text: Management's Role Managing Risk The Company's CIO plays a large role in informing the audit committee of the board of directors on cybersecurity risks. The audit committee of the board of directors receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee of the board of directors maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The CIO, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, and SEC financial reporting department employees, and the board of directors are notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.

companyName: MDU RESOURCES GROUP INC

ticker: MDU

secItem: Item 1C


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with its director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.

stage1Category: Management Role

stage1Method: majority


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO and the CIO reports directly to the Company's chief executive officer. The Company's CIO who served as the first CIO of the Company since 2016, oversaw the information technology and cybersecurity portfolios until her retirement on January 10, 2025. A new CIO from within the Company was named to succeed the retiring CIO and holds both a bachelor's and master's degree in business administration with over 25 years of information technology experience in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, over 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The other members of information technology director level leadership also responsible for managing cybersecurity risks have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee of the board of directors with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies and oversight of cybersecurity risks. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from across the Company.

stage1Category: Board Governance

stage1Method: unanimous


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and reporting processes are designed so that members of our senior management receive timely and adequate information regarding cybersecurity matters that impact the Company, including threats and incident response. We have implemented an approach to assess, identify and manage cybersecurity risks within our overall enterprise risk management program that shares common methodologies, reporting channels and governance processes and is based on a recognized framework established by the National Institute of Standards and Technology.

companyName: MOOG INC.

ticker: MOG-A

stage1Category: Risk Management Process


text: Cybersecurity risks, both internal and from third parties, are tracked regularly. We have established plans and procedures to guide us through an active threat or incident in order to return to normal business operations. We have developed a notification process to allow for real-time escalation of material cybersecurity incidents by and among members of our Corporate IT Security Team ("CIST").


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.


text: In addition, our IT infrastructure management program maintains an IT Crisis Response Plan ("ICRP") where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement.


text: We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis.


text: Lumen's CSO has worked in the public and private sectors in information security since 1997 and has been a chief security officer since 2017. His technical and process certifications include CISSP, ITIL Foundation, Six Sigma Certified, CISCO CCNP, and CCNA, and he oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: QWEST CORP

ticker: CTBB


text: Our information security program is enterprise-wide and includes cross-functional coordination between various departments across the Company including Information Security, Technology, Privacy, Enterprise Risk Management, and Internal Audit. The structure of our information security program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to organize processes and tools to identify, protect, detect, respond, and recover from threats and events.

companyName: NCR Voyix Corp

ticker: VYX


text: In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board of Directors ("Board") is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks.


text: The CIST is supported by experienced and knowledgeable leaders, who each have several decades of experience managing risk at Moog or similar companies, including risks arising from cybersecurity threats. The CIST consists of several centers of expertise comprised of persons with many types of skills and ability, including security operations center analysts, cyber engineers, threat hunters, threat modelers, cyber risk and compliance professionals, and threat and vulnerability management analysts. Members of the CIST maintain cybersecurity credentials, such as Certified Information Security Manager, Certified Information Systems Security Specialist, CompTIA Security+ and cybersecurity Analyst+, EC-Council Certified Ethical Hacker, Computer Hacking Forensic Investigator, and several vendor product certifications including from Amazon Web Services, Microsoft and Qualys.


text: We also perform annual internal assessments and audits of internal processes and controls related to cybersecurity and engage third-party experts to support the assessment of cybersecurity related risks, including cybersecurity penetration testing. The results of these assessments, audits and tests are reported to the CIO and CFO.


text: In the event of a cybersecurity incident, we engage our Incident Response Plan, which outlines the steps to be followed regarding preparation, detection, analysis, containment, eradication, recovery, notification, and post-incident remediation. Notification includes informing functional areas (e.g., legal), as well as senior management and the Board, as appropriate. We also have an insider threat detection program to proactively identify internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement to adequately safeguard controlled unclassified information and reporting cybersecurity incidents to the Department of Defense's Cybersecurity Maturity Model Certification program. Moog also shares and receives threat intelligence information with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: The CISO and the CIO present cybersecurity updates regularly and, as necessary, to the CFO. The CFO will engage the Board to participate in assessing cybersecurity risk as part of the Company's overall risk assessment. In addition, the Board is informed when a cybersecurity issue is identified that may pose significant risk to the Company.


text: Risk management and strategy As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on our owned and leased networks to conduct our operations, (ii) our transmission of large amounts of data over our systems and (iii) our processing and storage of sensitive customer data. Cyber-attacks on our systems may stem from a variety of sources, including fraud, malice or sabotage on the part of foreign nations, third parties, vendors, or employees and attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally. Our privacy and cybersecurity policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our Information Technology, Privacy, Product, and Operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed privacy and cybersecurity laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also share and receive threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: As noted elsewhere in this annual report, we are materially reliant on a variety of third-party service providers to operate our business, which exposes us to the risk of cyber incidents impacting those providers' systems. We have a vendor risk management program that assesses, manages and oversees risks associated with third-party service providers who have access to our data and systems. We maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on our operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of the Board of Directors. These escalation provisions, together with Lumen's Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: The Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen also has management level committees and response teams who support our processes to assess and manage cybersecurity risk as follows: • The Risk Oversight Committee ("ROC"), whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and General Counsel, is responsible for making risk management decisions to ensure consideration of all relevant factors and alignment with our overall risk mitigation strategy. The ROC also oversees key risk management activity to help ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board and senior management. • The Technology Security and Privacy Council, co-chaired by the CSO, Chief Information Officer, and Chief Privacy Officer, brings together IT, legal and internal audit personnel, and other function leads. The Security and Privacy Council provides a forum for these cross-functional members of management to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.


text: At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen also periodically holds employee trainings on our privacy, cybersecurity and information management policies, conduct phishing tests and generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: Risk Management and Strategy As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor, we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of its Board of Directors. These escalation provisions, together with Lumen's disclosure controls and procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: The Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to all security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team ("CSWAT"), which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The CSWAT is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, managing risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen's cybersecurity organization includes a response team and management level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen generally seeks to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include our Chief Financial Officer, Chief Technology and Product Officer, Executive Vice President of Enterprise Operations, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by our Board of Directors and our senior leadership team. Some of the more significant risks discussed by the ROC are also reported to our Risk and Security Committee at least quarterly.


text: RISK MANAGEMENT AND STRATEGY We identify and assess areas of risk for our company on an ongoing basis, and we have developed, and regularly refine, comprehensive practices to manage and mitigate existing and potential risks to our business. Our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our chief information security officer ("CISO"), who reports directly to our chief information officer ("CIO"); • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data; and • a cybersecurity incident response plan.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.


text: We also require all employees to participate in cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.


text: Third-Party Review Processes—Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.

stage1Category: Third-Party Risk


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.


text: EXISTING AND POTENTIAL RISKS As discussed in the Risk Factors section above, our operations could be significantly and negatively impacted by cybersecurity threats and other disruptions affecting our information technology, related information systems and sensitive information. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII and proprietary and confidential business data. We utilize EHRs and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. As described above, our information systems, in turn, interface with and rely on third party systems that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures.

stage1Category: None/Other


text: In April 2022, we experienced a cybersecurity incident that temporarily disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.

stage1Category: Incident Disclosure


text: Board Oversight—Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.


text: Our CIO and CISO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: Veritone, Inc.

ticker: VERI


text: Management Oversight—Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.


text: Cybersecurity Team and Strategy—Our cybersecurity team, which includes both our employees and those of our managed services provider, is comprised of subgroups focused on distinct functional areas of responsibility. The team maintains a Security Operations Center, staffed 24 hours a day, that delivers day-to-day execution support for our cybersecurity risk management program.


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. Our program leverages best practices and is guided by industry frameworks, including the National Institute of Standards and Technology Cyber Security Framework. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.


text: Third-Party Review Processes —Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management in accordance with our plan and as otherwise appropriate based on the nature of the incident.


text: Our information security program employs various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, encryption and multi-factor authentication. Further, we recognize the risks associated with the use of third-party service providers and have processes designed to identify material risks related to third parties.


text: EXISTING AND POTENTIAL RISKS As previously disclosed, in April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our business, financial condition or results of operations. Additional information on cybersecurity related risks is included in Item 1A, Risk Factors, of Part I of this report.


text: Board Oversight— Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.


text: Management Oversight— Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents are described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.


text: Cybersecurity risk management is a core component of our enterprise risk-management framework. Cybersecurity incidents and threats pose a risk to the disruption of our business operations, including the confidentiality, integrity and availability of data and information. CFC's cybersecurity program is designed to manage operational risks associated with the ever-evolving nature of cybersecurity threats. Because these risks could have a material adverse impact on our operations and reputation, both management and the CFC Board of Directors are actively engaged in the oversight of the cybersecurity program and our continuous efforts in monitoring, measuring and managing the risks.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Risk Management and Strategy The primary goal of CFC's cybersecurity operations is to prevent, identify, mitigate and respond on a timely basis to cybersecurity threats in order to reduce operational risk and business impact. Our strategy encompasses technology, process and people. The technology components are designed to provide multiple layers of system security, controls and monitors for our infrastructure, data and applications. Our security infrastructure and resources are focused on the monitoring of threats and the defense of our external and internal networks, endpoints, data resources and identity management.


text: We use risk-based processes to prioritize the resources that manage vulnerabilities, threats, incident responses and operational changes. The risk-based approach ensures we are taking action on the threats, events and incidents that have the highest likelihood of impacting our business and members. We maintain cybersecurity incident procedures that identify the activities, responses and escalation procedures to be executed upon detection of a potential cybersecurity incident. These procedures are a critical component of CFC's Crisis Management Plan and business continuity efforts.


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment.


text: The effectiveness of our cybersecurity operations is regularly examined and tested by third-party vendors who specialize in cybersecurity risk management. We regularly employ such vendors to test the effectiveness of our security controls, including penetration testing. External vendors are engaged at least on an annual basis to facilitate incident response exercises and training. We use external risk management services to assess and monitor cybersecurity risk associated with third-party service providers. Finally, we review the maturity of our program's design and control environment's effectiveness through regular internal assessments and examinations.


text: Our Board of Directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the Board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the Board. The reports include information on material cybersecurity incidents, if any, and management actions to protect CFC. Upon the occurrence of a material cybersecurity incident, the Board of Directors will be promptly notified so it may properly evaluate such cybersecurity incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the Board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, our Chief Information Officer ("CIO") and Director, Information Security, provide the Board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the Board of Directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.


text: Role of Management Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a three lines of defense model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.


text: Our first line of defense includes our CIO and Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our CIO, who reports to our Chief Operating Officer ("COO"), has over two decades of experience managing technology risk. Our Director, Information Security, who dually reports to the COO and CIO, has over a decade of information security management experience and as a Certified Information Systems Security Professional. Collectively, they are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. In addition to the COO, CIO and Director, Information Security, our Cybersecurity Committee is composed of members of management including, but not limited to, the Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the Board of Directors regarding material cybersecurity incidents and emerging threats.


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the Board.


text: We have not experienced any material cybersecurity incidents that have impacted our business, results of operations or financial condition to date. See "Item 1A. Risk Factors" for a discussion of our risks related to cybersecurity.


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment. We established requirements regarding the use of company-approved generative artificial intelligence tools to ensure that all employees utilize such tools in a manner that safeguards sensitive information and aligns with legal requirements and CFC's ethical standards.


text: Our board of directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the board. The reports include information on significant cybersecurity incidents, if any, and management actions to protect CFC. We promptly notify the board of directors upon the occurrence of a significant cybersecurity incident so it may properly evaluate the incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, members of our staff responsible for cybersecurity provide the board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the board of directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.


text: Role of Management Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a "three lines of defense" model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.


text: Our first line of defense includes our cybersecurity team lead by our Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our Director, Information Security, who reports to our Chief Operating Officer ( " COO"), has over a decade of information security management experience and is a Certified Information Systems Security Professional. Our COO and Director, Information Security are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. Our Cybersecurity Committee is composed of members of management including, but not limited to, the COO, Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the board of directors regarding material cybersecurity incidents and emerging threats.


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal Audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the b oard.


text: The Company recognizes the importance of maintaining cybersecurity measures that are designed to safeguard our information systems and to protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets.


text: Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: We conduct periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and attempt to improve our security measures and planning. We collaborate with external experts, including consultants and auditors, in evaluating and testing our information security program. Our employees and certain of our contractors are required to participate in security awareness training at least annually.


text: The information security program is under the responsibility of the Chief Information Officer (CIO). The CIO is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, standards, and risk management policies and procedures.


text: The Company's cybersecurity risk management policies and procedures include internal notification procedures which, depending on the level of severity assigned to the event, may include direct notice to, among others, the Company's General Counsel and Chief Privacy Officer. Members of the Company's legal department support efforts to evaluate the materiality of any incidents, determine whether notice to third parties such as regulators, customers or vendors is required, determine whether any prohibition on insider trading is appropriate, and assess whether disclosure to stockholders or governmental filings, including with the SEC, are required. Our internal notification procedures also include notifying various Company Information Technology Services managers, subject matter experts in the Company's software department and other senior executives, depending on the level of severity assigned to the event.


text: Our CIO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CIO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Data protection, cybersecurity and data privacy issues could negatively impact our business" in Item 1A of Part I of this Report.


text: Our information security program is enterprise-wide and includes cross-functional coordination between various departments across the Company including Information Security, Technology, Privacy, Enterprise Risk Management, and Internal Audit. The structure of our information security program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to organize processes and tools to identify, protect, detect, respond, and recover from threats and events.


text: Our information security program employs various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, encryption and multi-factor authentication. Further, we recognize the risks associated with the use of third-party service providers and have processes designed to identify material risks related to third parties.


text: Our Chief Technology Officer (CTO) is responsible for oversight of our information security strategy, program, and operations. The CTO has over 25 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. He holds a doctorate in Business Administration, Master of Business Administration, and Bachelor of Engineering in Electrical and Electronics Engineering / Information Systems. In previous roles at large scale fintech and cybersecurity companies, the CTO has designed comprehensive cybersecurity programs and managed and mitigated high profile cybersecurity incidents to ensure business continuity.


text: Our Chief Information Security Officer (CISO), who reports directly to the CTO, is responsible for day-to-day assessment and management of cybersecurity risk. Our CISO has over 20 years of experience in various roles related to information security and related technology, including previously serving as Vice President of Information Technology and Senior Vice President of Information Technology at other companies, and holds a Bachelor of Science in Math and a Master of Business Administration in Computer Information Systems and Information Technology. The CISO's responsibilities in prior roles at large, global fintech and healthcare companies has included initiatives to identify and reduce cybersecurity vulnerabilities.


text: The Company's cybersecurity risk management policies and procedures include internal notification procedures which, depending on the level of severity assigned to the event, may include direct notice to, among others, the Company's General Counsel and Chief Privacy Officer. Members of the Company's legal department support efforts to evaluate the materiality of any incidents, determine whether notice to third parties such as regulators, customers or vendors is required, determine whether any prohibition on insider trading is appropriate, and assess whether disclosure to stockholders or governmental filings, including with the SEC, are required. Our internal notification procedures also include notifying various Company information technology services managers, subject matter experts in the Company's software department and other senior executives, depending on the level of severity assigned to the event.


text: Our CTO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CTO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Our inability to protect our systems and data from cybersecurity threats or other technological risks could adversely affect our business operations, or stock price and damage our brand and reputation" in Item 1A of Part I of this Report.


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any such third party could harm our reputation; require us to expend resources to respond to and recover from such a security incident or defend against further attacks; divert management's attention; subject us to liability; or otherwise adversely affect our business. Because of these risks, we take cybersecurity seriously.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Under the oversight of our Board of Directors, and the Audit Committee of the Board, we have developed and maintain an information security program that includes technical, administrative and physical measures designed to safeguard our information and information systems. Cybersecurity risk management is integrated into our broader risk management framework. Our approach includes elements that are proactive and adaptive, using security assessments, employee training and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry and regulatory standards. Our information security program includes response procedures to be followed in the event of a cybersecurity incident that outline steps to be followed from detection to assessment to notification and recovery, including internal notifications to management, the Audit Committee and the Board, as appropriate. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption to systems or processes we rely on.


text: Our Board of Directors recognizes the importance of managing risks associated with cybersecurity threats and provides oversight of the Company's information security program. Risk is an integral part of the Board's deliberations throughout the year and the Board exercises its oversight responsibility both directly and through its committees. In particular, the Audit Committee oversees risks relating to information security, including cybersecurity risks. Members of management, including the Company's Chief Information Security Officer ("CISO"), provide the Audit Committee with updates on cybersecurity and information technology matters at least twice a year, and the Audit Committee and management also provide updates to the Board. In addition to reporting to the Audit Committee and Board, the CISO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or the Board, is notified by the CISO of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has been in that position since October 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: THE NEW YORK TIMES COMPANY – P. 25 As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively and damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process confidential subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts to breach our security and compromise our information technology systems from a broad range of actors. A cybersecurity incident impacting us or any such third party could disrupt our services, result in the compromise of confidential information; result in theft or misuse of our intellectual property; divert management's attention; require us to expend resources to mitigate the effects of such a security incident; subject us to litigation, regulatory or other government inquiries or investigations and/or liability; harm our reputation; or otherwise adversely affect our business, financial condition or results of operations.


text: The Board's risk oversight is enabled by an enterprise risk management program designed to identify, prioritize and assess a broad range of risks, including risks related to cybersecurity, that may affect the Company's ability to execute its corporate strategy and fulfill its business objectives, and to formulate plans to mitigate their effects.


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program, and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has held that position since 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information


text: P. 24 – THE NEW YORK TIMES COMPANY systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: From time to time, we experience security incidents. As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively, cause us to incur significant costs, subject us to significant liability and/or damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.


text: We believe that cybersecurity is a critical component of our enterprise risk management process, and as such, we have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: NPK International Inc.

ticker: NPKI


text: Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.


text: Our CIO, who reports to our Senior VP & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.


text: Our CIO has a Master of Science in Information Systems and has served in various roles in information technology for over 25 years. Our Cybersecurity Manager has served in various roles in information technology and information security for over 25 years, with 10 of those years as the leader responsible for enterprise cybersecurity, including serving as the Information Security Officer at another larger publicly traded company.


text: Cybersecurity Risk Management and Strategy Nordson Corporation manages cybersecurity risks by implementing processes for assessment, identification, and mitigation of cybersecurity threats. Nordson's cybersecurity program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, enabling us to develop policies regarding information access, asset protection and personal data security. However, this does not mean that we meet any particular technical standards, specifications or requirements, but rather that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. We strive to protect our information assets through key cybersecurity measures, such as the implementation of multifactor authentication and advanced malware defenses, and we collaborate with internal stakeholders to establish layered cybersecurity defenses and restricted access based on business needs. We conduct regular continuous education sessions for our employees on cybersecurity awareness, including confidential information protection and simulated phishing attacks.

companyName: NORDSON CORP

ticker: NDSN


text: Our Chief Product Officer has been with Pega for thirty-two years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity. With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect.


text: The Board's Oversight of Cybersecurity Risk Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.


text: Management's Involvement in the Oversight of Cybersecurity Risk Our CIO, who reports to our Senior Vice President & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.


text: Risk Management and Strategy Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity.


text: With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We also maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for certain breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information, and computer system security breaches.


text: Our cybersecurity risk management is a critical component of our comprehensive business continuity and enterprise risk management programs. Our information security team regularly collaborates with cross-functional subject matter experts and leaders to assess and enhance our cybersecurity risk posture and preparedness. Management employs the following defense mechanisms throughout the enterprise: employee training program to increase cybersecurity awareness, vulnerability management to identify and address potential weaknesses, multifactor authentication for secure access, tabletop exercises to simulate and prepare for potential incidents, and evaluation of third-party service providers, business partners and cloud suppliers, including through assessments of their cybersecurity practices prior to service utilization.


text: To date, management has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Nordson Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors, Increased information technology threats and cybersecurity incidents and threats could pose a risk to our systems, networks, products, solutions and services and those of our business partners." above for more information. While we are committed to safeguarding our information and the proprietary and confidential information they contain, we note that no security measures can guarantee complete protection against cybersecurity incidents.


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing an annual report on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Senior Director of Security and Compliance, primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.


text: Nordson Corporation 18 The Senior Director of Security and Compliance assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Vice President, Information Systems and Technology meets regularly with the Audit Committee to review our information technology systems and discuss key cybersecurity risks. Additionally, the Director, Internal Audit and Chief Financial Officer presents an overview of our global enterprise risk management program, including cybersecurity risks, to the Audit Committee, which is subsequently reported to the Board of Directors.


text: We engage with experts to assist with regular third-party penetration testing to evaluate our program against industry standards. We also have standing engagements with incident response experts and external counsel to enhance our cybersecurity resilience. We frequently collaborate with cybersecurity experts to share insights on threats, best practices and emerging trends.


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing regular reports on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Chief Information Security Officer ("CISO"), primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.


text: Nordson Corporation 18 The CISO assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Nordstrom understands that establishing, executing and sustaining effective cybersecurity measures to secure our information systems and preserve the confidentiality, integrity and availability of our data is critical to the success of the business.

companyName: NORDSTROM INC


text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CISO regularly updates the CTIO, Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.


text: Engagement with Third Parties on Management of Cybersecurity Risk Recognizing the dynamic nature of cybersecurity threats, Nordstrom collaborates with external experts, including assessors, consultants and examiners, to evaluate and test our cybersecurity risk preparedness. Regular exams, threat assessments and consultation on security enhancements with these third parties ensure that our cybersecurity strategies align with industry best practices.


text: Oversight of Third-party Risk In the course of our business, we regularly exchange data and information with certain third parties in various ways, exposing us to risk related to the cybersecurity posture of and information management practices of those third parties. To try to mitigate this risk, we have implemented processes that may, depending upon the nature of the relationship with the third party, require security assessments and data integration design reviews prior to allowing our systems to connect with theirs. In addition, we seek to require these third parties to adhere to pre-established cybersecurity standards. Where applicable, we try to obtain contractual commitments with those third parties to ensure these security requirements are met.


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition and cash flows.


text: The Trust's cybersecurity protocols include, but are not limited to, and intrusions, and isolated computer workstations. The Trust's personnel are aware of the potential of a cybersecurity incident and exercise caution to ensure no such incident occurs. The primary entities with which the Trust conducts business are banks, outside service providers, and vendors, which have their own cybersecurity protocols. Interactions between the Trust's information facilities passwords, passphrases, and two-factor or independent authorizations.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, led by our CISO and supported by our CTIO. The CISO, who has over 20 years of cybersecurity and technology expertise, supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.


text: Monitoring and Responding to Cybersecurity Incidents The security organization stays informed about the latest developments in cybersecurity, implements processes for regular monitoring of information systems and deploys relevant security measures. In the event of a cybersecurity incident, a formal incident response plan is in place for immediate actions and long-term strategies.


text: Board of Directors Oversight The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer, CTIO and CISO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.