text: Murphy's cybersecurity environment is led by the Company's Information Technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is responsible for monitoring and managing security of the corporate network and enterprise systems, including developing and deploying policies, technical controls, and safety protocols and responding to security threats. All members of the MCT hold globally recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active threats and incidents as they occur. The Chief Information Officer is a member of the IMT, and regularly provides briefings to the Chief Executive Officer, the executive leadership team, and the Audit Committee of the Board. The Audit Committee is ultimately responsible for ensuring that management has processes in place to identify and evaluate cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.


text: Murphy considers its protection from cybersecurity threats to be a core component of its overall enterprise risk management system. Murphy's cybersecurity risk management framework consists of cyber readiness, cybersecurity governance, and risk management strategy. The cybersecurity risk management framework is incorporated into the overall enterprise risk management process through policies, procedures, periodic simulations, and constant monitoring of the cybersecurity environment for new and emerging threats. The Company also requires employees to receive regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third party advisors, industry groups and policymakers.

companyName: MURPHY OIL CORP

ticker: MUR

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics.


text: Murphy utilizes industry leading technologies that focus on continuous monitoring and analytics built on machine learning and artificial intelligence to safeguard against sophisticated cyberattacks. Deployed technologies include next generation firewalls, advanced endpoint and email protection, multi-factor authentication and Managed Detection and Response. In addition to the monitoring and detection processes for its own IT systems, Murphy also has processes in place to identify cybersecurity threats associated with third party service providers and partners; these processes include industry information sharing groups, cybersecurity notification services, vendor risk assessments, and ongoing collaboration with federal agencies.


text: Murphy's cybersecurity environment and risk strategy is broadly managed by the Company's Information Technology (IT) group, which oversees the Company's IT and Operational Technology (OT) infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is specifically responsible for monitoring and managing security of the enterprise IT and OT network and systems, including developing and deploying administrative policies, technical controls, and safety protocols necessary to prevent unauthorized access, theft, damage, or loss of Company data or systems. All members of the MCT hold globally-recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active security threats and incidents as they occur. The Chief Information Officer oversees the IT group and is a member of the IMT, and provides briefings to the CEO, the executive leadership team, and the Audit Committee of the Board regarding cybersecurity risks, strategy, and management at least annually. The Audit Committee is ultimately responsible for overseeing cybersecurity strategy and ensuring that management has sufficient resources, programs, and processes in place to identify, evaluate, manage, and mitigate relevant cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board as appropriate. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.

stage1Category: Management Role

stage1Method: majority


text: Murphy considers its cybersecurity risk management framework to be a core component of its overall enterprise risk management system. The cybersecurity risk management framework directly aligns with the National Institute of Standards and Technology Cybersecurity Framework and involves regular review and update of security policies and procedures; leverage of industry-leading technologies focused on continuously monitoring, analyzing, and defending against intrusions; regular testing of such technologies and other controls; periodic simulations of security incidents; and constant monitoring of the broader cybersecurity environment for new and emerging threats. The Company also requires employees to attend regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third-party advisors, industry groups and policymakers.


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics. In addition to monitoring its own IT systems, Murphy also has processes in place to identify cybersecurity risks and threats associated with third party service providers and partners. These processes include conducting vendor due diligence and risk assessments, participating in industry information sharing groups, subscribing to cybersecurity notification services, and maintaining ongoing collaboration with federal agencies.


text: To our knowledge, Murphy has not experienced any cybersecurity incidents that have had, or are likely to have, material impacts to our business, operations, finances, or reputation.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management & Strategy Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Arrow has implemented and regularly reviews and updates its internal controls and procedures as well as corporate governance policies and procedures intended to protect its business operations, including the security and privacy of the confidential information of its customers. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its back-up systems. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.


text: Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.


text: Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.


text: Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.


text: In July 2023, the SEC adopted amendments intended to enhance and standardize disclosures related to cybersecurity. The amendments were effective in December 2023 and require timely disclosure of material cybersecurity incidents and annual disclosures related to cybersecurity risk management, strategy, and governance. Under the new rules, a material cybersecurity incident is required to be disclosed on a Form 8-K within four business days after the learning of a material incident. The SEC has defined a cybersecurity incident to mean "an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein." Arrow has undertaken and implemented a number of procedures and control steps to comply with these expanded cybersecurity reporting requirements as outlined below.

stage1Category: None/Other


text: Cybersecurity Risk Management & Strategy Arrow has implemented processes designed to oversee and identify risk from cybersecurity breaches. Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems.


text: Arrow also regularly reviews and updates its existing internal controls and procedures and corporate governance policies and procedures intended to protect its business operations, which includes the security and privacy of the confidential information of its customers. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and the Enterprise Risk Management ("ERM") committee at the senior management level all have a role in the cybersecurity risk management program. The Board receives periodic reports from the ERM committee, which is chaired by the Director of Compliance and Risk and includes executive, senior, and other designated managers as appropriate.

stage1Category: Board Governance


text: The Company's information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees', customers' and end users' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: Apyx Medical Corp

ticker: APYX


text: The outsourced Chief Information Security Officer ("CISO") works closely with the Chief Financial Officer to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: The S&T Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect the bank's assets. We encrypt and leverage data loss prevention technology for sensitive data and use advanced transport layer security encryption for our applications. S&T employees are required to undergo annual information security awareness training, which includes information regarding evolving threats such as phishing, malware and social engineering testing.

companyName: S&T BANCORP INC

ticker: STBA


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Apyx Medical has established a separate committee comprised of the CISO, Chief Financial Officer, Outside Counsel, Chief Executive Officer, and Department Heads, if necessary. This committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and CFO present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: a. Protecting data through the use of automated and manual processes; b. Periodically assessing and updating the program to address an evolving threat environment;


text: c. Maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and d. Ensuring business continuity and disaster recovery.


text: We based and tailored our framework on the National Institute of Standards and Technology, or NIST, Cybersecurity Framework and the Center for Internet Security, or CIS, Critical Security Controls.


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: a. Identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident;


text: b. Assessing the likelihood and potential impact of those threats; and c. Assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third-party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.

stage1Category: Third-Party Risk


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the Chief Security Officer, or CSO, continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset) and regulators in a timely manner based on the criticality of the cybersecurity incident. S&T also has in place incident response and business continuity plans. The Incident Response Program outlines the policies, procedures and technical measures for identifying an incident, assessing its nature and scope, minimizing and containing the impact, investigating the root cause and reporting, as applicable. S&T uses data from incidents to reassess risk, evaluate and implement any additional controls deemed necessary and measure the success of the incident response team. The Incident Response Program also includes staff training, annual updates and testing. The Business Continuity Plan defines the policies, procedures and technical measures to restore systems and critical operations. S&T also maintains business continuity plans for critical systems and applications managed or hosted by third-party vendors.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, Chief Information and Technology Officer and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.


text: Management's Role At the management level, the ERM Committee, CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 17 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Chief Information and Technology Officer has nine years of information technology and cybersecurity experience. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 10 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: • protecting data through the use of automated and manual processes; • periodically assessing and updating the program to address an evolving threat environment; • maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and • ensuring business continuity and disaster recovery.


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: • identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident; • assessing the likelihood and potential impact of those threats; and • assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2024, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.


text: Management's Role At the management level, the ERM Committee, CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.


text: Risks from cybersecurity threats, including as a result of the Previously Disclosed Cyber Incident, have materially affected us, including our results of operations and financial condition. We continue to face risks from this and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Risk Factors – Technology Risks."

companyName: KEY TRONIC CORP

ticker: KTCC


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 18 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 11 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.


text: Risk Management and Strategy We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.


text: Our Board of Directors is responsible for the oversight of risk management for the Company, including the review and assessment of the Company's enterprise risk management approach and processes. Our Board of Directors has delegated certain responsibility for the oversight of risks from cybersecurity threats to the Audit Committee. At each regularly scheduled quarterly meeting, and more frequently as necessary, management provides updates to the Audit Committee and our Board of Directors regarding the risks from cybersecurity threats. These updates include information regarding cybersecurity strategies, management structure, mitigation activities and an analysis of any actual or potential cybersecurity incidents.


text: Our management team, including our Chief Executive Officer and Executive Vice President of Quality and Information Systems, is responsible for assessing and managing our material risks from cybersecurity threats. In particular, our EVP of Quality and Information Systems, who reports directly to our Chief Executive Officer, oversees the implementation of controls designed to prevent, detect, mitigate and recover from cybersecurity threats and cybersecurity incidents. Our current EVP of Quality and Information Systems has a Bachelor of Science degree in Mechanical Engineering and over 14 years of experience building and executing information system strategies. The other members of our management team do not have specialized information systems or cybersecurity backgrounds but have general experience managing financial, legal and operational risks. Our EVP of Quality and Information Systems, along with his team, routinely monitors the Company's information systems for cybersecurity threats and will be notified upon the occurrence of a potential cybersecurity incident.


text: Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, management will inform the Audit Committee and/or our Board of Directors and, if the incident is deemed material, will disclose the incident pursuant to SEC rules and regulations.


text: Risk Management and Strategy We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise- wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") program. As part of our ERM program, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk management" section of this Form 10-K for additional information on our approach to risk management, including our governance framework. Refer to "Item 1A - Risk Factors" of this Form 10-K for additional information on our cybersecurity risks.


text: Cybersecurity risk management process Our Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to our network, infrastructure, computing environment, and to third parties. We periodically assess the design of our cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and we seek to implement improvements to our controls in response to that assessment. Our Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect our clients', associates', and firm data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, and providing appropriate public disclosure of cybersecurity risks and incidents when required. In addition, we maintain a global training program for our associates about cybersecurity risks and requirements and conduct regular phishing email simulations in order to test our associates' understanding of these risks.


text: Our cybersecurity strategy takes a defense-in-depth approach, with layered controls consisting of both commercially available and proprietary technologies that are intended to prevent an adversary from conducting a successful attack. Included in that approach is our Cyber Threat Center which is a critical component of our Cybersecurity Program and operates internally with the purpose of monitoring, detecting, and responding to cyber threats that could jeopardize the integrity, confidentiality, or availability of information systems. Our Cyber Threat Center operates 24 hours per day, 7 days per week, continuously monitoring our systems for signs of tampering or unauthorized activity, utilizes an incident response playbook which is based on NIST industry best practices, and includes containment and recovery procedures. Furthermore, we maintain cybersecurity insurance coverage which provides certain limited protection.


text: The Company's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: In conjunction with third-party vendors and consultants, we perform a variety of periodic risk assessment initiatives to gauge the performance of the Cybersecurity Program, to estimate our risk profile, and to assess compliance with relevant regulatory requirements. We perform periodic assessments of control efficacy through our internal risk and control self-assessment process, a variety of cyber event simulation exercises focused on the effectiveness of our incident response and crisis management procedures, and external technical assessments, including external penetration tests and "red team" engagements where third parties test our defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls.


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a supplier risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our supplier risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.


text: We also maintain business continuity plans that include identification of critical functions, third-party suppliers, and personnel. Our information technology department executes several disaster recovery exercises per year in order to test our capabilities and ensure that business recovery needs could be met during a real-world event. Additionally, our information technology department participates in annual crisis management exercises to test our operational responses and assess our preparedness for various scenarios, including cyber incidents. We also participate annually in industry-wide and internal exercises to test our response capabilities.


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party vendors, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.


text: The Board of Directors has designated its Risk Committee to assist it in overseeing management's responsibility to implement an effective risk management framework designed to identify, assess, and manage key risks, including cybersecurity risk. As part of our ERM program, executive management, with review and oversight of the Risk Committee, establishes key risk indicators to measure ongoing alignment with the firm's risk appetite and tolerance levels related to cybersecurity risk. Risk appetite and tolerance thresholds are periodically reviewed by management and approved by the Risk Committee. The Risk Committee receives regular presentations and reports from our Chief Information Security Officer ("CISO"), which address a wide range of cybersecurity risk topics, including emerging threats and recent developments, cybersecurity policy and standards updates, vulnerability assessments, risk assessment outcomes (including third-party and independent reviews), technology trends, and information security considerations arising with respect to the firm, our peers, and third-party vendors. Additionally, the Board of Directors receives reports at least annually on the performance of the firm's cybersecurity risk metrics.


text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's cybersecurity program is led by our CISO, who, effective October 1, 2024, reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.


text: Risk management and strategy We have established processes to identify, assess, and manage material cybersecurity risk, which are fully integrated into our overall enterprise risk management system and processes. These processes include risks related to our use of third-party service providers.

companyName: Santander Holdings USA, Inc.


text: The members of management who lead our Cybersecurity Program have extensive experience in technology, cybersecurity, and information security. Our CIO has over 35 years of relevant experience, including 25 years leading technology teams at multiple global financial services institutions, and is a Certified Information Security Manager and Registered Series 99 Operations Professional. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management, and is a Certified Information Systems Security Professional and Registered Series 99 Operations Professional. Both our CIO and CISO also participate in various financial services industry committees and cybersecurity advisory boards.


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") framework. As part of our ERM framework, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, firm data, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a third-party risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our third-party risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor our principal third parties and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third parties, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.


text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's Cybersecurity Program is led by our CISO, who reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.


text: Cybersecurity Risk Management and Strategy Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: The Company's planned investments in cybersecurity include implementing advanced data loss prevention measures, encryption protocols, and continuous monitoring to safeguard sensitive information and mitigate the risk of unauthorized access or disclosure. As part of the Company's risk management strategy, it has secured comprehensive cyber insurance coverage. The Company regularly reviews and updates its cyber insurance coverage to align with the evolving nature of c yber threats and industry standards.


text: In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.


text: The Company's planned investments in cybersecurity include implementing advanced data loss prevention measures, encryption protocols, and continuous monitoring to safeguard sensitive information and mitigate the risk of unauthorized access or disclosure. As part of the Company's risk management strategy, it has secured comprehensive cyber insurance coverage. The Company regularly reviews and updates its cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks Governance


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior management, including our CISO, periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.


text: Our CISO has 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders to include Risk, Legal, Finance, IT, Operations, and Business line leads.


text: Cybersecurity Risk Management and Strategy Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management. T he company's enterprise information security program adheres to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and other relevant industry frameworks as necessary.


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.


text: As of April 1, 2024, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior manage ment periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.


text: Our CISO has more than 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders including Risk, Legal, Finance, IT, Operations, and Business line leads.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and threat actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See section "Risks Relation to our Operations".

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • an internal information security team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party information security and cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • ongoing cybersecurity training and phishing testing for our employees.


text: This information security program is a key part of our overall risk management system. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our Vice President – Information Security Officer. Our current Information Security Officer has over 15 years of experience, including prior work in the healthcare field, and is a Certified Information Systems Security Professional and CompTIA Security+ certified.


text: In addition, our board of directors, as a whole and through the Bank's Corporate Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives reports, at least quarterly, from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.


text: Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security related items and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, and through the use of technological tools and software and results from third party assessments.


text: Our Chief Security Officer and Chief Information Officer provide quarterly briefings to the Security Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Security Committee provides regular updates to the Board of Directors on such reports. In addition, our Chief Security Officer and our Chief Information Officer provide annual briefings to the Board of Directors on cybersecurity risks and activities.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks, such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement, or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: Risk Management and Strategy The Company's information security program encompasses the security policies and procedures in place throughout the enterprise network to address compliance, transaction, reputation, and strategic risks. Our Information Security Officer is primarily responsible for this managing the information security program that includes identifying, assessing, and mitigating cyber threats. Our Information Security Officer reports directly to the Chief Information Officer.

companyName: CITY HOLDING CO

ticker: CHCO


text: We evaluate cybersecurity incidents individually and in the aggregate to assess materiality. Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please see Item 1A. Risk Factors, "Risks Related to Our Business, Operations, and Industry—Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security-related items, and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, the use of technological tools and software, and results from third-party assessments.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: CINTAS CORP

ticker: CTAS


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over fifteen years of IT and cybersecurity leadership experience and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.


text: We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at technical and executive levels and incorporate external resources and advisors, as needed. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT Security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.


text: We face a number of cybersecurity risks in connection with our business. We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Although such risks and attacks have not materially affected us, including our business strategy, consolidated results of operations or consolidated financial condition, to date, our security programs and measures may not prevent all intrusions, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the information technology systems related risk factor in Item 1A: Risk Factors - Risks Relating to Business Strategy and Operations.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0), which organizes cybersecurity into six functions: govern, identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over twenty-five years of IT and cybersecurity experience, has served over fifteen years in various cybersecurity management roles, and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CISO is a part of, and is supported by, our IT security team, which includes other security leaders, security engineers, and security analysts. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.


text: We view cybersecurity as a shared responsibility. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have implemented various processes and tools to identify cybersecurity threats, detect potential attacks, and protect our data and information technology. We periodically evaluate evolving cybersecurity risks and legal and compliance requirements, and we make ongoing strategic investments to address those evolving risks and requirements.

companyName: STARBUCKS CORP

ticker: SBUX


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills at technical and executive levels and incorporate external resources and advisors, as needed. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, the Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.


text: We regularly use both outsourced and in-house information security expertise to employ a variety of administrative, technical, and physical data safeguards designed to both deter and mitigate cybersecurity risks, including cyber incident response procedures, endpoint threat detection and response solutions, employee training, third-party risk reviews, penetration testing, technical control reviews, vulnerability assessments, and enterprise-wide risk assessments. These policies and procedures, which are based on the National Institute of Standards and Technology framework, align with international standards under ISO/IEC 27001 and are reviewed annually, including via an annual assessment of relevant IT SOX controls and Payment Card Industry Data Security Standard reviews performed both by external Qualified Security Assessors and authorized members of our internal information security team. Our third-party due diligence processes also include procedures for identifying cybersecurity threats associated with third-party service providers. Cybersecurity risks are also identified and evaluated through our enterprise risk management (ERM) processes, which are overseen by the Audit Committee of our Board of Directors. Through our ERM processes, key stakeholders across the business identify, assess, and manage risk, including material cybersecurity risks. These processes enable us to monitor and assess the evolving landscape of cybersecurity risks.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: Our information security program is administered under the supervision of our EVP, Chief Digital and Innovation Officer (CDIO) and Vice President (VP) of Platforms, Infrastructure and Cybersecurity, who share responsibility for assessing and managing the Company's cybersecurity risks. Both our CDIO and VP of Platforms, Infrastructure, and Cybersecurity have over 20 years of related experience, holding technical leadership roles at notable multinational organizations, across diverse industries.


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detention, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.


text: The Audit Committee of our Board of Directors oversees risks associated with information technology and cybersecurity. Cybersecurity risks and incidents identified through these processes are evaluated by our CDIO and VP of Platforms, Infrastructure and Cybersecurity. Our VP of Platforms, Infrastructure and Cybersecurity provides regular updates on a quarterly basis, and more frequently as required, on these matters to the Audit Committee of our Board of Directors. Such reports may include discussions on current control audits, risk assessments, proposed mitigation measures, and other key information technology and cyber initiatives.


text: Information about our material cybersecurity risks can be found in Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: As a shell company with no current business or operations, our accounting systems are included in the accounting systems of our parent company, Vector Group Ltd. (Commission File No. 1- 5759). Consequently, our management team relies on the cybersecurity processes that our parent company has established to oversee and identify material risks from cybersecurity threats. Therefore, none of the committees are responsible for the oversight of risks from cybersecurity threats. See "Item 1C. Cybersecurity" of Vector Group Ltd.'s Form 10-K for the year ended December 31, 2023 for a discussion of its comprehensive cybersecurity approach.

companyName: MULTI SOLUTIONS II, INC


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.


text: The Corporation has developed an information security program to assess, identify, and monitor cybersecurity risks. The Corporation regularly assesses cybersecurity risks arising from the operating environment and attempts to identify the likelihood and severity of the risk and the possible impact of the risk on the Corporation, its customers, and employees.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: The Corporation conducts periodic testing of software, hardware, defensive capabilities, and other information security systems utilizing both internal processes and third-party consultants. Testing procedures are supplemented by regular cyber threat exercises and employee training. Threat simulation exercises are used to develop and refine the Corporation's incident response plans and employees undergo cybersecurity awareness training on a regular basis.


text: The Corporation also addresses cyber risks posed by its relationships with third-party vendors. The Corporation assesses vendor risk as a part of its vendor management process, which requires a pre-acquisition diligence review, including the review of the vendor's information security policy for all vendors determined to be a "critical vendor". The vendor management process also requires a review of all critical vendors annually and all critical vendors are reported to the Board of Directors.


text: The Corporation's information security program is led by the Chief Technology Officer in conjunction with the Chief Risk Office and the Executive Enterprise Risk Management Committee. The Board Enterprise Risk Management Committee is responsible for oversight of the Corporation's cybersecurity and information security program and regularly reviews and evaluates information security and cybersecurity risks provided by management.