this committee and report monthly on the technology and cyber security programs. The Senior Vice President, Senior Technology Officer also is a member of Management's Enterprise Risk & Disclosure Committee, which meets a minimum of four times a year, to report on the technology and cyber security programs.


text: The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.

companyName: LAKE SHORE BANCORP, INC.


text: The Executive Vice President, Senior Operations Officer has 35 years of experience in operations and technology with an educational background in Business Administration. In the role of Senior Bank Operations Officer and Executive for the past 24 years, she oversees and works closely with Horizon's technology and security teams to develop and implement robust security measures to protect the Bank's systems, networks, and customer data. The Senior Bank Operations Officer stays current on the latest industry trends and emerging cyber threats through publications, webinars, seminars and banking association training around cyber security. She also collaborates with external agencies, such as law enforcement and regulatory bodies, to address cyber threats and ensure compliance with industry best practices.


text: The Senior Vice President, Senior Technology Officer has 28 years of experience in information technology, with the last 13 as the information technology leader for the Bank. He holds a Bachelor's Degree in Computer Science. He is an active member of FS–ISAC's Mergers an Acquisition Working Group, and a named author of their 2023 "Cybersecurity Best Practices in Mergers, Acquisitions and Divestiture Deals" publication. He also serves as an advisory member of the Indiana Governor's Executive Council on Cybersecurity. He attends numerous industry training sessions including those put on by the SANS Institute, PaloAlto, Cisco, Microsoft, the Cybersecurity and Infrastructure Security Agency (CISA), and FS–ISAC.


text: The Vice President, Information Security and Audit Information Security Officer has 28 years as an IT Professional, with the last 9 as the cybersecurity leader for Horizon Bank with an education background in Technology. He has achieved numerous certifications throughout his career including the Microsoft Certified Systems Engineer (MCSE) and Certified Novell Engineering (CNE 5/6) and has demonstrated a continued commitment to excellence and has attained certification as a Certified Information Systems Security Professional (CISSP) issued by ISC2 in 2022. Through continuous learning and professional development, the Information Security Officer has honed his expertise in cybersecurity frameworks, threat detection, incident response, and risk management. He also serves as a member of the Indiana Bankers Association (IBA) Cyber Security Committee and attends numerous industry training sessions including those put on by Microsoft, FS–ISAC, SANS Institute. HORIZON BANCORP, INC.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber–attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. See Item 1A. Risk Factors for further discussion of risks related to cyber security. HORIZON BANCORP, INC.


text: Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. As part of the operation of our business, the Company, and our service providers, use, store, and process data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially and adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, FDIC and the DFR. To address these risks and regulatory requirements, the Company established a robust cybersecurity risk management program. This program safeguards sensitive customer data, financial transactions, and our information systems, serving as a vital component of our broader enterprise risk management strategy.

companyName: UNION BANKSHARES INC

ticker: UNB


text: Risk Management Oversight and Governance The Company's Board of Directors is charged with overseeing and approving Union's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Union's Information Security Officer (ISO) provides periodic updates regarding cybersecurity risks and the cybersecurity program to the Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Company's Board of Directors on a regular basis. Consistent with this responsibility the Board has delegated primary oversight responsibility over the risk management framework and oversight of the cybersecurity program, including oversight of cybersecurity risk and cybersecurity risk management to Union's IT Steering Committee.


text: Union's IT Steering Committee has representation from the following departments: information technology, information security, other department leaders and stakeholders, and Union's senior management team. This Committee receives regular updates on the state of Union's cybersecurity program, including any incidents, as well as approving information technology or information security related projects and proposals. These team members are also responsible for the resolution of any findings and implementation of recommendations from internal and external audits and examinations.


text: Union's ISO is responsible for implementing and maintaining the cybersecurity program with support from Union's Information Security team. The Information Security team consists of Union's ISO, members of the risk and compliance department, security staff, and information technology members, all of whom collaboratively work together to manage cybersecurity risks. The ISO reports directly to Union's Senior Risk Officer.


text: To date, such cybersecurity risks have not materially affected us. We do, from time to time, experience threats to our data and systems that have been halted by the policies and systems in place. For more information about the cybersecurity risks we face, see "Risk Factors - Operational Risks" in Part I, Item 1A of this Annual Report.


text: Cybersecurity Risk Management Program The program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner.