text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.


text: We work with third parties from time to time that assist us from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.


text: Key elements of the Company's cybersecurity program are a formal Risk Management Strategy within ISMS, which is based on the ISO 27001 framework, and an Incident Response Plan, which establishes the process for the Company to identify, assess, mitigate, and remediate risks from cybersecurity events and incidents, including internal notification, breach reporting, and external communications protocols for material incidents. The Company responds to risks in a prioritized fashion. Remediation priority considers the risk likelihood and impact, cost, work effort, and availability of resources.

companyName: SIGMATRON INTERNATIONAL INC


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.

stage1Category: None/Other


text: Governance. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a Chief Information Officer, who reports to the CFO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

stage1Category: Management Role


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit committee of the board of directors for certain cybersecurity incidents.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents.

stage1Method: majority


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

stage1Category: Board Governance


text: Risk Management and Strategy We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks.


text: For information security and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide information security program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a Chief Information Officer, who reports to the CFO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: The Company also appointed a certified CISO who has significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the ERC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, review overall cybersecurity strategies and policies and to report on material cybersecurity risks.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Cybersecurity Risk Management and Strategy Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as a cybersecurity incident response team ("CSIRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of cybersecurity incidents to law enforcement and regulatory bodies, as appropriate.


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, DDoS and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the CSIRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises, and cyber incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.


text: Everest outsources certain business, technological and administrative functions and relies on third-party vendors to perform certain functions or provide certain services on its behalf. The Company negotiates contractual provisions to address identified cybersecurity risk(s) with third-party vendors. Third party security assessments of these vendors are also performed as part of the Company's third-party vendor management processes. The Company also maintains processes to oversee and manage material risks from cybersecurity threats associated with its use of third-party service providers.


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report, and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management, and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.


text: For the year ended December 31, 2023, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.

stage1Category: Strategy Integration


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. Accordingly, the Board of Directors of Group, through the RMC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight, as described more fully in our Proxy Statement, while management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk.


text: The Company also appointed a certified Chief Information Security Officer ("CISO") with significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the Executive Risk Committee ("ERC"), referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business of cybersecurity threats. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, report on material cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as an Incident Response Team ("IRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, distributed denial-of-service and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the IRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises and incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.


text: For the year ended December 31, 2024, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. The Company's Board, through its committees, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight. In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board's oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy. Management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk. In addition, the Company's subsidiary boards of directors may provide additional oversight.


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company and the effectiveness of the Company's cybersecurity program to the Board's Technology and Cyber Committee. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.


text: our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.


text: The Company has a formal third-party management policy that is incorporated into the overall ISMS. It includes procedures to identify, document, and address potential risks posed by third-party service providers of business-critical information systems owned or used by the Company ("Providers"). The Company assesses all Providers and will take additional steps to assess risk from Providers without an industry standard cybersecurity certification. The Company monitors the security posture of all Providers and reviews each Provider's security and service delivery performance at least annually.


text: In addition, the Company has adopted company-wide policies and procedures and conducts periodic employee training on a range of matters with cybersecurity risk management implications, including information security and acceptable use of technology policies.


text: As of the date hereof, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations, or financial condition. Nevertheless, there is no guaranty that the Company will not experience a cybersecurity threat or that the Company will successfully address an incident in the future. Also, notwithstanding the Company's vigilance, a cybersecurity incident at one of its suppliers or customers could materially adversely impact the Company. See Item 1A "Risk Factors – Technology Risks" for a discussion of cybersecurity risks.


text: The Board of Directors, directly and through the Audit Committee, actively engages in reviews of cybersecurity risks. The full Board of Directors meets with the Company's Vice President of Information Technology and Director of IT Infrastructure and Security at each of the Board's regularly scheduled meetings to discuss the Company's cybersecurity posture, including malicious activity experiences and vulnerabilities for potentially material cybersecurity threats and incidents. The results of disaster recovery exercises, penetration testing, and other external audits are also presented to the Board. The Audit Committee is responsible to review and evaluate the Company's cybersecurity and other information technology controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to threats. In addition to being represented on the oversight committee under the Incident Response Plan, the Audit Committee meets regularly with the Company's information technology leadership team and reviews with them any specific cybersecurity issues that could affect the adequacy of the Company's internal and disclosure controls.


text: The Company's information technology team is primarily responsible to manage the Company's information systems and assess and address all cybersecurity events that are internally detected or externally reported. Communication among Company personnel, including members of upper management when appropriate, is a high priority. An escalation process is in place under the Incident Response Plan to manage cybersecurity events depending on the severity of the risk of information system exploitation. Incidents of critical severity require immediate notice to members of an oversight committee comprised of upper executive and information technology officers, a member of the Audit Committee, and corporate counsel for evaluation and appropriate response. Incidents of medium or low severity are assigned to the appropriate personnel for response, mitigation and remediation.


text: The Company's information technology team is led by the Vice President of Information Technology. He has overall responsibility for developing, implementing, and maintaining the Company's technology strategy, systems, and operations. The current Vice President of Information Technology has been employed in the Company's information technology department for 10 years, previously as a Director of IT Development and a Business Analyst. He has a Master of Science in Information Systems Degree from DePaul University of Chicago. The leadership team also includes our Director of IT Infrastructure and Security, who is responsible for managing the Company's cybersecurity strategy, including management of firewalls, identity and access management, endpoint protection, and backups. The current Director of IT Infrastructure and Security has been employed in the Company's information technology department for 12 years, previously as a Technician and Network Administrator. He has a Master of Science in Information Management Degree from the University of Illinois.


text: Risk Management and Strategy The Company is committed to incorporating industry best practices in its cybersecurity program. Its Information Security Management System (ISMS), which the Company uses in the identification of cybersecurity risks and their classification and evaluation, is based on the National Institute Standards and Technology (NIST) framework and International Organization for Standardization (ISO) standards. The Company invests considerable resources in its information systems and personnel to safeguard its operations. It also regularly engages with external security consultants and auditors to validate its overall cybersecurity and risk management posture.


text: Key elements of the Company's cybersecurity program are a formal Risk Management Strategy within ISMS, which is based on the ISO 27001 framework, and an Incident Response Plan, which establishes the process for the Company to identify, assess, mitigate, and remediate risks from cybersecurity events and incidents, including internal notification, breach reporting, and external communications protocols for material incidents. The Company responds to risks in a prioritized fashion. Remediation priority considers the risk likelihood and impact, cost, work effort, and availability of resources.


text: evaluation of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business execution – establishment of a program to address.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: The Board of Directors, directly and through the Audit Committee, actively engages in reviews of cybersecurity risks. The full Board of Directors meets with the Company's Vice President, Information Technology and Operating Initiatives and Director of IT Infrastructure and Security at each of the Board's regularly scheduled meetings to discuss the Company's cybersecurity posture, including malicious activity experiences and vulnerabilities for potentially material cybersecurity threats and incidents. The results of disaster recovery exercises, penetration testing, and other external audits are also presented to the Board. The Audit Committee is responsible to review and evaluate the Company's cybersecurity and other information technology controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to threats. In addition to being represented on the oversight committee under the Incident Response Plan, the Audit Committee meets regularly with the Company's information technology leadership team and reviews with them any specific cybersecurity issues that could affect the adequacy of the Company's internal and disclosure controls.


text: The Company's information technology team is led by the Vice President, Information Technology and Operating Initiatives. He has overall responsibility for developing, implementing, and maintaining the Company's technology strategy, systems, and operations. The current Vice President of Information Technology and Operating Initiatives has been employed in the Company's information technology department for more than 10 years, previously as a Director of IT Development and a Business Analyst. He has a Master of Science in Information Systems Degree from DePaul University of Chicago. The leadership team also includes our Director of IT Infrastructure and Security, who is responsible for managing the Company's cybersecurity strategy, including management of firewalls, identity and access management, endpoint protection, and backups. The current Director of IT Infrastructure and Security has been employed in the Company's information technology department for 13 years, previously as a Technician and Network Administrator. He has a Master of Science in Information Management Degree from the University of Illinois.


text: Risk Management and Strategy Cybersecurity is an integral part of the Company's overall risk management program. The Company takes a comprehensive approach to cybersecurity and involving key stakeholders in oversight and decision-making processes.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The Company utilizes a risk-based, multi-layered information security strategy based on the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage risks from cybersecurity threats. This approach includes: (i) dedicated security operations center monitoring; (ii) network-based and host-based protections; (iii) a Privacy Council focused on privacy regulation adherence; (iv) privilege access management controls; (v) annual and ongoing information security training for all employees and targeted tabletop and other exercises; (vi) encryption of data, backup, recovery, and testing; (vii) regular internal and external audits against information security best practices; and (viii) benchmarking using external third parties. The Company employs these measures, and others, to protect its information assets and operations from internal and external cyber threats while ensuring business resiliency. It also aims to protect employee, customer and supplier information from unauthorized access or attack, as well as secure the Company's networks, systems, devices, products, and services.


text: The Company maintains cybersecurity policies, standards, and procedures, which include cyber incident response plans. These policies and procedures are continually refined to adapt to changes in regulations, identify potential and emerging security risks, and develop mitigation strategies and protocols for those risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities, and improve decision-making, prioritization, monitoring, and reporting. The Company also engages external parties, such as consultants, independent assessors, computer security firms, and risk management and governance experts, to enhance its cybersecurity oversight and to identify and mitigate risks from third-party service providers.


text: The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. See "Risk Factors - Risks Related to the Company's Business and Strategy" in Part I, Item 1A of this Annual Report.


text: The Board of Directors provides oversight of the Company's cybersecurity program. The Audit Committee, which consists of non-employee independent directors, receives updates from the Chief Information Officer ("CIO") on cybersecurity performance and recent industry trends at least quarterly. In addition to regular cybersecurity briefings from the Audit Committee, the Board also receives periodic, but at least annual, updates from management regarding cybersecurity, including prompt notice of cybersecurity threats or incidents that could materially impact the Company. The Board is informed about risk profile status, adversary assessments, training initiatives, cybersecurity projects, emerging global policies and regulations, cybersecurity technologies and best practices, cyber readiness, third-party assessments, mitigation efforts, and response plans.


text: The Company has a dedicated CIO and an Information Security Director who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, the Information Security Director, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and Information Security Director have cybersecurity expertise as well as extensive experience in information technology strategy, operations, incident response, and business continuity.


text: The Company also has a cross-functional Cybersecurity Incident Response Team consisting of senior-level management. This team is responsible for cybersecurity incident oversight and meets as needed, depending on the nature of an incident. The Company's internal audit team also provides independent assurance on the overall operations of the Company's cybersecurity program. The Company ensures that all employees, including part-time and temporary employees, undergo cybersecurity training and compliance programs at least annually.


text: Mark J. Costa, age 57, is Chair of the Eastman Chemical Company Board of Directors and Chief Executive Officer. Mr. Costa joined the Company in June 2006 as Chief Marketing Officer and leader of corporate strategy and business development; was appointed Executive Vice President, Specialty Plastics and Performance Polymers Head and Chief Marketing Officer in August 2008; was appointed Executive Vice President, Specialty Products and Chief Marketing Officer in May 2009; and became President and a member of the Board of Directors in May 2013. Prior to joining Eastman, Mr. Costa was a senior partner with Monitor Group, a global management consulting firm. He joined Monitor in 1988, and his experience included corporate and business unit strategies, asset portfolio strategies, innovation and marketing, and channel strategies across a wide range of industries. Mr. Costa was appointed Chief Executive Officer in January 2014 and named Board Chair effective July 2014. Mr. Costa also serves on the Board of Directors of International Flavors & Fragrances Inc.


text: William T. McLain, Jr., age 51, is Executive Vice President and Chief Financial Officer. Mr. McLain joined Eastman in 2000 and has served in high-level finance and accounting roles throughout the organization in the United States, Asia, and Europe. In 2011, Mr. McLain served as Director, Asia Pacific Finance, and in 2013 was appointed to International Controller. In 2014, Mr. McLain was appointed Corporate Controller until 2016 when he became Vice President of Finance. Prior to Eastman, Mr. McLain worked for the public accounting firm PricewaterhouseCoopers LLP. Mr. McLain was appointed to his current position effective February 2020.


text: Stephen G. Crawford, age 59, is Executive Vice President, Manufacturing and Chief Sustainability Officer, with executive responsibility for global manufacturing and engineering and the corporate sustainability strategy. Mr. Crawford joined Eastman in 1984 and held leadership positions of increasing responsibility in both the manufacturing and technology organizations. From 2007 until January 2014 he served as Vice President of Global R&D in the AM and AFP segments. He was appointed Senior Vice President and Chief Technology Officer effective January 2014, and Senior Vice President, Chief Technology and Sustainability Officer effective October 2019. Mr. Crawford was appointed to his current position effective October 2022.


text: Our management believes that our current systems and practice of implementing regular updates positions us well to support current needs and future growth. We use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Brad A. Lich, age 56, is Executive Vice President and Chief Commercial Officer, with responsibility for the AM segment, including the circular platform, as well as leadership of marketing, sales, supply chain, corporate strategy, and regional leadership. Mr. Lich joined Eastman in 2001 as Director of Global Product Management and Marketing for the Coatings business. Other positions of increasing responsibility followed, including General Manager of Emerging Markets of the former Coatings, Adhesives, Specialty Polymers, and Inks ("CASPI") segment. In 2006, Mr. Lich became Vice President of Global Marketing with direct responsibility for company-wide global marketing functions. In 2008, Mr. Lich was appointed Vice President and General Manager of the former CASPI segment, and in 2012 was appointed Vice President and General Manager of the AFP segment. In January 2014, Mr. Lich was appointed Executive Vice President, with responsibility for the AFP and AM segments and the marketing, sales, and pricing organizations. In March 2016, Mr. Lich assumed executive responsibility for outside-U.S. regional business leadership. Mr. Lich was appointed to his current position effective July 2016.


text: Kellye L. Walker, age 57, is Executive Vice President and Chief Legal Officer. Ms. Walker has overall leadership responsibility for Eastman's legal organization, including corporate governance, compliance and litigation management, as well as government affairs, product stewardship and regulatory affairs, global business conduct, global trade, global security, and the Company's global health, safety and environment organization. Before joining Eastman, Ms. Walker served as executive vice president and chief legal officer of Huntington Ingalls Industries. Prior to that, Ms. Walker's work experience includes serving as general counsel and chief legal officer at American Water Works Company, Diageo North America, and BJ's Wholesale Club. Ms. Walker was appointed to her current position effective April 2020.


text: Adrian J. Holt, age 54, is Senior Vice President and Chief Human Resources Officer. Mr. Holt is responsible for human resources strategy and services worldwide, which includes inclusion and diversity, total rewards, learning and leadership development, and global talent acquisition and management. Mr. Holt joined Eastman in 2016 as Vice President, Global Talent Acquisition and HR Client Support, Americas and EMEA. Prior to Eastman, Mr. Holt served as Chief Human Resources Officer for WireCo World Group and as Vice President of Corporate Human Resources for BASF North America. Mr. Holt was appointed to his current position effective May 2023.


text: Christopher M. Killian, age 54, is Senior Vice President and Chief Technology Officer. Dr. Killian has responsibility for Eastman's global technology and innovation organization. Prior to this position he served as Vice President of Technology for the AFP, CI, and AM segments. Dr. Killian joined Eastman in 1996 as a research chemist. During his career at Eastman, he has held various leadership positions in technology and the business including Director, Tritan Growth Platform early in his career. Dr. Killian was appointed to his current position effective June 2021.


text: Julie A. McAlindon, age 56, is Senior Vice President, Regions and Chief Supply Chain Officer. Ms. McAlindon has responsibility for overseeing global supply chain, sourcing and procurement, and regional leadership outside of North America. Ms. McAlindon also leads the transformation of Eastman, building the capabilities and culture required to support Eastman's strategy. Prior to this role, Ms. McAlindon was Chief Procurement Officer and Vice President, Transformation. Ms. McAlindon joined Eastman in 2016. Before joining Eastman, Ms. McAlindon was with Avient Corporation as senior vice president, designed structures and solutions; and vice president of marketing. Prior to that, Ms. McAlindon's work experience includes a variety of leadership positions with The Dow Chemical Company. Ms. McAlindon was appointed to her current position effective June 2021.


text: Travis Smith, age 50, is Senior Vice President with responsibility for the AFP segment. Mr. Smith joined the Company in December 1992 as a chemical engineer and has held various positions of increasing responsibility within manufacturing, the chemicals business, corporate innovation, specialty plastics, and advance materials during his career at Eastman. Mr. Smith assumed the position of Vice President and General Manager, Performance Films in July 2012 and for both Performance Films and Advance Interlayers in April 2018. Mr. Smith was appointed to his current position effective October 2022.


text: Michelle R. Stewart, age 52, is Vice President, Chief Accounting Officer and Corporate Controller. Since joining Eastman in 1995, Ms. Stewart has served in a number of positions with increasing responsibility in the financial organization. Prior to joining Eastman, Ms. Stewart worked for the public accounting firm KPMG Peat Marwick. Ms. Stewart was appointed to her current position effective October 2021.


text: Risk Management and Strategy Cybersecurity is an integral part of the Company's overall risk management program. The Company takes a comprehensive approach to cybersecurity, involving key stakeholders in oversight and decision-making processes.


text: Stephen G. Crawford, age 60, is Executive Vice President, Methanolysis Operations and Worldwide Engineering & Construction Transformation, with executive responsibility for overseeing methanolysis operations in Kingsport, and leading efforts to strengthen Eastman's engineering processes and disciplines and building capabilities for large projects. Mr. Crawford joined Eastman in 1984 and held leadership positions of increasing responsibility in both the manufacturing and technology organizations. From 2007 until January 2014 he served as Vice President of Global R&D in the AM and AFP segments. He was appointed Senior Vice President and Chief Technology Officer effective January 2014, Senior Vice President, Chief Technology and Sustainability Officer effective October 2019, and Executive Vice President, Manufacturing and Chief Sustainability Officer effective October 2022. Mr. Crawford was appointed to his current position effective January 2025.


text: The Company utilizes a risk-based, multi-layered information security strategy based on the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage risks from cybersecurity threats. This approach includes: (i) dedicated security operations center monitoring; (ii) network-based and host-based protections; (iii) a Privacy Council focused on privacy regulation adherence; (iv) privileged access management controls; (v) annual and ongoing information security training for all employees and targeted tabletop and other exercises; (vi) encryption of data, backup, recovery, and testing; (vii) regular internal and external audits against information security best practices; and (viii) benchmarking using external third parties. The Company employs these, and other measures, to protect its information assets and operations from internal and external cyber threats while ensuring business resiliency. It also aims to protect employee, customer and supplier information from unauthorized access or attack, as well as secure the Company's networks, systems, devices, products, and services.


text: The Company maintains cybersecurity policies, standards, and procedures, which include cyber incident response plans. These policies and procedures are continually refined to adapt to changes in regulations, identify potential and emerging security risks, and develop mitigation strategies and protocols for those risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities, and improve decision-making, prioritization, monitoring, and reporting. The Company also engages external parties, such as consultants, independent assessors, computer security firms, and risk management and governance experts, to enhance its cybersecurity oversight and mitigate third-party risks.


text: The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. See "Risk Factors - Risks Related to the Company's Business and Strategy" in Part I, Item 1A of this Annual Report.


text: The Board of Directors provides oversight of the Company's cybersecurity program. The Audit Committee, which consists of non-employee independent directors, receives updates from the Chief Information Officer ("CIO") on cybersecurity performance and recent industry trends at least quarterly. In addition to regular cybersecurity briefings from the Audit Committee, the Board also receives periodic, but at least annual, updates from management regarding cybersecurity, including prompt notice of cybersecurity threats or incidents that could materially impact the Company. The Board is informed about risk profile status, adversary assessments, training initiatives, cybersecurity projects, emerging global policies and regulations, cybersecurity technologies and best practices, cyber readiness, third-party assessments, mitigation efforts, and response plans.


text: The Company has a dedicated CIO and an Information Security Director who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, the Information Security Director, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and Information Security Director, with over 35 and 25 years of experience, respectively, have cybersecurity expertise, coupled with experience in IT strategy, operational management, incident response, and business continuity maintenance.


text: The Company also has a cross-functional Cybersecurity Incident Response Team consisting of senior-level management. This team is responsible for cybersecurity incident oversight and meets as needed, depending on the nature of an incident. The Company's internal audit team also provides independent assurance on the overall operations of the Company's cybersecurity program. The Company ensures that all employees, including part-time and temporary employees, undergo cybersecurity training and compliance programs at least annually.


text: Mark J. Costa, age 58, is Chair of the Eastman Chemical Company Board of Directors and Chief Executive Officer. Mr. Costa joined the Company in June 2006 as Chief Marketing Officer and leader of corporate strategy and business development; was appointed Executive Vice President, Specialty Plastics and Performance Polymers Head and Chief Marketing Officer in August 2008; was appointed Executive Vice President, Specialty Products and Chief Marketing Officer in May 2009; and became President and a member of the Board of Directors in May 2013. Prior to joining Eastman, Mr. Costa was a senior partner with Monitor Group, a global management consulting firm. He joined Monitor in 1988, and his experience included corporate and business unit strategies, asset portfolio strategies, innovation and marketing, and channel strategies across a wide range of industries. Mr. Costa was appointed Chief Executive Officer in January 2014 and named Board Chair effective July 2014. Mr. Costa also serves on the Board of Directors of International Flavors & Fragrances Inc.


text: William T. McLain, Jr., age 52, is Executive Vice President and Chief Financial Officer. Mr. McLain joined Eastman in 2000 and has served in high-level finance and accounting roles throughout the organization in the United States, Asia, and Europe. In 2011, Mr. McLain served as Director, Asia Pacific Finance, and in 2013 was appointed to International Controller. In 2014, Mr. McLain was appointed Corporate Controller until 2016 when he became Vice President of Finance. Prior to Eastman, Mr. McLain worked for the public accounting firm PricewaterhouseCoopers LLP. Mr. McLain was appointed to his current position effective February 2020.


text: Brad A. Lich, age 57, is Executive Vice President and Chief Commercial Officer, with responsibility for the AM segment, including the circular platform, as well as leadership of marketing, sales, supply chain, corporate strategy, and regional leadership. Mr. Lich joined Eastman in 2001 as Director of Global Product Management and Marketing for the Coatings business. Other positions of increasing responsibility followed, including General Manager of Emerging Markets of the former Coatings, Adhesives, Specialty Polymers, and Inks ("CASPI") segment. In 2006, Mr. Lich became Vice President of Global Marketing with direct responsibility for company-wide global marketing functions. In 2008, Mr. Lich was appointed Vice President and General Manager of the former CASPI segment, and in 2012 was appointed Vice President and General Manager of the AFP segment. In January 2014, Mr. Lich was appointed Executive Vice President, with responsibility for the AFP and AM segments and the marketing, sales, and pricing organizations. In March 2016, Mr. Lich assumed executive responsibility for outside-U.S. regional business leadership. Mr. Lich was appointed to his current position effective July 2016.


text: Travis Smith, age 51, is Executive Vice President, Additives & Functional Products, Manufacturing, WWE&C and HSE with responsibility for the global manufacturing and Worldwide Engineering and Construction ("WWE&C") in addition to leadership of the AFP segment and Health, Safety and Environment ("HSE"). Mr. Smith joined the Company in December 1992 as a chemical engineer and has held various positions of increasing responsibility within manufacturing, the chemicals business, corporate innovation, specialty plastics, and advance materials during his career at Eastman. Mr. Smith assumed the position of Vice President and General Manager, Performance Films in July 2012 and for both Performance Films and Advance Interlayers in April 2018, and was appointed Senior Vice President with responsibility for the AFP segment effective October 2022. Mr. Smith was appointed to his current position effective January 2025.


text: Ik Adeyemi, age 47, is Senior Vice President, Chief Legal Officer and Corporate Secretary. Ms. Adeyemi has leadership responsibility for Eastman's legal organization, which includes corporate governance, commercial law, litigation management and intellectual property, as well as responsibility for product stewardship and regulatory affairs, global business conduct, global trade compliance, and global public affairs. Before joining Eastman, Ms. Adeyemi served as vice president, corporate secretary, and associate general counsel of The Clorox Company. Prior to that, Ms. Adeyemi's work experience includes serving as the head of legal, corporate/M&A at BHP Billiton, and working at the law firms of Skadden, Arps, Slate, Meagher & Flom in the U.S. and White & Case LLP in London. Ms. Adeyemi was appointed to her current position effective September 2024.


text: Michelle H. Caveness, age 51, is Senior Vice President and Chief Manufacturing Officer overseeing global manufacturing and operations support. Ms. Caveness joined Eastman in 1996 and has held leadership roles of increasing responsibility in engineering, technology and manufacturing as well as on cross-functional business teams. Prior to her current role, she was vice president, Tennessee operations site leader and global operations support, leading one of the largest manufacturing sites in the United States and associated sites across the globe. Ms. Caveness was appointed to her current position effective January 2025.


text: Adrian J. Holt, age 55, is Senior Vice President and Chief Human Resources Officer. Mr. Holt is responsible for human resources strategy and services worldwide, which includes employee engagement, total rewards, learning and leadership development, and global talent acquisition and management. Mr. Holt joined Eastman in 2016 as Vice President, Global Talent Acquisition and HR Client Support, Americas and EMEA. Prior to Eastman, Mr. Holt served as Chief Human Resources Officer for WireCo World Group and as Vice President of Corporate Human Resources for BASF North America. Mr. Holt was appointed to his current position effective May 2023.


text: Christopher M. Killian, age 55, is Senior Vice President, Chief Technology Officer, and Sustainability Officer. Dr. Killian has responsibility for Eastman's global technology and innovation organization, and leadership of Eastman's sustainability strategy. Dr. Killian joined Eastman in 1996 as a research chemist. During his career at Eastman, he has held various leadership positions in technology and the business including Director, Tritan Growth Platform early in his career. Prior June 2021 Dr. Killian served as Vice President of Technology for the AFP, CI, and AM segments and was appointed Senior Vice President and Chief Technology Officer effective June 2021. Dr. Killian was appointed to his current position effective January 2025.


text: Julie A. McAlindon, age 57, is Senior Vice President, Regions and Chief Supply Chain Officer. Ms. McAlindon has responsibility for overseeing global supply chain, sourcing and procurement, and regional leadership outside of North America. Ms. McAlindon also leads the transformation of Eastman, building the capabilities and culture required to support Eastman's strategy. Prior to this role, Ms. McAlindon was Chief Procurement Officer and Vice President, Transformation. Ms. McAlindon joined Eastman in 2016. Before joining Eastman, Ms. McAlindon was with Avient Corporation as senior vice president, designed structures and solutions; and vice president of marketing. Prior to that, Ms. McAlindon's work experience includes a variety of leadership positions with The Dow Chemical Company. Ms. McAlindon was appointed to her current position effective June 2021.


text: Michelle R. Stewart, age 53, is Vice President, Chief Accounting Officer and Corporate Controller. Since joining Eastman in 1995, Ms. Stewart has served in a number of positions with increasing responsibility in the finance organization. Prior to joining Eastman, Ms. Stewart worked for the public accounting firm KPMG Peat Marwick. Ms. Stewart was appointed to her current position effective October 2021.


text: Our cybersecurity program is aligned with our company strategy and governance processes. Our program is designed to deploy and monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents through various means, including: • A security team responsible for monitoring our infrastructure and managing our cybersecurity risk assessment processes, our security controls, and response to cybersecurity incidents. • Periodic use of outside independent advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests, and to monitor and help identify potential cybersecurity incidents. • An incident response plan that includes procedures for identifying, evaluating and responding to cybersecurity incidents. • A training and awareness communication series addressed to our employees to help them identify potential cybersecurity threats and attacks. • A risk management process using independent third-party service providers that process and store data. We assess the risks from cybersecurity threats posed by such services.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – titled "Our business depends on numerous complex information systems. Any failure to maintain these systems, a network disruption, or breaches in data security could cause a material adverse effect on our business", which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The Strategy and Risk Committee of the Board of Directors oversees the Company's cybersecurity risks and strategy. A member of the committee has a bachelor and doctoral degrees relevant to and experience in cybersecurity and information technology trends. Management provides the Strategy and Risk Committee periodic reports on cybersecurity risks, risk mitigation in place and planned, and any material cybersecurity incidents. These reports are provided to our Board of Directors. If a material cybersecurity incident were to occur, the Audit Committee would oversee the financial reporting and disclosure and law compliance aspects.


text: Our program and team of cybersecurity professionals and resources is led and supervised by our Vice President of Information Technology, who has over 25 years of experience in information technology. To execute the program, we utilize internal and external technical experts in cybersecurity risk management, data and network security structures, incident response and security operations, and laws, regulation, and reporting requirements. Our cybersecurity team monitors the prevention, detection, mitigation, management, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment. As part of the program, our executive management team is regularly informed about the monitoring, prevention, detection, mitigation, management, and remediation efforts.


text: Cybersecurity Risk Management and Strategy The operation of our business is dependent on the secure functioning of our digital information systems and infrastructure. Our cybersecurity risk management program (our "Cybersecurity Program") has been designed to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our Cybersecurity Program based on published frameworks, including the National Institute of Standards and Technology, and routinely evaluate our program for ongoing adherence to those frameworks.


text: Our Cybersecurity Program is aligned with our company strategy and governance processes and is designed to deploy and monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents through various means, including: • A security team responsible for monitoring our infrastructure and managing our cybersecurity risk assessment processes, our security controls, and response to cybersecurity incidents; • Periodic use of outside independent advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests, and to monitor and help identify potential cybersecurity incidents; • An incident response plan that includes procedures for identifying, evaluating and responding to cybersecurity incidents; • A training and awareness communication series addressed to our employees to help them identify potential cybersecurity threats and attacks; • A risk management process using independent third-party service providers that process and store data. We assess the risks from cybersecurity threats posed by such services; and • An AI committee to set Company-wide policy and drive the safe use of AI technologies.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Our business depends on numerous complex information systems. Any failure to maintain these systems, a network disruption, or breaches in data security could cause a material adverse effect on our business", which is incorporated by reference into this Item 1C.


text: We sometimes engage external cybersecurity experts, or applications, to enhance our cybersecurity program. These serve to assist our internal cybersecurity team in mitigating cyber threats, in addition to monitoring and responding to potential cyber incidents.

companyName: CarParts.com, Inc.

ticker: PRTS


text: Cybersecurity Governance The Strategy and Risk Committee of the Board (the " Strategy and Risk Committee ") oversees the Company's cybersecurity risks and strategy, including our Cybersecurity Program. A member of the Strategy and Risk Committee has bachelor and doctoral degrees relevant to and experience in cybersecurity and information technology trends. Management provides the Strategy and Risk Committee with periodic reports on cybersecurity risks, risk mitigation in place and planned, and any material cybersecurity incidents. These reports are provided to our Board of Directors. If a material cybersecurity incident were to occur, the Audit Committee of the Board would oversee the financial reporting and disclosure and law compliance aspects.


text: Our Cybersecurity Program and team of cybersecurity professionals and resources are led and supervised by our Vice President of Information Technology, who has over 25 years of experience in information technology. To execute the Cybersecurity Program and promote compliance with applicable cybersecurity laws, regulations, and reporting requirements, we utilize internal and external technical experts in cybersecurity risk management, data and network security structures, and incident response and security operations. Our cybersecurity team monitors the prevention, detection, mitigation, management, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. As part of the Cybersecurity Program, our executive management team is regularly informed about the monitoring, prevention, detection, mitigation, management, and remediation efforts.


text: Cybersecurity Risk Management, Strategy and Governance We have implemented and maintain a risk management framework designed to identify, assess, and mitigate risks from cybersecurity threats. We assess our cybersecurity program ("CSP"), as part of our enterprise risk management program, against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and also use as a model the Center for Internet Security ("CIS") control framework's Implementation Group 2 ("IG2"). We perform annual assessments against NIST CSF benchmarks and focus on continuous improvement over those criteria. We use a list of factors based on business risk tolerance and external compliance requirements to determine if a business asset, data, system, process, or service provider should be included within the scope of the CSP. Prior to contracting with an outside vendor that hosts our data, such as Company information, or PII of our associates or residents, or that integrates with our systems, our policy is to conduct a cybersecurity risk assessment, which includes, as appropriate, a due diligence questionnaire completed by the vendor, a System and Organization Controls 1 ("SOC1") report from major vendors and a review of the vendor's scope of access to our IT systems and data.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: We also utilize third-party service providers to enhance our CSP, including engaging them annually to assess our CSP against the NIST CSF. We use one or more third-party managed security solution providers, who provide us with threat intelligence information and managed threat detection and response capabilities. We have also engaged a third party to assist with associate cybersecurity training. Additionally, we have engaged outside breach response legal counsel to assist the Company with cybersecurity counseling and incident response.


text: Although we have not experienced any material cybersecurity incidents, a future incident could materially affect us. We rely on information technology to process, transmit and store electronic information, and to manage or support a variety of business processes, including financial transactions, PII, and resident and lease data. Our business requires us and some of our vendors, to use and store PII and other confidential and sensitive information of our residents and associates. Any failure in or breach of our operational or information security systems or those of our vendors as a result of cyber-attacks or other security incidents, could materially adversely impact our operations and financial position, including disruption of our operations caused by an inability to access network systems, disclosure or misuse of confidential or proprietary information (including PII of our residents and/or associates), damage to our reputation, and/or potentially significant legal and/or financial liabilities and penalties.


text: You should carefully review Part I, Item 1A. "Risk Factors" of this Form 10-K for a discussion of the risks to the Company related to cybersecurity.


text: Our cybersecurity team is headed by our Senior Director of Cybersecurity, who has over 15 years of experience with IT and cybersecurity. The cybersecurity team reports to our Senior Vice President-Information Technology. The Senior Director of Cybersecurity and the Senior Vice President-Information Technology are part of, and work with, a management Cybersecurity Steering Committee ("CSC"), which meets regularly. The CSC works to ensure strategic alignment of the CSP with our business objectives and priorities. The CSC is chaired by the Senior Director of Cybersecurity and is composed of our Chief Financial Officer, Chief Operating Officer, General Counsel and senior members of our finance, legal, IT, risk management and internal audit teams. The Company has designated an incident response team and defined criteria to guide responses to cybersecurity incidents.


text: The Audit Committee of our Board of Directors provides Board-level oversight of risks from cybersecurity threats. In addition to providing periodic reports, at least annually the Senior Director of Cybersecurity and the Senior Vice President-Information Technology meet with the Audit Committee regarding cybersecurity risks and assessments and related Company policies and initiatives. The Audit Committee and management have adopted a policy that categorizes cybersecurity incidents and sets out incident escalation procedures to the full Board of Directors.


text: Risk Management and Strategy We have implemented and maintain a risk management framework designed to identify, assess, and mitigate risks from cybersecurity threats. We assess our cybersecurity program ("CSP"), as part of our enterprise risk management program, against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and also use as a model the Center for Internet Security ("CIS") control framework's Implementation Group 2 ("IG2"). We perform annual assessments against NIST CSF benchmarks and focus on continuous improvement over those criteria. We use a list of factors based on business risk tolerance and external compliance requirements to determine if a business asset, data, system, process, or service provider should be included within the scope of the CSP. Prior to contracting with an outside vendor that hosts our data, such as Company information, or PII of our associates or residents, or that integrates with our systems, our policy is to conduct a cybersecurity risk assessment, which includes, as appropriate, a due diligence questionnaire completed by the vendor, a System and Organization Controls 1 ("SOC1") report from major vendors and a review of the vendor's scope of access to our IT systems and data.


text: We utilize third-party service providers to enhance our CSP, including engaging them annually to assess our CSP against the NIST CSF. We use one or more third-party managed security solution providers, who provide us with threat intelligence information and managed threat detection and response capabilities. We have also engaged a third party to assist with associate cybersecurity training. Additionally, we have engaged outside breach response legal counsel to assist the Company with cybersecurity counseling and incident response.


text: Although we have not experienced any material cybersecurity incidents, a future incident could materially affect us. We rely on information technology to process, transmit and store electronic information, and to manage or support a variety of business processes, including financial transactions, PII, and resident and lease data. Our business requires us and some of our vendors to use and store PII and other confidential and sensitive information of our residents and associates. Any failure in or breach of our operational or information security systems or those of our vendors as a result of cyber-attacks or other security incidents could materially adversely impact our operations and financial position, including disruption of our operations caused by an inability to access network systems, disclosure or misuse of confidential or proprietary information (including PII of our residents and/or associates), damage to our reputation, and/or potentially significant legal and/or financial liabilities and penalties.


text: Our cybersecurity team is led by our Senior Director of Cybersecurity, who has over 15 years of experience with IT and cybersecurity. The cybersecurity team reports to our Senior Vice President-Information Technology. The Senior Director of Cybersecurity and the Senior Vice President-Information Technology are part of, and work with, a management Cybersecurity Steering Committee ("CSC"), which meets regularly. The CSC works to ensure strategic alignment of the CSP with our business objectives and priorities. The CSC is chaired by the Senior Director of Cybersecurity and is composed of our Chief Financial Officer, Chief Operating Officer, General Counsel and senior members of our finance, legal, IT, risk management and internal audit teams. The Company has designated an incident response team and defined criteria to guide responses to cybersecurity incidents.


text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is overseen by our Chief Information Security Officer ("CISO"), and it is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our CISO is a Certified Information Systems Security Professional and a Certified Ethical Hacker with more than 25 years of experience as a cybersecurity professional working extensively with critical infrastructure partners to reduce cyber risk within traditional and operation technology networks.

companyName: ALBEMARLE CORP

ticker: ALB


text: Our leadership team receives monthly updates on security operations and governance functions as part of monthly Information Security Council meetings led by our CISO. The Audit and Finance Committee of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our Chief Information Officer and CISO report on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on a periodic and as needed basis to the Audit and Finance Committee. The Audit and Finance Committee offers guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they become part of our continuous risk monitoring program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.


text: We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and regular phishing tests to raise awareness and response actions.


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity engineers who provide 24/7 network monitoring.


text: As further discussed in Item 1A. Risk Factors, a material cybersecurity incident could significantly increase the cost of doing business or otherwise adversely impact our financial results and condition. To date we have not had a cybersecurity incident that has had, or is reasonably likely to have, a material effect on our financial results or business operations; however, we monitor and work to continuously improve our cybersecurity program as threats become more frequent and sophisticated.


text: All our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We also conduct frequent drills and exercises of formal cyber response procedures and business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.


text: Albemarle Corporation and Subsidiaries In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.


text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is managed by our Cybersecurity Director and is overseen by our Chief Information Officer ("CIO"), who assumes responsibility for the Chief Information Security Officer ("CISO") role. The cybersecurity program is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our Cybersecurity Director brings extensive experience in cybersecurity, including service in U.S. Army Cyber Operations, and has led initiatives in threat management, risk mitigation, and security architecture to strengthen enterprise resilience. His expertise in incident response and security strategy ensures our cybersecurity program remains aligned with industry best practices and evolving cyber threats.


text: The Audit and Finance Committee ("AFC") of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our CIO reports on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on an as needed basis, but at least annually, to the AFC and executive leadership. The AFC and executive leadership offer guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.


text: All information assets are inventoried, classified, prioritized, and protected based on the respective risk, with appropriate cybersecurity controls applied to each. We have also implemented and maintain a documents management program which governs the classification, protection, and use of sensitive company data within the Albemarle environment.


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they are continuously monitored as part of our supply chain risk management program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.


text: Albemarle Corporation and Subsidiaries We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and periodic phishing tests to raise awareness and response actions.


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity analysts who provide 24/7 network monitoring.


text: Our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We conduct an annual incident response tabletop exercise as well as periodic exercises of formalized site business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.


text: In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.


text: Cybersecurity is among the most critical risks to the Company. For many activities important to its business, the Company depends on the confidentiality, integrity, and availability of information systems and data, some of which are provided or managed by third parties.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: Internal and third-party risks are reviewed, monitored, and managed by the Company's Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. The Company regularly engages third-party experts to assess the effectiveness of its cybersecurity programs. Biennially, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the NIST Cybersecurity Framework. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles. Periodic testing to ensure the security training is effective.


text: An external managed security services provider and industry-leading security tools continuously monitor the Company's systems and network for cybersecurity threats. The Company's cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. This is accomplished through mandatory annual security training for team members with access to Company email as well as tailored training for team members in more sensitive roles. Periodic testing ensures the training is effective. In addition, all team members have access to a variety of training materials on security topics through the Company's training management system.


text: Cybersecurity Risk Management Program Cybersecurity is among the most critical risks to the Company. For many activities important to its business, the Company depends on the confidentiality, integrity, and availability of information systems and data, some of which are provided or managed by third parties.


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover.


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles (and periodic testing to ensure the security training is effective).


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Vice President, Information Security and Privacy, briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: The Company's Information Security and Privacy program and teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us has not occurred or will not occur in the future. For additional information on risks from cybersecurity threats, please see Item 1A Risk Factors.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: We, like many organizations operating in the current climate, face significant cybersecurity threats. To date, no risks from cybersecurity threats or incidents have materially affected us, including our results of operations or financial condition. Notwithstanding our security awareness program, we may not be successful in identifying a cybersecurity threat or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could materially affect us. Additional information on the cybersecurity risks we face can be found in Item 1A. "Risk Factors—Technology, Data Security, Cybersecurity, Business Continuity and Disaster Recovery Risks" of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company takes an active, multi-faceted approach to cybersecurity, including adversarial engagement, under an "assume breach" philosophy premised on the continuous and ever-evolving nature of cyber threats and threat actors. The Company utilizes a cross-functional working group comprised of a Cybersecurity Department, which is responsible for overseeing cybersecurity for the Company's information systems; and plant operational technology (OT) personnel who are responsible for the security of plant OT. This group works in a cross-functional context due to the interconnectivity of these systems, as well as to collaborate about cybersecurity matters. The Company's Cybersecurity Department is headed by the Director of Global Cybersecurity, who reports to the Company's Chief Information Officer, and includes personnel located around the world who have cybersecurity training and skills in engineering, architecture, surveillance, analytics and administration. The Cybersecurity Department is responsible for setting the Company's cybersecurity policies, standards and benchmarks for its information systems, penetration testing and overseeing repairs of technical elements that fail testing. The Cybersecurity Department also conducts threat hunting within the Company's information systems and responds to threats. The Cybersecurity Department also engages certain third-party specialists to periodically review the Company's information systems and cybersecurity defenses, as well as to provide education about current and emerging threats, techniques and countermeasures. The Cybersecurity Department has also conducted cyber-attack simulation exercises with Company executive management and other leadership personnel for cyber-attack readiness. The Company's Director of Global Cybersecurity and Chief Information Officer also collaborate with our joint venture partner concerning cybersecurity matters for the DGD Joint Venture.


text: The Cybersecurity Department uses a system based on the critical security controls set forth by the Center for Internet Security, Inc. (CIS) as a benchmark and framework for its cybersecurity defenses, and has implemented cybersecurity policies and controls designed using the CIS controls framework. The Cybersecurity Department regularly implements updates and changes to its cybersecurity program to remain current and adapt to emerging cybersecurity risks; audits the cybersecurity program typically every three years; conducts targeted vulnerability testing; and assigns pertinent Company personnel as owners for governance and compliance. The Cybersecurity Department also provides cybersecurity training to Company employees.


text: The Company's Chief Financial Officer oversees a corporate risk analysis that organizes the Company's enterprise risks, including cybersecurity, into categories to assess the potential likelihood and impact of each, and to periodically review and update with the board of directors.


text: The Company also has an internal Cybersecurity Committee comprised of leadership across multiple internal functions that meets regularly to review, with the Director of Global Cybersecurity and the Chief Information Officer, active and thwarted cybersecurity incidents, systemic threats, attack trends and techniques, counter and preventative measures and defenses being implemented to enhance security. The meetings are also conducted for: ongoing awareness among Company leadership about cybersecurity threats and incidents; discussion of strategies for continuous improvement and associated capital needs; and review of oversight, governance and reporting of cybersecurity matters.


text: The Cybersecurity Department outsources several cybersecurity defense measures to utilize the know-how and tools, including artificial intelligence, of industry leading companies. The Cybersecurity Department also proactively consults with specialists in a variety of cybersecurity disciplines to review the Company's information systems for cyber risks and to provide advice for remediating areas of concern, as well as for implementing preventative measures to improve the Company's defenses.