text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.

companyName: Axogen, Inc.

ticker: AXGN

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: The Company's VP of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's VP of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The VP of Information Technology, Security and Business Intelligence holds a MBA from Boston University, a Master's degree in Electrical and Computer Engineering from Utah State University, and a Bachelor's degree in Electronics Engineering from Mumbai University. The Company's Information Technology team has specific professional certifications, and has over 10 years of experience with managing risks arising from cybersecurity threats.

stage1Category: Management Role

stage1Method: majority


text: The Company's VP of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the VP of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's IP; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

stage1Category: Risk Management Process


text: Risk Management and Strategy The Company's cybersecurity program focuses on the following areas: a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: h. Governance: The Board's oversight over the effectiveness of the Company's cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Vice President of Information Technology, Security and Business Intelligence and other members of the cyber team and management.


text: The Board, in coordination with the Audit Committee, oversees the effectiveness of management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.


text: The Company's Vice President of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The Vice President of Information Technology, Security and Business Intelligence holds a master's degree in business administration from Boston University, a master's degree in electrical and computer engineering from Utah State University, and a bachelor's degree in electronics engineering from Mumbai University. The Company's Information Technology team has specific professional certifications and has over 10 years of experience with managing risks arising from cybersecurity threats.


text: The Company's Vice President of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the Vice President of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Risk management and strategy Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC). Mitek uses guidance from standard bodies such as the NIST (Cyber Security Framework). Mitek also adheres to Service Organization Control (SOC2) security framework for securing customer data.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of Confidentiality, Integrity and Availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring: • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.


text: We assess and test our cybersecurity policies and practices on an annual basis. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess and test our cybersecurity measures.


text: We perform risk assessments on critical third-party service providers, software and other tools used in the Company's operations that may have the potential to create cybersecurity threats to our business.


text: We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure.


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors has ultimate oversight of the Company's risk management. Our Board receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises our cybersecurity personnel. Our Head of IT's experience includes over 25 years of design, implementation and management of cyber-security & information technology programs at various levels and organizations.


text: Cybersecurity Risk Management and Strategy The Company maintains a comprehensive information security program that is designed to identify, protect against, detect, and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Our Information Security Policy provides guidance on the requirements necessary to ensure the security of the Company's data, systems, and networks. It applies to all individuals who access IT resources or data processed by the Company. We use commercially reasonable efforts to follow industry standards and best practices, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, for our IT Security Incident Response Plan.


text: Our technology structures undergo an annual internal assessment to evaluate risk using the NIST Cybersecurity Framework; our assessment methodology and a thorough sampling of our results are validated annually by a third party. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.


text: Our IT Application Security Program includes reviews and assessments of security vulnerabilities and remediation. We use commercially reasonable efforts to update security systems regularly to protect against known vulnerabilities. We plan to perform vulnerability scans at least quarterly and penetration testing annually as well as after any significant infrastructure or application modification. Whitebox and blackbox security testing and manual penetration testing is performed to monitor security controls and defenses.


text: We have measures in place to protect the confidentiality, integrity and availability of franchise and customer information. Most personally identifiable information ("PII") handled by our restaurants is associated with payment cards, which are protected by an EMV chip reader that encrypts and tokenizes customer data, so it passes through our networks without retaining any personal information. We do not store any credit or debit card information from customers. All information is processed through a third-party firm. To maintain the safety and security of our customers' private payment information, we follow the Payment Card Industry Data Security Standard ("PCI DSS") to ensure our processes and systems are well equipped for proper data protection. Employees and third-party contractors with access to the Company's cardholder data environment ("CDE") or systems used to support the CDE, complete annual PCI awareness training. The Company's corporate restaurant employees also receive periodic security training on devices that capture payment card data.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls applied to financial business processes and supporting information systems are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements.


text: Cybersecurity Governance Our Board of Directors has charged the Audit Committee with oversight of the Company's identification, assessment, and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. Our Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") manage our network operations and software development across corporate and franchise locations. The Board of Directors receives regular updates from the CISO and CTO regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.


text: Our technology structures undergo an annual assessment to evaluate risk using the NIST Cybersecurity Framework. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.


text: All employees and third-party contractors with access to the Company's IT infrastructure must annually acknowledge that they have read and understand the IT User Acceptance Policy. Employees and contractors must also complete information security awareness training upon initial hire and annually thereafter.


text: We provide cybersecurity and information security compliance training to relevant employees at least once per year, tracking completion and requiring testing, and conduct simulated phishing campaign tests. We also provide additional specialized training for our security team and for employees with access to certain sensitive information.

companyName: SANMINA CORP

ticker: SANM


text: We recognize the importance of cybersecurity in achieving our business objectives, safeguarding our assets, and managing our daily operations. Accordingly, we integrate a process for identifying, assessing, and managing material risks from cybersecurity threats into our overall risk management system. The Audit Committee of our Board of Directors oversees all matters related to the security of and risks related to information technology systems and procedures, including cybersecurity policies and procedures.

companyName: EMCORE CORP


text: Our cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents, is managed by our Director, IT, who has worked in information technology and communications services for over 25 years. Our cybersecurity program incorporates an incident response plan to engage cross-functionally across the Company and report cybersecurity incidents to appropriate levels of management, including senior management and the Audit Committee or Board of Directors, based on potential impact. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging larger, well-known third-party service providers with significantly greater cybersecurity capabilities than we possess to monitor cybersecurity events and provide rapid responses to any critical events, including with respect to Managed Detection and Response (MDR) and Endpoint Detection & Response (EDR). Because we rely on their more significant expertise, our ability to identify and remediate weaknesses or vulnerabilities is limited to their services. We have engaged with third parties to assess our cybersecurity defenses biweekly and audit our cybersecurity program. We also conduct annual penetration tests of our information systems via independent third-party cybersecurity experts to evaluate our systems and provide remediation and recommendations to improve our cybersecurity program. We also conduct annual cybersecurity awareness training. We aim to incorporate industry best practices throughout our cybersecurity processes, and our cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. We are compliant with DFARS 252.204-7012 and DFARS 252.204-7020 and have a compliant NIST SP 800-171 self-assessment status.


text: As of the date of this report, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: While we believe our cybersecurity program is appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see Item 1A. "Risk Factors" in this report.

stage1Category: None/Other


text: Risk Management and Strategy Managing cybersecurity risks and securing our sensitive data and systems are a critical part of our business operations and of paramount importance to our organization. Consequently, our cybersecurity risk management program is integrated into our overall enterprise risk management (ERM) program.

companyName: CARROLS RESTAURANT GROUP, INC.


text: We have developed and implemented a cybersecurity risk management program that leverages the Center for Internet Security Critical Security Controls framework (CIS CSC). As part of our cybersecurity risk management program, we use multiple internal and external systems and tools to help monitor, identify, assess and manage material risks from cybersecurity threats and protect the Company's data and systems. We also monitor various sources to identify risks including, but not limited to, data from government entities, security vendors, and industry sources.


text: Our cybersecurity risk management program includes: • We leverage third-party cybersecurity vendors to test our systems, identify previously undiscovered risks in the environment and validate existing cybersecurity controls. We maintain a process to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors with access to our resources. • We educate our users on cybersecurity prevention tactics through monthly security awareness training and ongoing phishing tests. • Email is protected through multiple layers of security that cover all internal and external communication. • We have a robust patching and remediation process for our systems. We use a managed risk service to help detect and prioritize vulnerabilities found in the environment and track them for remediation. • We have a disaster recovery plan and controls designed to protect against business interruption, including multiple backups of our critical systems. • We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, access controls, extended detection and response, and event monitoring.


text: Cybersecurity Governance Our Board of Directors is responsible for oversight of risk management, including cybersecurity risks. The Audit Committee is updated quarterly on current cybersecurity events, metrics and other technology risks by our Chief Information Officer and Senior Director of Technical Operations & Security. The Audit Committee, in turn, provides the Board of Directors with updates regarding cybersecurity risks as it deems necessary or appropriate.


text: Our Internal Cybersecurity Team is comprised of the Chief Information Officer, Senior Director of Technical Operations & Security, and Information Security Manager. This team is responsible for managing efforts to assess, detect, prevent, mitigate and remediate cybersecurity risks, threats and incidents. This team has combined experience of 70 years in Information Technology, with over 35 years in managing cybersecurity programs, and hold various cybersecurity certifications. In addition, this team meets monthly with the IT leadership team to review current risks and trends, along with monitoring ongoing cybersecurity metrics.


text: While risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, a future cybersecurity incident could do so by, among other things, interrupting our operations, causing reputational harm and/or exposing us to litigation.


text: Enterprise Risk Management: CMS Energy and Consumers manage security risks, including cybersecurity risks, through a robust enterprise risk management program that includes people, processes, technology, and governance structures. The enterprise risk management program identifies risks that may significantly impact the business and informs the companies' risk-mitigation strategies. The enterprise risk management program is reviewed with the Board at least annually.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Executive Director of Security, is an integrated organization accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct exercises to practice their response to simulated events. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when issues occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant incidents and have invested in cybersecurity insurance to offset costs incurred from any such incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.


text: CMS Energy and Consumers have experienced no material cybersecurity incidents; however, future cybersecurity incidents could materially affect their business strategy, results of operations, or financial condition. For additional details regarding these and other uncertainties, see Item 1A. Risk Factors.


text: Management's Role: The Executive Director of Security has 25 years of information technology and security experience. To enhance governance, the Executive Director of Security reports to the Senior Vice President and Chief Customer Officer, who has extensive experience overseeing cybersecurity and has had executive oversight of the security function for nine years at CMS Energy and Consumers. Prior to joining CMS Energy, this officer served as Vice President of Business Technology at Pacific Gas & Electric Company, a non-affiliated company. The Executive Director of Security is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the Executive Director's team. Cyber incidents are managed using the companies' standard process for critical events. In the event of such incidents, the Executive Director of Security communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.


text: Oversee Third-Party Risk Dime has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank's Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM

stage1Category: Third-Party Risk


text: Board Oversight: As part of the Board's risk oversight process, senior management meets with the Board or Audit Committee at least twice annually to provide updates on and discuss cybersecurity. Such updates include a review of the companies' cybersecurity strategy, a scan of the threat landscape, and recent performance. Additionally, cybersecurity risks are included in the Audit Committee's risk oversight functions, which focus on operating and financial activities that could impact the companies' financial and other disclosure reporting. The Audit Committee's oversight involves reviewing and approving policies on risk assessment, controls, and accounting risk exposure. The Audit Committee also reviews internal audit reports regarding cybersecurity processes, and receives updates that focus on CMS Energy's and Consumers' cybersecurity program, mitigation of cybersecurity risks, and assessments by third-party experts. Of note, two members of the Board have extensive industry experience in cybersecurity and are on CMS Energy's and Consumers' Audit Committee.


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Vice President of Information Technology and Security and CIO, is accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct technical exercises to practice their response to simulated events as well as tabletop exercises to test that response using their incident command system, including leadership decisions. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when cybersecurity attacks occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant cybersecurity incidents and have invested in cybersecurity insurance to offset costs incurred from any such cybersecurity incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.


text: Management's Role: The Vice President of Information Technology and Security and CIO has over 25 years of information technology and security experience and, to enhance governance, reports to the Senior Vice President and General Counsel. The Vice President of Information Technology and Security and CIO is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cybersecurity team. Cybersecurity incidents are managed using the companies' standard process for critical events. In the event of such cybersecurity incidents, the Vice President of Information Technology and Security and CIO communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.


text: –Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess our processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with our use of third parties.

companyName: CEDAR FAIR L P


text: –Audit Committee of the Board of Directors: The Audit Committee is responsible for discussing the Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit Committee also provides guidance on long-term and short-term cybersecurity strategies.


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Information Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, we engage a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. We also maintain a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. We also provide training to our employees about cybersecurity, perform penetration testing at least annually, perform security incident preparedness activities at least annually, and perform an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of our contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of our managed security service provider and internal analysts to detect and identify threats. Lastly, we follow the National Institute of Standards and Technology ("NIST") Framework, which enables us to compare ourselves against the industry and manage dynamic cybersecurity risks.


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with one of our third-party providers, we have developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Information Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and our information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer, the Chairman of the Board of Directors and the Chair of the Audit Committee. The entire Board of Directors is notified of material or high risk incidents.


text: Risks from cybersecurity threats could materially affect our business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.


text: The SHUSA CISO is responsible to oversee, develop, and maintain the Information Security Program, including assessing risks and managing controls appropriate to the size and complexity of SHUSA and its subsidiaries. The SHUSA CISO is also responsible to inform the SHUSA Board of Directors, management, and staff of information security risks. The SHUSA CISO has relevant experience to effectively carry out this role, including 20 years of experience within the IT and information security fields.

companyName: Santander Holdings USA, Inc.


text: Risk Management and Strategy The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board, primarily through its Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Company's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Management IT Examination Handbook, FFIEC Cybersecurity Assessment Tool, and GLBA 501(b). In general, the Company addresses cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management department. The process provides awareness and collaboration across internal teams including Information Security and Business Continuity. A Technical Requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. This process is aimed at advocating the necessary security, infrastructure, and application standards or controls so that information systems and the third party have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board annually.


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Committee reviews and approves the Information Security Program and receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Board Risk Committee related to information cybersecurity.


text: Our Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate.


text: To our knowledge, neither cybersecurity threats, nor the results including as a result of any previous cybersecurity incidents have materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors - Risks Related to Out Business.


text: The Risk Committee, in collaboration and coordination with the Board of Directors and its other committees, is responsible to review risks related to information security, cybersecurity, and technology, as well as the steps taken by management to control for such risks.


text: As one of the elements of the Company's overall enterprise-wide risk management approach, our Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management program. The process provides awareness and collaboration across internal teams including, but not limited to, Information Technology, Information Security and Business Continuity. In addition to ongoing monitoring of select vendors, a review is conducted on new or significantly changed third parties, applications, and technology to ensure that systems and third parties meet certain baseline requirements. This process is used to identify and monitor risks in vendor arrangements and assists management in establishing appropriate risk responses. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Risk Committee receives periodic presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Risk Committee related to information cybersecurity.


text: Our Chief Operating Officer ("COO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans, including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the COO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate. We believe our Board and management, including the Chief Operating Officer, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, internal and external training, and periodic discussions with consultants and peers with applicable knowledge and expertise. In addition, members of our management hold varying levels of relevant cybersecurity certifications.


text: We organize roles and responsibilities for risk management into a three-LOD model. Our Information Security Program is a first LOD function and has responsibility for the primary management of the risks that emanate from first LOD activities. Each first LOD unit owns, identifies, measures, controls, monitors, and reports risks originated through its activities. The second LOD which reports to the Chief Risk Officer, independently monitors risk exposures, implements comprehensive and appropriate risk controls, and reviews and challenges first LOD units on their activities to ensure that risk is managed in line with agreed frameworks and risk appetite levels. The third LOD provides independent assurance to the Company's Board of Directors and senior management by assessing the quality and effectiveness of the processes and systems of internal control, risk management and risk governance, compliance with applicable regulations, and the reliability and integrity of financial and operational information. The third LOD reports to the Chief Audit Executive and to the Board of Directors, independent of any other function or unit in the Company.


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Science and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Identify, Protect, Detect, Respond and Recover, and Foundational – with key controls implemented in each of these pillars. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of threat intelligence, privacy and regulatory compliance, asset management, risk management, and the business environment. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to limit or contain the impact of a potential cybersecurity event consisting of access management, data security, protective technology, network security, and vulnerability management. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of anomalous activities or events, security continuous monitoring, and vulnerability detection. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event. • Foundational covers the essential aspects of the information security program consisting of governance, awareness and training, third-party information security, security architecture, change management, strategy and standards, and talent management.


text: An internal cyber risk assessment is performed annually to ensure that our cybersecurity program and its processes and controls adequately mitigate material cybersecurity threats and risks. As part of the program, we proactively identify IT assets, systems, and information and assess their risk and protection levels to detect and remediate any potential weaknesses by using vulnerability scanning, penetration testing and simulations of real cyberattacks. The Company also engages an external third party to independently validate the organization's maturity with regard to managing cybersecurity risks and that it meets regulatory and industry standards with respect to managing those risks.


text: The Company has multiple other enterprise risk programs and assessments which include information security as an integrated component that allow the Company to identify, assess, and manage risk. Processes and controls documented as part of these programs are tested as part of the enterprise-wide risk control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, including risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third Party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed through an enterprise risk and issue management process.


text: As of the time of filing, there are no known cybersecurity threats that have materially affected, or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.


text: The SHUSA Board of Directors and its Risk Committee oversee the development, implementation, and maintenance of the Company's Information Security Program. Annually, the CISO provides the Board of Directors with a report that includes the cyber risk assessment process, risk management and control decisions, results of testing, third-party service provider arrangements, security breaches or violations (if any), and adjustments to the program. In addition, the CISO provides the Board Risk Committee with annual cyber awareness reporting, in which cybersecurity risk and internal mitigating controls are reviewed.


text: Cybersecurity Risks Dime considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by Dime and third-party service providers, are critical to business operations and therefore require appropriate risk management.


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committees chaired by SHUSA's Chief Operational Risk Officer and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and an Internal Audit team among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.


text: Risk management and strategy We have established processes to identify, assess, and manage material cybersecurity risk, which are fully integrated into our overall enterprise risk management system and processes. These processes include risks related to our use of third-party service providers.


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Standards and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Govern, Identify, Protect, Detect, Respond and Recover – with key controls implemented in each of these pillars. • Govern covers the essential aspects of the information security program consisting of risk management strategy, third-party and supply chain risk management, roles and responsibilities, strategy, policies, and standards. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of asset management, risk assessments including vulnerability identification and continuous improvements from testing and evaluations. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to protect the organization against potential cybersecurity events and consists of access management and authentication, data security, awareness and training, platform security, and infrastructure resilience including network defenses. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of adverse activities or events analysis, and security continuous monitoring. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event.


text: The Company has multiple enterprise risk programs and assessments that include information security as an integrated component and allow the Company to identify, assess, and manage risk. Processes and controls documented through these programs are tested as part of the enterprise-wide risk and control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, which have defined risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third-party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed via an enterprise issue management process.


text: As of the time of filing, there are no known cybersecurity threats that have materially affected or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.


text: The SHUSA CISO is responsible to oversee, develop, and maintain the Information Security Program, including assessing risks and managing controls appropriate to the size and complexity of SHUSA and its subsidiaries. The SHUSA CISO is also responsible to inform the SHUSA Board of Directors, management, and staff of information security risks. The SHUSA CISO has relevant experience to effectively carry out this role, including 20 years of experience within the IT and information security fields.


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committee chaired by SHUSA's Head of Technology & Operations and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and Internal Audit representatives among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.


text: Risk Management and Strategy Cybersecurity is a dynamic and constantly evolving field. We are committed to continuously improving our cybersecurity posture by staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessments and incidents. Our goal is to maintain a resilient cybersecurity framework that protects our assets and supports our long-term business objectives.

companyName: VAIL RESORTS INC

ticker: MTN


text: We manage risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by our Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. Management has created an information security program, which is comprised of a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of data created, collected, stored, and used to operate our business.


text: We identify, assess, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third party service providers and other companies with whom we do business. As part of our cybersecurity program, team members receive cybersecurity training and participate in awareness programs including phishing simulation exercises and reminders, and programming and events during Cybersecurity Awareness Month. We also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: We maintain an Incident Response Plan ("IRP"), which applies to information security incidents. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, as well as the communication protocol of such incidents to senior management and other key stakeholders pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.


text: Board oversight of cybersecurity risk management is supported by the Audit Committee, which regularly reviews internal reports from management with respect to information technology and cybersecurity issues, and interacts with our enterprise risk management function and our Chief Information Officer ("CIO") regarding major cybersecurity risk areas and recommended actions to address such risks.


text: The processes by which the relevant members of management are informed about and manage the prevention, detection, mitigation, and remediation of cybersecurity incidents include conducting cybersecurity risk assessments, establishing network access controls, creating a vulnerability management program, and continuous monitoring for threats.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Cybersecurity Governance Our Information Security and Compliance teams, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that our CIO and our Vice President of Information Security, in coordination with our Information Technology Senior Leadership Team, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each quarter, the Audit Committee discusses our approach to cybersecurity risk management with our CIO, and at least annually, or more frequently as necessary, our CIO meets with the Board to discuss cybersecurity risk management.


text: Our CIO and our Vice President of Information Security are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across company. Our CIO serves as Chair of our Cybersecurity Incident Materiality Assessment Council and works in coordination with the other members of our Executive Committee.


text: Our CIO has served in various roles in information technology and information security for over 27 years, including in technology leadership roles such as Chief Information Officer, Vice President Business Technology, Vice President Business Information Services, Senior Director of Mountain Technology, Director of Resort Application Development, and Director of Order Management Systems leadership roles for large public companies. Our CIO holds a B.B.A. in Management Information Systems and Accounting from University of Oklahoma.


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security holds several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.


text: Our CIO and Vice President of Information Security, in coordination with our Legal, Internal Audit, and Compliance teams, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our security IRP. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CIO, the Vice President of Information Security, and our Cybersecurity Incident Materiality Assessment Council monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: The Audit Committee reviews our cybersecurity management strategy and initiatives on a regular basis and oversees the management of risks from cybersecurity threats, including the policies, processes, and practices implemented by the Company to address such risks. The Audit Committee also routinely receives reports on the cybersecurity landscape, regulatory requirements, industry standards, and emerging threats. Prompt and timely information regarding any significant cybersecurity incident as specified in our IRP, including ongoing updates as the incident unfolds and until it has been addressed, are also provided to both the Board and the Audit Committee.


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future.


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security has earned several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.


text: The Company is not aware of any current cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for additional information regarding the risks we face from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013, ISO/IEC 27017 and the SOC 2 Type 1 certifications, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk oversight strategy and utilizes common reporting channels and governance processes that apply across other risk areas. We have a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for managing our cybersecurity processes, strategy and controls. Certain members of our Information Security team hold cybersecurity certifications, including the Certified Information Systems Security Professional ("CISSP") and the Certified Information Systems Auditor ("CISA") designations.


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating, for certain service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and our Board committees assist with certain aspects of risk oversight. With respect to cybersecurity risk, our Board of Directors shares certain of the oversight responsibility and processes with the Audit Committee of the Board of Directors ("Audit Committee").


text: The Audit Committee, comprised entirely of independent directors, reviews and discusses with management our guidelines, policies and practices regarding risk assessment and risk management as they relate to our financial condition, and oversees our financial risk exposures, including planning regarding business continuity and cybersecurity. In addition, the Audit Committee oversees our annual enterprise business risk assessment, which includes the review of cybersecurity risks we face and our associated risk mitigation measures, and receives semi-annual reports from management on cybersecurity matters, including areas such as threat intelligence, major cybersecurity risk areas, regulations and cybersecurity incidents. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the Board of Directors regarding its activities related to cybersecurity. In addition, the Board of Directors also directly receives reports from management on our cybersecurity risk profile and on the performance of our data privacy and cybersecurity risk management program, semi-annually in alternating quarters with the Audit Committee.


text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 25 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.


text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013 and ISO/IEC 27017:2015 certifications, and seek to achieve the SOC 2 Type 1 and Type 2 attestations, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test (including penetration test) or otherwise assist with certain aspects of our security controls and processes; • global security operations center services through certain service providers; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating (using common vulnerability scoring system or similar methodologies based on industry practices), for certain service providers, suppliers and vendors.


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. Our CISO has more than 20 years of experience managing information security for media/entertainment, technology, retail and financial services companies. While at Paramount, our CISO oversaw the integration of Viacom's and CBS's information security programs and our transformation to a cloud-centric, global streaming provider.

companyName: Paramount Global


text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, including information technology, information security, product security, physical security and legal, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 30 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.


text: Our information security program, the framework for how we assess, identify and manage risks from information security and cybersecurity threats, is designed in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverages the International Organization for Standardization 27001 framework. Cybersecurity risk is integrated into our overall strategic risk management ("SRM") program, which evaluates key risk areas across Paramount by a cross-functional group of risk owners, in close coordination with members of senior management.


text: Our information security program is overseen by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, the CISO and members of the information security team timely notify members of senior management, including our CTO and General Counsel, and under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and CISO, which include information on the broader information security and cybersecurity threat landscape, the information security program's strategic priorities, progress made in respect of those priorities and summaries of cybersecurity incidents and related remediation efforts. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.


text: We have experienced cybersecurity attacks in the past and may experience attacks in the future, potentially with more frequency or sophistication. Although past attacks have not materially impacted our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors — Risks Relating to Business Continuity, Cybersecurity and Privacy and Data Protection."


text: Our information security program is overseen by our Chief Technology Officer ("CTO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers, partners and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, members of the information security team notify members of senior management as soon as reasonably practicable, including our CTO, Acting General Counsel and, under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and senior members of the information security team, which include information on cybersecurity incidents and related remediation efforts, the broader information security and cybersecurity threat landscape, the information security program's strategic priorities and progress made in respect of those priorities. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.