text: Governance and Oversight The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the Company's cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates, as needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: We actively educate our employees about potential cybersecurity threats and actions. Our executive officers and global workforce receive ongoing trainings in response to cyber threats and cybersecurity incidents. We mandate annual completion of our information security training and compliance program, which includes reviewing and acknowledging the Company's information security policy. All employees also participate in regular security awareness training, which includes data protection principles, general end-user security hygiene, and internal phishing simulations. Additional annual training covers information security topics related to our Code of Conduct and Records Management Policies.

companyName: J M SMUCKER Co

ticker: SJM

secItem: Item 1C


text: Cybersecurity Risk Management As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.

companyName: KEYCORP /NEW/

ticker: KEY

stage1Category: Strategy Integration

stage1Method: unanimous


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer ("CISO"), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.

stage1Category: Risk Management Process

stage1Method: majority


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group. The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.


text: As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key's Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.


text: The potential impact of cybersecurity threats on our business strategy, operations, and financial condition is discussed under specific headings in our risk factor disclosures at Item 1A and in the Management's Discussion and Analysis of Financial Condition and Results of Operations at Item 7 of this Annual Report on Form 10-K.

companyName: ARTIVION, INC.

ticker: AORT

stage1Category: None/Other


text: With respect to third party service providers, Key maintains a third party management program that is designed to identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key's third party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based due diligence can also include an assessment of the strength of certain control areas, including, but not limited to, information security management, physical security, network security, platform security, application security, cloud security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key's Third Party Management Policy and Program.

stage1Category: Third-Party Risk


text: Cybersecurity Governance As described in more detail in "Risk Management — Overview" in Item 7 of this report, the Board serves in an oversight capacity to ensure that Key's risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board's Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management's activities related to cybersecurity risk. The Board's Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board's Technology Committee provides additional oversight of management's activities related to Key's technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.

stage1Category: Board Governance


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 29 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.

stage1Category: Management Role


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2023). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance, and Security Architecture and Engineering.


text: The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an


text: The CISO reports to Key's Chief Information Officer who oversees all of Key's shared services for technology, operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry.


text: At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief Executive Officer and comprising other senior level executives, including the Chief Information Officer, reports to the Board's Risk Committee and is responsible for managing risk, including cybersecurity risk. The ERM Committee serves as a senior level forum for review and discussion of material operational risk issues, including cybersecurity risk, and receives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees the Operational Risk Committee, which provides governance, direction, oversight, and high-level management of operational risk, including cybersecurity risk, and includes senior management representation from the LOB and support areas. The CISO is a voting member of the Operational Risk Committee.


text: The Operational Risk Committee also includes subcommittees which, among other things, address security issues and concerns, pursue security-related program enhancements, address fraud trends, provide input on fraud strategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness of fraud risks across Key.


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO and senior executives from Key's LOB and major support areas. The CMT provides overall strategic direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key's risk governance committee structure.


text: As discussed above in "Cybersecurity Risk Management," the RRG shares the results of its independent internal audits of security activities at Key and the effectiveness of the IS Program with the line of business management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators. Any identified gaps are risk rated, issued a due date for remediation, and tracked through completion of remediation. Remediation is then verified by the RRG.


text: Cybersecurity Risk Management As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer (" CISO "), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group (RRG). The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.


text: As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key's Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.


text: Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis. In addition, our management team from time to time participates in cybersecurity tabletop exercises that simulate cybersecurity incidents. These exercises are intended to test our response to potential incidents and assess the procedures outlined in our incident response playbooks.


text: With respect to third party service providers, Key maintains a third party management program that is designed to identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key's third party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based due diligence can also include an assessment of the strength of certain control areas, including, but not limited to, information security management, physical security, network security, platform security, application security, cloud security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key's Third Party Management Policy and Program.


text: Cybersecurity Governance As described in more detail in "Risk Management — Overview" in Item 7 of this report, the Board serves in an oversight capacity to ensure that Key's risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board's Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management's activities related to cybersecurity risk. The Board's Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board's Technology Committee provides additional oversight of management's activities related to Key's technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 30 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2024). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance and Data Protection, and Security Architecture, Engineering and Platform Operations. The Deputy CISO has over 17 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an MBA.


text: Oversight of Third-Party Risk Trinity implements stringent processes to oversee and manage cybersecurity risks associated with its use of third-party service providers. These processes include targeted assessments of both third parties and the solutions being implemented or used in accordance with Trinity's information security policies, standards, and risk appetites. In addition, we seek contractual safeguards where appropriate regarding cybersecurity and information risk management.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal, compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds an undergraduate degree in finance, a master's degree in business administration, and a juris doctorate. He is licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the Board. The Privacy and Information Security teams work together to implement controls around how personally identifiable information is managed and protected and to comply with applicable laws and regulations.


text: Cybersecurity Incidents When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber incident response plans, which are a supplement to our corporate incident response plan. These plans provide a framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage incidents impacting banking information, including our clients' and employees' information.


text: The Company's approach to risk management is designed to identify, assess, prioritize, and manage significant risk exposures that could affect the Company's ability to execute its corporate strategy and fulfill its business objectives. The Company manages enterprise risk through its Risk Management Committee ("RMC") chaired by the Company's Vice President of Compliance, Risk and Audit with direct oversight from the Company's General Counsel. The RMC, which is made up of senior leadership across a variety of business functions, defines the Company's enterprise risk framework based upon analysis of industry and peer benchmarking as well as company-specific data analysis.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: As a component of the Company's enterprise risk management program, the Company's cybersecurity risk management program outlines the Company's cybersecurity risk management practices and capabilities, including the division of responsibilities for reviewing the Company's cybersecurity risk exposure and risk tolerance, tracking emerging information risks, and ensuring proper escalation of certain key risks for periodic review by the Board and its committees.


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes and monitors risk mitigation and treatment strategies to support business continuity.


text: The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology Cybersecurity Framework for identifying, assessing, and managing material risks from cybersecurity threats. This approach combines prevention and detection techniques, informed by internal and external sources, to identify and analyze potential threat activities. When a threat is identified, a cyber incident response plan outlines the Company's procedures for containing, remediating, and recovering from the cybersecurity incident. Cybersecurity tenets are also incorporated into the Company's technology policies.


text: The Company's cybersecurity risk management program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates, proactively scans for vulnerabilities, and engages qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. When vulnerabilities are identified, the Company's information technology ("IT") management team receives reports that assess each vulnerability and track progress in remediating that vulnerability. The IT management team also collaborates with supply chain management and the Company's third party risk management program to onboard and monitor key third-party service providers to address the potential risk of cybersecurity threats through the use of such third parties. Annual cybersecurity training is mandatory for all users with access to the Company's IT systems, and the Company conducts monthly tests to promote phishing awareness. In addition to these prevention methods, the Company seeks to detect potential threats through external intelligence and monitoring solutions. External commercial or governmental agencies are also engaged to assess potential threat activity relevant to the Company. The Company also monitors server and endpoint devices across the organization to detect signs of a cyberattack.


text: The Company has implemented and maintains an information security incident response plan ("IR Plan"), which includes processes to assess, escalate, contain, investigate, and remediate cybersecurity incidents. Upon notification of a potential cybersecurity threat, management defines the threat based on its nature as an information security event, alert, incident, or breach, and all cybersecurity incidents are categorized by level of severity based on the impact of the incident to the Company's operations. A technical incident response team is responsible for technical response activities, including information gathering and forensic analysis, containment, and remediation efforts. The Company's Crisis Management Team drives the Company's enterprise-level crisis response process, leads decisions around response strategies, coordinates resources required to execute such strategies, and oversees all cybersecurity incidents categorized as Critical and High.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board.


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 17 years of experience in information technology and security, and the CISO has 31 years of information technology experience and 11 years of information security experience.


text: As part of its broader oversight activities, the Board oversees risks from information security threats and other risks identified by the RMC, both directly and by way of delegation to the Audit Committee. As reflected in its charter, the Audit Committee oversees and specifically discusses the guidelines and policies by which the Company assesses and manages its cybersecurity risk exposures, as well as the steps management has taken to monitor and control such exposures. The Audit Committee also oversees the Company's internal control over financial reporting, including with respect to financial reporting-related information systems. In addition to any communications of specifically identified cybersecurity events, the Audit Committee receives and discusses quarterly updates on cybersecurity activities, including review of annual external assessment results, training compliance and discussion of cybersecurity risks and resolutions, and is responsible for elevating significant matters to the full Board as events arise. The Board receives an annual update and provides feedback on the Company's cybersecurity governance processes, risk management plan, and any significant activities related thereto, and also reviews risk management practices in the course of its review of the Company's corporate strategy, business plans, Board committee reports, and other presentations. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, the Company also maintains disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes, and monitors risk mitigation and treatment strategies to support business continuity.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal, and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board (the "Audit Committee").


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 18 years of experience in information technology and security, and the CISO has 32 years of information technology experience and 12 years of information security experience.


text: Internal Cybersecurity Team The TSO, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Southern Company system. The Southern Company system also relies on a Data Privacy and Protection team in the compliance organization, as well as the internal audit organization, to work with the TSO on data protection policies and practices. Multiple experienced information security leaders with internal and external security experience responsible for various parts of the business report to the CISO, each of whom is supported by a team of trained cybersecurity professionals. In addition to these internal cybersecurity capabilities, external auditors and security companies are regularly engaged to assist with assessing, testing, identifying, and managing cybersecurity, including through penetration testing, vulnerability testing, and other technical evaluations.

companyName: SOUTHERN CO GAS


text: Cybersecurity risks are included in the risk universe that the RRC evaluates, with input from information security subject matter experts at the company, to assess top risks to the enterprise. The RRC process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating cybersecurity risk into the overall RRC process in this manner assists the company in identifying, assessing, and managing material cybersecurity risks.

companyName: SYSCO CORP

ticker: SYY


text: Cybersecurity is a critical component of Southern Company's risk management program. The Southern Company system has implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the Southern Company system's ability to fulfill critical business functions, including energy delivery service failures, and on the confidentiality, integrity, and availability of the Southern Company system's information systems.


text: Board of Directors The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein.


text: The Southern Company system has implemented a cross-functional, risk-based, "defense-in-depth" approach to preventing, detecting, identifying, mitigating, responding to, and recovering from cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Overall network efforts are led by the CISO and the Technology Security Organization (TSO), the organization responsible for implementing, monitoring, and maintaining cybersecurity practices across the Southern Company system, and aided by the Executive Vice President of Operations and the Energy Management System and Generation organization. The CISO meets regularly with the CIO and the Chief Executive Officer and reports regularly to committees of the Board to discuss risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Security and resiliency are emphasized through business assurance, enterprise risk management, and incident response plans designed to identify, evaluate, and remediate incidents when they occur. Among other things, the Cybersecurity Incident Response Plan (CIRP) establishes a team comprised of the CISO, the Deputy CISO, the Director of the Digital Defense Center, and members of the legal and compliance organizations to evaluate emerging cyber threats and escalate to executive management and business units as appropriate. Plans, policies, and technologies are regularly updated and training exercises and crisis management preparedness activities are conducted to test effectiveness.


text: The CISO works closely with the legal and compliance organizations, as well as the relevant business units, to help ensure broad oversight of and compliance with legal, regulatory, and contractual cybersecurity requirements. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system. The CISO receives reports on cybersecurity threats from a variety of sources both internally and externally on an ongoing basis and regularly reviews risk management measures implemented to identify and mitigate cybersecurity risks. Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually).


text: Refer to the Risk Management section of MD&A for a discussion of cybersecurity risk, which is incorporated by reference into this item.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Risk Management and Strategy Although many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness.


text: The Southern Company system emphasizes both security and resiliency through business assurance and incident response plans designed to identify, evaluate, and remediate incidents when they occur. A 24/7 security operations center is also utilized, which facilitates real-time situational awareness across the cyber-threat environment, and a robust insider threat protection program that leverages cross-function information sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology.


text: The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.


text: Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency.


text: The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems. The Southern Company system also maintains insurance coverage for cyber incidents; the scope of coverage and fitness of coverage is evaluated each year.


text: Incident Response The Southern Company system has adopted a CIRP that applies in the event of certain cybersecurity threats or incidents to provide a standardized guide for responding to security incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the incident response process follows the National Institute of Standards and Technology guidance and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. The CIRP is reviewed periodically to help ensure its applicability to any changing needs or circumstances and to provide users a tactical tool to effectively respond to incidents. The CIRP applies to all Southern Company system personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Southern Company system information and to all devices and network services that are owned or managed by the Southern Company system. A full tabletop exercise is performed at least annually, including stakeholders from business units beyond technology security, such as power delivery, legal, compliance, risk management, and corporate communications. In addition, the Southern Company system participates in sector-level and cross-sector exercises led by industry or the U.S. government. In the event of an incident, the technology security organization, the legal organization, and other stakeholders frequently review lessons learned after an incident has been remediated.


text: The following is a discussion of Truist's cybersecurity risk management strategy and governance. Refer to the "Risk Management" section of Part II, Item 7 for additional discussion.


text: Horizon recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Material Cybersecurity Risks, Threats, and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Southern Company system, including its business strategy, results of operations, or financial condition. While the Southern Company system has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats, or incidents. Additional information on cybersecurity risks can be found in Item 1A "Risk Factors" of this Form 10-K which should be read in conjunction with the foregoing information.


text: Risks From Cybersecurity Threats To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: Cybersecurity risk management and strategy Like other financial services firms, Truist faces an increasingly complex and evolving cybersecurity threat environment. See Item 1A, "Risk Factors" for information on risks from cybersecurity threats. We maintain a risk-based cybersecurity framework that is part of our ERM Framework. It is implemented through people, processes, and technology, whereby we assess, identify, and manage material risks from cybersecurity threats, and seek to adapt our risk mitigation activities accordingly.


text: Foundationally, our cybersecurity framework is based upon the National Institute of Standards and Technology for Improving Critical Infrastructure Cybersecurity and is also designed to incorporate elements from additional industry standards, such as those of the Federal Financial Institutions Examination Council, to better suit the Company's cyber risk profile. In addition, our cybersecurity framework incorporates internal and third-party capabilities that drive the development and implementation of our data security strategy, which is designed to reduce cybersecurity risk while enabling Truist's corporate business objectives.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats We maintain an Information Security Program that specifies how we execute our cybersecurity framework. The Information Security Program is designed to assess, identify, and manage risks arising from the cybersecurity threats facing Truist. Truist maintains cybersecurity and information security policies, procedures, and technologies that are intended to protect our clients', teammates' and our own data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning. For example, to further mitigate the risks presented by an evolving cyber threat landscape, Truist: • provides data protection guidance to clients; • promotes data protection awareness and accountability through mandatory teammate training; and • conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of Truist's crisis response and management programs and provide the basis for improvement.


text: In addition, as a key part of the Company's Information Security Program, Truist participates in the federally recognized Financial Services Information Sharing and Analysis Center, as well as other industry organizations and initiatives that promote industry best practices, such as harmonized cybersecurity standards, cyber readiness, and secure consumer financial data sharing.


text: Our Cyber Incident Response Team is responsible for identifying, triaging, and containing cybersecurity threats and incidents, including, to the extent possible, those experienced by third-party service providers. Incidents with potential for higher impacts are routed to an enterprise response function that coordinates the response activities across impacted resource groups and business stakeholders. Through this structure, Truist manages its cyber, business, and legal obligations, including escalation to executive management and the Board, as appropriate, client and regulatory notifications, and remediation activities.


text: Our Information Security Program is also designed to help oversee, identify, and mitigate cybersecurity risks associated with our use of third-party service providers. Following an initial assessment of the level of enterprise risk potentially posed by use of the third party, the service provider is then subject to further risk-based assessments on its operational resilience and cybersecurity practices, including disaster recovery and business continuity plans that specify the time frame to resume activities and recover data. In its agreements with third-party service providers, Truist requires service providers to adhere to Truist's relevant cybersecurity and operational resilience standards, subject to certain exceptions that are managed on a case-by-case basis.


text: Our Information Security Program is assessed periodically to test the effectiveness of key controls through cybersecurity maturity measurements, technology risk oversight, compliance risk management testing and monitoring, internal audit review, and regulatory oversight. In addition, Truist maintains disaster recovery plans that are reviewed, modified, and approved annually.


text: Truist Financial Corporation 41 Management's role in assessing and managing material risks from cybersecurity threats Truist's Information Security Program is operated and maintained by management, including the CIO, interim CISO, and CRO. These senior officers are responsible for assessing and managing Truist's cybersecurity risks. Our Information Security Program also includes processes for escalating and considering the materiality of incidents that impact Truist, including escalation to executive management and the Board, which are periodically tested through tabletop exercises to assess Truist's preparedness. Our cybersecurity framework strategy, which is overseen by the interim CISO, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing.


text: The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the Company's broader business goals and objectives. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: In addition, various management committees assess and manage Truist's cybersecurity risks. These committees promote visibility and awareness of cybersecurity risks and drive action and escalation as needed. The primary management committees involved in Truist's Information Security Program are the Enterprise Technology Risk Committee and the Technology Risk Oversight Committee, each of which is a sub-committee of the ERC. Truist's cybersecurity teams that implement the Information Security Program and the risk partners who oversee the program leverage these committees to report on and escalate current or emerging cybersecurity risks or other changes in the business environment which could affect Truist's risk profile or control environment.


text: As discussed in more detail in the "Risk Management" section of Part II, Item 7, the ERC is a cross-functional executive forum to promote awareness and dialogue on risk matters across the enterprise, including cybersecurity risks, oversee the execution of risk program requirements and sound risk management activities, and enact delegated decision-making authority and oversight routines from the BRC. Our CRO and CIO are members of the ERC. The interim CISO provides updates at every ERC meeting on cybersecurity and information security risk.


text: The Enterprise Technology Risk Committee provides business unit oversight of key management activities, including the Company's Information Security Program. The Technology Risk Oversight Committee provides oversight of key risk management activities to identify, assess, monitor, mitigate, and report on technology (including core technology, data and cybersecurity) risk across the enterprise. These sub-committees serve as governing forums for monitoring and escalating significant cybersecurity as well as other technology risk matters to the ERC.


text: The members of management that lead our Information Security Program and strategy have extensive experience in technology, cybersecurity, and information security. Our CRO previously served as our interim CIO and has more than 20 years of banking experience spanning a variety of roles in both the commercial and consumer segments, including credit risk, portfolio risk management, model management, acquisition integrations, technology, and vertically integrated operations for revenue producing businesses, including leading operational services across Truist for deposits, payments, credit card, capital markets, consumer and wholesale lending, fraud, and care centers across all products. Our CIO has over 25 years of experience leading technology teams at financial institutions, including in the areas of application development, infrastructure, information technology strategy, risk management, and information security. Following the departure of our CISO in November 2024, the CIO is serving as our interim CISO while our search for a permanent CISO continues. The CIO's direct reports have on average over 20 years of experience with technology management and information security at financial institutions, including in the areas of governance, operations, application and data protection, access management, and business information security.


text: Board of Directors' oversight of risks from cybersecurity threats Our Board has primary responsibility for the oversight of our enterprise risk management and exercises its oversight function in respect of cybersecurity risk through the BRC. The BRC is responsible for overseeing Truist's risk management function, including approving and reviewing Truist's risk management framework and policies, and overseeing management's implementation of such framework and policies. The oversight responsibility of our Board and the BRC is facilitated through management-reporting processes designed to provide visibility to the Board on cybersecurity matters. For example, members of the BRC receive regular reports from our CRO and interim CISO related to information technology and cybersecurity risks to Truist. The BRC meets periodically with risk management advisors and discusses with executive management any cybersecurity recommendations received. Management also discusses urgent cybersecurity developments with the Chairs of the BRC and BTC between Board and committee meetings, as appropriate. The Board annually reviews and approves our Information Security Program and Information Security Policy. Additionally, the BTC provides oversight of Truist's technology strategy, including elements of it that involve cybersecurity.


text: Truist provides ongoing development and education to its directors with respect to cybersecurity, including presentations at Board meetings on special topics, such as updates on cybersecurity legislation and regulation. The Board also conducts a cybersecurity tabletop exercise at least every other year to simulate Truist's analysis and response to hypothetical cybersecurity incidents. In addition, Truist provides directors with a Board Cybersecurity Handbook that provides details on key Truist practices, resources, and protocols relating to cybersecurity protection, response, and preparedness. Finally, as required by the Gramm-Leach-Bliley Act, the Board receives an update at least annually on Truist's Information Security Program.


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity risk management also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Cybersecurity Leaders (as defined below) and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Incident Response The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its processes and capabilities in addressing cybersecurity threats.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1.A Risk Factors—Information Technology Risks."


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: In addition, the cybersecurity team, managed by the SVP of Enterprise Strategy and Execution, receives oversight and executive support through engagement with our ERC. The ERC is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile. Similarly, the team works with our ERM function on business alignment and procuring cybersecurity insurance.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile at its regularly scheduled meetings. The Company's Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Audit Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CISO, who reports to the Company's CIO. The CISO and CIO (collectively, the Company's "Cybersecurity Leaders") are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department. The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant. • The CISO is responsible for all aspects of cybersecurity across the Company's facilities, airports, and aircraft fleet, which includes security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management. The CISO has served in various roles in information technology for nearly 40 years at numerous technology companies and consulting firms. The CISO earned a Bachelor of Science in Industrial Engineering from Louisiana State University, a Master of Science in Management Information Systems from The University of Texas at Dallas, and a Master of Business Administration from Southern Methodist University.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; mobile application; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive and process certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.


text: The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the Company's broader business goals and objectives. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.

companyName: SOUTHWESTERN PUBLIC SERVICE CO


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based, threat-informed approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are evaluated and prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk or threat. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity program also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO" and, together with the CIO, the Company's "Cybersecurity Leaders") and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Incident Response The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team collaborates closely with other internal teams as well as with external legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its cybersecurity response plan and its processes and capabilities in addressing cybersecurity threats.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, assessors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability evaluations to help identify potential weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and/or a recommendation of specific mitigation activities. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the Company's business strategy, results of operations, or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company and its service providers have experienced cyber-attacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A Risk Factors—Information Technology, Cybersecurity, and Data Privacy Risks."


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board may request follow-up information and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: We are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings. The Company's CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data protection, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. As needed, the Audit Committee reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations. In addition to this regular reporting, cybersecurity risks or threats may also be escalated on an as-needed basis to the Audit Committee.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CISO, who reports to the Company's CIO. The Cybersecurity Leaders are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department. The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant. • The CISO is responsible for leading the Company's cybersecurity strategy and department while ensuring the protection of data and assets across the Company's facilities, airports, and aircraft. The CISO has served in various roles in cybersecurity for over 15 years. The CISO earned a Bachelor of Business Administration in Management Information Systems from The University of Oklahoma and holds a Certified Information Systems Security Professional certification. The CISO also participates in the Aviation Information Sharing and Analysis Center Board and is the Vice Chair of the Cybersecurity Council at Airlines for America.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, incident response, security operations, vulnerability management, risk and compliance and security engineering. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of relevant issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates, as needed, with external legal advisors, communication specialists, and other key stakeholders.


text: SPS is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: All employees and third-party contractors with access to the Company's IT infrastructure must annually acknowledge that they have read and understand the IT User Acceptance Policy. Employees and contractors must also complete information security awareness training upon initial hire and annually thereafter.

companyName: JACK IN THE BOX INC

ticker: JACK