text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which is used to benchmark and tailor the Company's strategies and program to our risk profile and specific operational needs and goals.


text: Our cybersecurity program includes: • Penetration testing of internal information technology systems and review of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • Phishing, social engineering, and cyber hygiene training; • Continuous security event monitoring, management, and incident response plans; • Continuous enhancements to security capabilities based on evolving threats; • Information security policies and procedures; • Privacy controls and compliance with applicable legislative and regulatory requirements; • Assessment of applicable third-party vendors' cybersecurity and information security practices; and • A cross-functional approach to addressing cybersecurity risk with participation from representatives across the business and functions.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT

secItem: Item 1C


text: As part of our cybersecurity program, we have adopted an incident response plan, under which the Chairs of our Board of Directors and Audit Committee are informed by the Cybersecurity Steering Committee of any cybersecurity incidents that have the potential to materially adversely impact the Company or its information systems. To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, or in any penalties or settlements.


text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: KITE REALTY GROUP TRUST

ticker: KRG

stage1Category: Risk Management Process

stage1Method: unanimous


text: As risk management is an ongoing process, the Company regularly assesses its cybersecurity risks and adjusts its program accordingly. Via multiple monitoring solutions, potential cyber threats are automatically logged and proactively addressed. Our monitoring tools use well-established vulnerability scoring to aid in the overall risk assessment. The scoring ranks by potential severity and likelihood and includes a review of mitigating factors. The Company prioritizes its cybersecurity investments based on the likelihood and impact of potential threats.


text: From onboarding and at least annually thereafter, the Company educates and trains its workforce on cybersecurity leading practices using a variety of methods. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Any identified deficiencies or vulnerabilities are reviewed by the IT staff and management and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: The Company has developed incident response plans to contain, investigate, respond to and recover from cybersecurity incidents. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats To date, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, refer to Item 1A. "Risk Factors – We and our tenants face risks related to cybersecurity attacks that could cause loss of confidential information and other business disruptions." included elsewhere within this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter. Reports on these topics are provided to the Audit Committee by the Senior Vice President, Chief Technology Officer and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.

stage1Category: Board Governance


text: Management's Role The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to ensure the constant evolution of the program.

stage1Category: Management Role


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries including real estate, global retail, fintech and insurance along with experience working for several top IT service and solutions providers.

stage1Method: majority


text: We recognize that cybercriminals frequently target employees to gain unauthorized access to information systems. Therefore, from onboarding and at least annually thereafter, the Company educates and trains its employees on cybersecurity leading practices using a variety of methods, which is supplemented throughout the year with regular phishing and other cyber-related testing. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Identified deficiencies or vulnerabilities are reviewed by the IT staff and management, and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. These efforts may include reviewing security documentation or protocols of key vendors, service providers, and external users of our systems.

stage1Category: Third-Party Risk


text: The Company has developed cybersecurity incident response plans to contain, investigate, respond to, and recover from cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Key members of management, including the Company's Chief Financial Officer, Chief Operating Officer, and Chief Legal Officer, as well as employees from IT, internal audit, marketing and communications, and human resources, serve on the Company's security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats As of December 31, 2024, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, see "We and our tenants face risks related to cyber attacks that could cause loss of confidential information and other business disruptions" in Item 1A. "Risk Factors" within this Annual Report on Form 10-K.


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter, including current threat levels and ongoing program enhancements. Reports on these topics are provided to the Audit Committee by the Vice President, Chief Information Security Officer ("CISO") and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.


text: Management's Role The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to help ensure the constant evolution of the program.


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries, including real estate, global retail, fintech, and insurance, along with experience working for several top IT service and solutions providers. The IT team provides quarterly reports to the Company's senior management, which typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.


text: The Company has cybersecurity insurance designed to cover certain expenses related to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: Cybersecurity Risk Management and Strategy We identify, assess and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to personnel and customers, violation of privacy and security laws and other litigation and legal risk, and reputational risks. We have implemented and continue to maintain various cybersecurity processes, technologies, and controls designed to aid in our efforts to assess, identify, and manage such material risks.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial Officer, Chief Operating Officer and Chief Technology Officer and is chaired by our General Counsel, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee, together with the rest of our senior leadership team, to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, and periodic penetration testing and tabletop exercises.


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, from time to time we work with third parties that are intended to help us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, managed cybersecurity service providers and penetration testing firms.


text: To operate our business, we utilize certain service providers to perform a variety of functions, such as professional services, data center facilities and other functions. Our processes are designed to address cybersecurity threat risks associated with our use of service providers, including those in our supply chain or who have access to our customer and employee data or our information systems. Certain risks associated with our use of service providers are included within our enterprise risk management assessment program, as well as our processes designed to identify, assess and manage cybersecurity-specific risks, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our service providers. We perform diligence on certain service providers that have access to our systems, data or facilities that house such systems or data. This diligence may include a review of the service providers' internal and/or external security audits and certifications. Additionally, we may impose specific cybersecurity obligations on certain service providers.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.

stage1Category: None/Other


text: Board of Director Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and Senior Director, Information Security. Such individuals have collectively over 20 years of prior work experience in various roles involving managing and safeguarding information security, formulating and executing strategies for cybersecurity, and instituting programs for information and cyber protection, as well as several relevant degrees and certifications, including Certified Information Systems Security Professional, or CISSP, Offensive Security Certified Professional, or OCSP, M.S. Cybersecurity and Information Assurance, M.B.A. Information Systems. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial & Operating Officer and Chief Revenue Officer and is chaired by our Chief Legal Officer, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, periodic penetration testing, bug bounty program and tabletop exercises.


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • periodically evaluate customer support interactions to help ensure compliance with security protocols and service standards; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units. In addition, our full board of directors is presented with updates on our cybersecurity threat risk management and strategy processes at least annually.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. As such, we rely on the cybersecurity policies and procedures implemented by Prospect Capital Management, for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details that Prospect Capital Management has provided to us regarding its cybersecurity program that are relevant to us.


text: Prospect Capital Management has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on, or through, our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business- We may experience cybersecurity incidents and are subject to cybersecurity risks. The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO supervises the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Prospect Capital Management also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management also utilizes a security awareness training platform as supplementary cybersecurity training for staff with a high failure rate on the phishing tests.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MAXLINEAR, INC

ticker: MXL


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We have allocated adequate resources and have designated high-level personnel, including our Chief Information Security Officer, to manage the cybersecurity risk assessment and mitigation process.


text: As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "We have been and may in the future be subject to information technology failures, including security breaches, cyber-attacks, design defects or system failures, that could disrupt our operations, damage our reputation and adversely affect our business, operations, and financial results," "We are subject to governmental laws, regulations and other legal obligations related to privacy, data protection, and cybersecurity," and "We face risks related to security vulnerabilities in our products."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cybersecurity Committee of the Board of Directors (the "Cybersecurity Committee"). Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.


text: Our Chief Information Security Officer and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our Chief Information Security Officer has twenty-five years of cybersecurity experience, has completed a Masters in Information Security Engineering, and holds several cybersecurity certifications.


text: Our Chief Information Security Officer and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Security Officer and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem. There are processes in place to restrict and provide need-based access to sensitive or confidential data for third parties. We conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Our Chief Information Security Officer and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our Chief Information Security Officer and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.


text: The last known cybersecurity breach occurred in 2020. The Company has not experienced any material cybersecurity breach in the years ended December 31, 2023, 2022 and 2021. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2023, 2022, and 2021.


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. This process involves evaluating their infrastructure security policies and controls to ensure high levels of code quality. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We follow the Critical Security Controls, or CIS, guidance to defend our systems and networks against the most prevalent cyber-attacks. We have allocated adequate resources and have designated executives and IT management personnel to manage the cybersecurity risk assessment and mitigation process. We track quarterly Risk Register scores, which are derived from assessments of impact and likelihood, and monitor adoption rates of CIS controls to gauge our progress. These metrics are systematically tracked and reported to the board on a quarterly basis. As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity.


text: Our Cyber Security Operations Control center integrates feeds from all key areas of our infrastructure (email, network, endpoint, identity, firewall) into a centralized security information event management, or SIEM, system. This system is integrated with our Incident Response Plan, or IRP, which provides a process for responding to different types of cybersecurity incidents and designates responsibilities and actions to be taken in responding to such incidents. The IRP aims to eradicate problems as quickly as possible, while gathering actionable intelligence, restoring business functions, improving detection, and preventing reoccurrence. It includes guidelines for determining incident type, severity, roles and responsibilities, and escalation points.


text: Furthermore, we perform regular third-party security penetration testing and cyber tabletop exercises with key stakeholders to simulate responding to a hypothetical cybersecurity incident.


text: We contract with third-party security monitoring services, performing active, automated searches of indexed darknet databases. Additionally, we perform quarterly vulnerability scans against our network infrastructure and systems exposed to the Internet. The Company also participates in a cybersecurity risk insurance policy.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.


text: Our executives and IT management and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our executives and IT management and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our executives and IT management and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity risk management is overseen by a senior IT executive with ten years of cybersecurity experience, which includes both Fortune 500 and large semiconductor companies, and thirty-five years of experience in various technology domains, such as IT Infrastructure, Cloud, Cybersecurity, and Application Development.


text: Our executives and IT management and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our executives and IT management and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.


text: The Company has not experienced any material cybersecurity breach in the years ended December 31, 2024, 2023 and 2022. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2024, 2023 and 2022.


text: We are dedicated to safeguarding our invaluable assets and ensuring the well-being of personnel, as demonstrated through the preparation of our cybersecurity program.

companyName: EnerSys

ticker: ENS


text: Cybersecurity Risk Management and Strategy Our cyber risk management program is designed to comprehensively address the spectrum of cybersecurity threats that confront our organization. Within this program, we integrate an analysis of the risks facing the organization to guide our preparedness against cybersecurity threats to ensure a holistic approach that encompasses cross-functional and geographical visibility under the oversight of executive leadership through regular risk management meetings.


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. Additionally, our organization adheres to compliance with the Cybersecurity Maturity Model Certification (CMMC) and is undergoing International Organization for Standardization (ISO) accreditation, further demonstrating our commitment to adhering to rigorous cybersecurity standards. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents. Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial losses arising from cyber threats.


text: We prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional organizational risks, please refer to the General Risk Factors section of Item 1(A) Risk Factors.


text: Cybersecurity Governance The Board delegated primary oversight authority to the Audit Committee who plays a pivotal role in ensuring the effectiveness of our cybersecurity strategy. Through regular updates provided by our leadership team, the committee actively evaluates the organization's cybersecurity posture and aids in prioritizing risk mitigation efforts aligned with our strategic objectives. These updates encompass detailed quarterly reports during audit committee meetings, covering key metrics, ongoing initiatives, and any cybersecurity incidents. Additionally, on an annual basis, the entire board receives updates on the progress of our cybersecurity program and strategy, including insights into emerging risks and industry trends. Moreover, the board benefits from supplementary educational briefings delivered by both internal and external experts, providing invaluable global threat visibility and enhancing the Board's understanding of cybersecurity challenges and opportunities.


text: Overseeing our cybersecurity initiatives is our CIO and Director of Global Cybersecurity, who provide invaluable expertise in managing cybersecurity risks and leading our cybersecurity operations. Both the CIO and Director of Global Cybersecurity possess extensive expertise in information technology and program management, with a wealth of experience, including over 19 combined years of dedicated service within our corporate information security organization. Furthermore, the executive leadership team is active in security operations, overseeing implementation of policies, procedures, and policies related to cybersecurity, technology, and vendors. Both the Audit Committee of the Board as well as executive leadership team will be notified and updated in the event of an incident, with incident updates, mitigation efforts, and impact, as deemed appropriate.


text: We established a cyber incident management team that consists of our Sponsor's CIO, CISO, CFO, CLO and our CEO, CFO, General Counsel and Head of Marketing that is responsible for determining if a cybersecurity incident is material to us and requires disclosure.

companyName: JLL Income Property Trust, Inc.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."

companyName: Huron Consulting Group Inc.

ticker: HURN


text: We have an enterprise-wide cybersecurity strategy that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program is verified as conforming with ISO/IEC 27001:2013 and our most recent recertification was in 2023.


text: We use various mechanisms to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements.


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically, such as upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, our service providers adhere to mutually agreed upon security requirements, controls and responsibilities.


text: Cybersecurity Governance Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has nearly 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a way that mitigates cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.


text: Our board of directors, in coordination with the board of director's Technology and Information Security ("T&IS") Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Accordingly, the company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the company's Information Security functional team, senior management, and our board of directors in coordination with the Technology and Information Security ("T&IS") Committee and the Audit Committee of our board of directors. Our cybersecurity risk management function is a component of our overall approach to risk management, including coordination with our Enterprise Risk Management Committee.


text: Our cybersecurity risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."


text: Our cybersecurity risk management program includes among other things: a. Risk assessments designed to help identify significant cybersecurity risks to our critical systems, information and services;

companyName: Douglas Emmett Inc

ticker: DEI


text: We have a cybersecurity program that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program conforms with ISO/IEC 27001:2022 and our most recent recertification was in 2024.


text: We use various mechanisms to detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements. We also engage third parties, including assessors, consultants, and auditors to assess our cybersecurity control environment and to test the vulnerability of our cybersecurity infrastructure at least annually.


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically. We use a variety of inputs in such risk assessments, including information supplied by the providers themselves and other third parties. In addition, our contracts with our service providers require them to adhere to mutually agreed upon security requirements, controls and responsibilities, as applicable.


text: Cybersecurity Governance Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has over 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a manner designed to mitigate cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has the primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.


text: Our board of directors, in coordination with its T&IS Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs.


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO who have over a combined four decades of experience, specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.

companyName: Spok Holdings, Inc

ticker: SPOK


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.


text: We have processes in place designed to identify and mitigate risks from third-party vendors, including, as appropriate, pre-contractual security assessments and review of contractual terms addressing cybersecurity and data protection.

companyName: Sonos Inc

ticker: SONO


text: Cybersecurity is part of our Board of Directors' oversight function. Our Board of Directors has delegated oversight of cybersecurity and other information technology to its Audit Committee. Our Audit Committee receives regular reporting from executive management on our cybersecurity risks and, as necessary, updates on cybersecurity incidents. Our Audit Committee and executive management report to our Board of Directors regarding its activities, including the Cybersecurity Program. Our Board of Directors also receives continuing education on the cybersecurity risks that impact public companies.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors –Cyberattacks, data breaches or other compromises to our or our critical third parties' systems, data, products or services could have a material adverse effect on our business.


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including our Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO and VP Technology Operations, who have specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. The CIO/CISO has over two decades of experience directing security programs, controls, policies and operationalizing them specific to the healthcare industry. The VP Technology Operations has over a decade of experience managing the Cybersecurity Program, SOC2 audits and security controls and policies. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to help identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors".


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: bluebird bio, Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We evaluate cybersecurity risk as part of our overall enterprise risk management program, using systematic methodologies, reporting channels and governance processes that apply across the broader enterprise risk management program.


text: We require each third-party infrastructure and applications service provider that has access to our system to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including training on best practices for data privacy and security and safekeeping of patient information; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for information technology software service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product candidates' development programs and activities related to our approved products and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Head of Information Technology and our Head of Information Security are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Head of Information Technology's experience includes 25 years in managing information technology departments, including four years specifically in cybersecurity and five years with the Company. Our Head of Information Security's experience includes 13 years in managing information technology departments, including 12 years specifically in cybersecurity and seven months with the Company.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation, and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer ("CFO").


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: b. A security team principally responsible for managing (1) our cybersecurity risk assessment process, (2) our security controls, and (3) our response to cybersecurity incidents;


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating, and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a detailed discussion on the Company's cybersecurity related risks, see "Risk Factors" relating to information technology contained in Part 1, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.


text: Our VP of IT/CISO and CFO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO, Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer & Chief Operating Officer ("CFO & COO").


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. In accordance with the plan, material cybersecurity incidents are escalated to the Audit Committee of the Board of Directors. We design and assess our program based on the NIST Cybersecurity Framework.


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers and vendors performed throughout the year.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO & COO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO & COO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.


text: Our VP of IT/CISO and CFO & COO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team, which includes personnel with Certified Information Systems Security Professional ("CISSP") certification from the International Information System Security Certification Consortium, has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO & COO and our Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of the Information Technology Systems, or ITS, department who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business."


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee. The chairperson of our audit committee has received a certificate in Cybersecurity Oversight from Carnegie Mellon University.


text: Our head of the ITS Department, and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Our head of the ITS Department oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. We have set up processes by which our executive management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our head of the ITS Department and our executive management provide quarterly briefings to the audit committee of the board regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our head of the ITS Department provides periodic briefings to the board of directors on cybersecurity risks and activities.


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business.


text: c. The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; d. An incident response plan with procedures for responding to cybersecurity incidents;


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company."


text: Our head of the ITS Department and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: We maintain a comprehensive information and cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. We aim to continually strengthen our cybersecurity posture and protocols. We have invested in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. We provide no assurance that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. See "Risks Related to Our Business-Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients."


text: Cybersecurity Strategy and Risk Management Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate material vulnerabilities and the impact of cyber incidents.


text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.


text: e. Cybersecurity awareness training of our employees, and senior management; and f. A third-party risk management process for service providers, suppliers and vendors.


text: Incident Response and Recovery Planning While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur. We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders. Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident.


text: Training and Awareness We maintain a comprehensive information and cybersecurity awareness and training program for all employees and contracted resources. This includes a mandatory annual information security training, periodic simulations such as red teaming and tabletops, regular communications on relevant topics and policies related to data privacy, phishing, email security best practices, among others. We provide specialized security training for certain roles with access to sensitive data, including human resources or employees who regularly handle personal or sensitive information. Governance (Management Oversight and Engagement with the Board of Directors)


text: Cybersecurity is governed by our cross-functional apex body, the Management Security, Continuity and Privacy Forum ("MSCPF"), comprised of management representatives across all of our business units and enterprise functions such as Legal, Human Resource, Growth and Strategy, Compliance, Technology and Information Security. The MSCPF periodically reviews the strategy, policy, program effectiveness, standards development, cybersecurity risks, incident, and response preparedness.


text: The Audit Committee of our board of directors provides primary oversight and strategic guidance on Cybersecurity. The Audit Committee receives reports from management, typically on a quarterly basis, regarding our security risk management, including cybersecurity-related risks, vulnerabilities, policies, practices, and strategic initiatives. Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack. In 2022 and 2023, our senior management and board of directors completed cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.


text: We maintain a comprehensive cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. Cyber security is also an inherent consideration for our data and AI-led solutions. Specifically, there is a heightened focus on institutionalizing a Responsible AI framework to proactively identify and mitigate data protection and privacy risks. We aim to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. No assurance can be given that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors" under "Risks Related to Our Business–– Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to mitigate potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will comprehensively protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: Cybersecurity Strategy and Risk Management Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate vulnerabilities and the impact of cyber incidents.


text: Cyber security is an inherent consideration for our data and AI-led digital solutions. There is heightened focus on institutionalizing a Responsible AI framework that includes periodic Secure AI assessments to proactively identify and mitigate data protection and privacy risks.


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, PCI DSS for handling financial data, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, SOC 1 TYPE II and SOC 2 TYPE II, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.