text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.

companyName: SOUTHWESTERN PUBLIC SERVICE CO

secItem: Item 1C


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.


text: Cybersecurity Risk Management and Strategy We maintain an enterprise-wide approach to risk management through which we identify, manage and mitigate significant risks, including those related to our information systems. Our cybersecurity risk management program, which applies to our global operations, focuses on our people, processes and technology, and is designed to secure our information systems by preventing, detecting and responding to current and emerging cybersecurity threats.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our employees are a key element of our cybersecurity risk management program. All of our employees are required to adhere to our cybersecurity practices, and undertake routine training to raise awareness and reinforce safe practices. Our training program includes bi-annual online training courses, group tabletop exercises, phishing and malicious email simulations, and information security bulletins. We also maintain policies that govern, and provide specific guidance to employees regarding how they may use our information systems.


text: Another key element of our cybersecurity risk management program is our use of processes and technologies to create information security safeguards and controls, and target specific users or business needs. Our processes and technologies include firewalls, email security software and encryption, endpoint detection and response, access controls, backup and recovery procedures, system patches and updates, vulnerability scanning, penetration testing by third party vendors, incident response procedures, and internal and external audits of our information systems.


text: Through these internal and external assessments, we continuously identify areas for remediation and opportunities to improve the security of our information systems, including by evaluating our program against industry standards and best practices, such as the Cybersecurity Framework established by the National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls established by the Center for Internet Security. We also track key performance indicators that we believe are indicative of the effectiveness of our cybersecurity risk management program.


text: For additional information related to cybersecurity risks that could have a material and adverse effect on our business, financial condition or results of operations, see "Our operations could be adversely affected by interruptions or breaches in the security of our computer and information systems" in Item 1A of this Report.

stage1Category: None/Other


text: Cybersecurity Governance The Audit Committee of our Board of Directors oversees the adequacy and effectiveness of our internal controls, policies and procedures regarding cybersecurity, information security and data protection, and compliance with applicable laws and regulations concerning privacy. Our Chief Information Officer ("CIO"), in turn, is responsible for managing the Company's cybersecurity risk management program and incident response procedures. On a quarterly basis, and more frequently as circumstances warrant, our CIO briefs the Audit Committee on our cybersecurity risks, our strategies for preventing, detecting, responding to and mitigating such risks, including the effectiveness of our incident response procedures, and our information security controls. Our CIO has extensive knowledge and expertise regarding our information systems and security, having served in a variety of senior information technology positions across our organization for more than thirty years, and as an executive officer of the Company since 2006.

stage1Category: Management Role


text: Additionally, our CIO leads an incident response team ("IRT"), charged with the on-going management of our cybersecurity program. This team is responsible for the prevention, mitigation, detection and remediation of cybersecurity risks and incidents affecting our operations pursuant to our incident response procedures. The IRT is composed of information security professionals, who collectively bring decades of relevant information security and cybersecurity experience to their roles. In the event that a cybersecurity incident is detected, the IRT performs a multi-factor, risk-based assessment to determine the appropriate level of response. Depending upon the results of the assessment, including the nature and magnitude of the event, our incident response procedures provide for oversight and management of an incident by the IRT, under the direction of the CIO, or, in the event of escalation, under the direction of the executive officers of the Company, with reporting to and oversight by the Audit Committee.

stage1Method: majority


text: Chevron's business and proprietary information, information technology (IT) and operational technology (OT) networks are essential to its success. The company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by identifying and appropriately managing and mitigating risks while ensuring business resiliency. This program is integrated within the company's Enterprise Risk Management (ERM) process, which is the company's systematic approach to identifying, managing and assessing major risks and safeguards, including cybersecurity risks. Chevron uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.

companyName: CHEVRON CORP

ticker: CVX


text: The company's worldwide team of cybersecurity professionals undertakes a range of preemptive activities to protect its people, assets and reputation globally. The company also leverages internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. The company seeks to remove exploitable weaknesses in its systems or devices before they become a threat. Chevron security experts use automated threat intelligence feeds to increase vulnerability awareness, taking action to mitigate the highest risks. The company's cybersecurity guardrails, which are high-level design requirements expected to be built into any new digital solutions being deployed, are also updated on an ongoing basis to align with changes in industry standards and the evolving threat environment.


text: Chevron's cyber risk management process includes testing and risk assessments of technologies, third-party suppliers, and its IT and OT networks. These assessments ensure that our focus is on the highest priorities to maintain the security of our company's assets. To further protect the company's systems and data, Chevron's cybersecurity organization has threat intelligence capabilities to monitor security breaches impacting third-party suppliers. As third-party risks increase, the company's approach to third-party supplier risk management and qualification continues to evolve, including the ongoing expansion of its current supplier risk management program beyond IT vendors to other high-risk, third-party vendors.


text: Chevron's Chief Information Security Officer (CISO) leads a global cybersecurity team that operationalizes and manages the company's cybersecurity program and strategy. Chevron's CISO has more than 20 years of cybersecurity experience and is responsible for providing a single and consolidated view of the company's enterprise cybersecurity risk. Before joining Chevron, he held a leadership role in cyber threat analysis with the U.S. Department of State's Bureau of Diplomatic Security. Chevron's CISO reports to the Chief Information Officer (CIO) who is responsible for Chevron's broader IT program, including resiliency and ability to remediate and recover from a cybersecurity incident to minimize impacts to the business and operations. He has more than 30 years of experience in IT and the oil and gas industry.


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. Chevron's CISO regularly receives cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The CISO has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.


text: The company's dedicated cyber risk organization meets regularly with business units to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the enterprise. Chevron has invested in broad cybersecurity awareness and required training to educate those with access to Chevron's networks on company policy and best practices. The company conducts regular phishing tests to train and assess its workforce's ability to identify malicious emails.


text: Chevron's Corporate Audit Department has a dedicated team responsible for IT and information security (including cybersecurity) audits. Chevron also leverages external resources to reinforce its cybersecurity capabilities. On a regular basis, external consultants provide a maturity assessment of the company's cybersecurity program.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Information technology failures and data security breaches could harm our business," which discussion is included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: TEJON RANCH CO

ticker: TRC


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises, including an expansive cybersecurity exercise in 2023, to test and improve response plans.


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process. In 2023, the Audit Committee hosted an external expert to discuss cybersecurity and digital risk management topics.

stage1Category: Board Governance


text: To date, the company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition; however, the company has experienced and will continue to experience cyber incidents of varying degrees. Despite the cybersecurity measures that the company is taking to mitigate such risks, there can be no guarantee that such measures will be sufficient to protect the company's systems, information, intellectual property and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the company or its results of operations or financial condition or cause reputational or other harm to the company. Refer to Item 1A. Risk Factors on pages 21 through 22 for further discussion of cyberattacks and the associated risks to Chevron's business.

stage1Category: Strategy Integration


text: Chevron's Chief Information Officer (CIO) oversees Chevron's broader IT program, which includes the company's cybersecurity program and its ability to remediate and recover from a cybersecurity incident to minimize business and operational impacts. Chevron's CIO joined Chevron in 2024, bringing more than 20 years of experience leading global innovation initiatives in digital, data, full supply chains, vehicle commerce, energy, and IT operations for technology and automotive companies. Chevron's Chief Information Security Officer (CISO) reports to the CIO and leads a global cybersecurity team.


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, such as engaging an independent third party to conduct regular assessments of its cyber security maturity against industry best practice frameworks and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Audit Committee as part of the CISO's regular briefings, and in turn the Audit Committee Chair regularly updates the Board on such briefings.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. The cybersecurity organization provides the IT leadership, which includes Chevron's CIO, with regular cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The leadership of the cybersecurity organization has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises to test and improve response plans.


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process.


text: The Company has implemented a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.


text: Board of Directors The Board has delegated the primary responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews compliance and disclosure control procedures for cybersecurity matters. Members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and the Senior Vice President, General Counsel and Secretary (the "General Counsel"), provide regular updates to the Audit Committee regarding data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them. The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives briefings from management and third-party cybersecurity advisors on the Company's cybersecurity program, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee and the full Board.


text: Additional information about our risk management governance and structure, including enterprise risk management, as well as information technology specific risk management and governance, is provided under the "Governance and Structure" and "Information Technology Risk Management" sections of Risk Management included in Item 7, Management's Discussion and Analysis in this Form 10-K.

companyName: STATE STREET CORP

ticker: STT


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that Senior Risk Council members have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management process overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business. The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.


text: The Company's CISO is the member of management principally responsible for overseeing the Company's cybersecurity risk management program, in coordination with the CIO and other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management. The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure. She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley. The CISO reports directly to the CIO who in turn reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with the Company's legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Risk Management & Strategy The Company has adopted information security policies that establish requirements and responsibilities with respect to the protection of the Company's interests and information technology assets against loss, improper disclosure and unauthorized modification. The Company regularly educates and shares best practices with its employees to raise awareness of cybersecurity threats and the Company's information security program, which the Company believes creates a culture of shared responsibility for the security of sensitive data and the Company's network. All employees are regularly offered information security and protection training, including specialized training for employees exposed to sensitive information, which prompt them to certify their awareness of and compliance with applicable information technology policies and additional technology and cybersecurity standards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, encryption intrusion prevention and detection systems, anti-malware functionality, data monitoring, endpoint extended detection and response, architecture controls, access controls and ongoing vulnerability assessments.


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board and the Audit Committee when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees or contractors and service providers).


text: We address third-party cybersecurity risks presented by our use of third-party software, service, data and technology providers, including cloud-based services, and proactively evaluate the cybersecurity risk of third parties using multiple evaluation factors which are aligned with our contracting and vendor selection processes. We actively work with internal partners to assess and implement methods of transferring risk to appropriate parties.

companyName: TYSON FOODS, INC.

ticker: TSN

stage1Category: Third-Party Risk


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Audit Committee as appropriate.


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term.


text: The Company deploys measures which leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures in order to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.


text: The Company has a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.


text: Board of Directors The Board of Directors (the "Board") has the primary responsibility for oversight of cybersecurity matters. This responsibility had been previously delegated to the Audit Committee. The Board regularly reviews compliance and disclosure control procedures for cybersecurity matters. The Board also receives quarterly briefings from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and Senior Vice President, General Counsel and Secretary (the "General Counsel"), as well as third-party cybersecurity advisors, on the Company's cybersecurity program, including data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board.


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Operating Officer ("COO"); Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that these senior management personnel have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management processes overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business.


text: The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.


text: The Company's CISO is the member of management principally responsible for overseeing the Company's cybersecurity risk management program, under the CIO's leadership and in coordination with other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management. The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure. She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley. The CISO reports directly to the CIO who in turn reports directly to the COO. The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with the Company's legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. The Information Technology organization, led by the CIO, is responsible for the implementation of cybersecurity technical controls. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Network Defense Architect, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees, contractors and service providers).


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Board as part of the regular briefings provided by the CIO and CISO.


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Board as appropriate.


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term. As of the date of this report, the Company has not experienced a cybersecurity incident or third-party information security breach in the last three fiscal years that has materially affected the Company, including its business strategy, results of operations or financial condition.


text: Stewart recognizes the importance of protecting our customers', employees' and partners' confidentiality and data integrity. To that end, we continuously and methodically evaluate cyber risks, how they evolve and how they may affect us. We utilize considerable resources in our cybersecurity efforts, and we are committed to continuous cybersecurity education and training across our entire organization as well as our partners and customers. We continuously evaluate and monitor third-party risk relating to the protection of sensitive data. Our program focuses on a broad area of security domains, including, but not limited to: risk management, data protection, incident response, identity and access management, threat and vulnerability management, disaster recovery, business resiliency, and continuity.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Company deploys measures which it believes leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.


text: The information required by this Item is provided under "Information Technology Risk Management" included in Item 7, Management's Discussion and Analysis in this Form 10-K, and is incorporated herein by reference.


text: Cybersecurity risk is an integral part of our enterprise risk management and is managed as part of our overall information technology risk under the direction of our Chief Information Security Officer (CISO). Our CISO is an executive vice president at State Street and is responsible for our overall information security program.


text: Before joining State Street, our CISO worked at a global information technology firm for more than 10 years, holding various positions, including senior vice president and chief security officer, and, prior to that, chief information security officer for that firm's software division. Earlier on, she held leadership and general manager roles at an information management firm and an information security firm, each based in both the United States and Europe. She has worked with the World Economic Forum as a member of their Global Future Council on Cybersecurity. She holds a Doctor of Philosophy in information security and a Bachelor of Science in computer science.


text: We recognize the significance of cyber-attacks and take steps to mitigate the risks associated with them. We invest in building and maintaining a mature cybersecurity program to leverage people, technology and processes to protect our systems and the data in our care. We have also implemented a program to help us better measure and manage cybersecurity risk, including those risks we face when we engage third parties for products and services.


text: We design our information and systems access restrictions referencing the National Institute of Standards and Technology 800 53R5 and NIST CSF 2.0 Framework and use the supplemental requirements as implementation guidance. Our information security policies and standards are reviewed and updated for new regulatory changes and/or mandates. These standards are applicable to all corporate functions, business units, subsidiaries and controlled affiliates across the enterprise. Annual audits are conducted by internal and external parties to measure compliance and adherence to the standards.


text: All employees and third parties that have access to our systems or networks are required to adhere to our cybersecurity policy and standards. Our centralized information security group provides education and training. This training includes a required annual online training class for all employees and third parties that have access to our systems or networks, multiple simulated phishing attacks and regular information security awareness materials. Every employee and contractor has a defined role in protecting systems and information of State Street, our clients and others. They are responsible for complying with the information security program, reporting suspected violations and threats; and protecting the confidentiality of information assets of us, our clients and others at all times.


text: We employ Information Security Officers to help the business better understand and manage their information security risks, as well as to work with the centralized Global Cybersecurity team to drive awareness and compliance throughout the business.


text: We use independent third parties to perform ethical hacks of key systems and penetration tests of our network and certain applications to help us better understand the effectiveness of our controls and to implement more effective controls, and we engage with third parties to conduct reviews of our overall program to help us better align our cybersecurity program with what is required of a large financial services organization.


text: We have an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and to drive the appropriate level of communication to internal and external stakeholders, including timely reporting of material incidents in accordance with SEC rules.


text: The TORC, an executive management committee, assesses and manages the effectiveness of our cybersecurity program, which is overseen by the TOPS of our Board. The TOPS receives regular cybersecurity updates throughout the year and is responsible for reviewing and approving the cybersecurity policy on an annual basis. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: Risk assessment and management Stewart has an enterprise risk management (ERM) program to assess, identify, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with Stewart's broader business goals and objectives. The cybersecurity risk is assigned to the Vice President, Information Technology (IT), who is a member of the ERM committee, for monitoring. The cybersecurity risk is also under the management oversight of Stewart's Senior Leadership Team.


text: Stewart takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks that could affect Stewart's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based upon their potential impact and likelihood. Risk mitigation strategies are developed and implemented based upon the specific nature of each cybersecurity risk. These strategies include the application of cybersecurity policies, procedures, and technologies, and employee training, education, and awareness. Additionally, Stewart's cybersecurity program provides mechanisms for employees to report any unusual or potentially malicious activity.


text: Stewart is regularly assessed against the cybersecurity frameworks of the National Institute of Standards and Technology (NIST CSF) and also evaluated for compliance with the SSAE-18 Systems and Organization Controls (SOC) standards of the American Institute of Certified Public Accountants (AICPA).


text: Stewart receives certain confidential or personal information related to its customers and employees. Stewart's operations depend upon the secure collection, processing, retention and transmission of such information by and through Stewart and its vendors. Therefore, the performance, reliability, and security of Stewart's technology infrastructure and information systems, and those of its vendors, are critical to Stewart's operations and initiatives.


text: Vendor risk management is an essential part of Stewart's Enterprise Governance Risk and Compliance (GRC) program. Critical vendors, which includes vendors that have access to personal information, are assessed and measured against standard security frameworks. Critical vendors are monitored for performance and compliance, and vendor security requirements are well defined and included with all master service agreements and contracts.


text: Incident response In the event of a material breach or an information technology disruption, management has an incident response team in place to take immediate action, work with local and national law enforcement, and notify the appropriate regulators, our Board of Directors and impacted parties. In addition, we would work with the NYSE to disclose the scope and effect of the breach or disruption through an appropriate Form 8-K filing, without providing information that could affect any law enforcement investigation.


text: Cybersecurity governance and board oversight The Board is responsible for overseeing management's assessment of significant risks facing Stewart. The Board approves management's strategy to manage these risks and monitors management's performance in implementing the strategy. The Board's oversight of cybersecurity risks occurs at both the full Board level and at the Board committee level through the Audit Committee.


text: The Board receives, at each regularly scheduled meeting, a risk report which includes an updated cybersecurity risk exposure assessment, a summary of existing cybersecurity controls and risk mitigations, and further planned controls and risk mitigation activities.


text: Our Chief Information Security Officer (CISO) reports quarterly to the Audit Committee concerning Stewart's cybersecurity program, operations, and other ad hoc updates. On a regular basis, management conducts a third-party assessment of Stewart's cybersecurity controls, the results of which are reported to the Audit Committee.


text: Management's role Stewart's cybersecurity function is led by Stewart's CISO, who reports to the Group President, Technology and Operations. The Group President, Technology and Operations, is responsible for all areas of Stewart's digital business strategy, enterprise technology solutions, innovation, and global information technology. The CISO leads a holistic security program to defend enterprises against emerging threats. He has served in various roles in information technology and security leadership for over 30 years.


text: Management uses third party consultants, as necessary, to assist in assessing, identifying and managing risks from cybersecurity threats. Annually, senior management participates in tabletop exercises to assess its readiness responding to cybersecurity incidents. Our cybersecurity team routinely challenges our employees and the effectiveness of existing controls.


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ended December 31, 2023. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.


text: Stewart recognizes the importance of protecting our customers', employees' and partners' confidentiality and data integrity. To that end, we continuously and methodically evaluate cyber risks, how they evolve and how they may affect us. We utilize considerable resources in our cybersecurity efforts, and we are committed to continuous cybersecurity education and training across our entire organization as well as our partners and customers. We continuously evaluate and monitor third-party risk relating to the protection of sensitive data. Our program focuses on a broad area of security domains, including, but not limited to: risk management, data protection, incident response, identity and access management, threat and vulnerability management, disaster recovery, business resiliency, and continuity.


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ending December 31, 2024. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.


text: Risk Management and Strategy We are heavily dependent on information technology systems and networks, including the Internet, third-party services and artificial intelligence, across our supply chain, including for product design, production, forecasting, ordering, manufacturing, transportation, sales, and distribution, as well as for processing financial information, external and internal reporting purposes, retail operations and other business activities. We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including, but not limited to, risks from ransomware attacks, security breaches, cyber-attacks or other malicious activities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations, computer viruses or other malicious codes, unauthorized access, phishing attacks or unauthorized uses, as part of our overall risk management framework and processes. Our risk management framework considers cybersecurity risks alongside other company risks to evaluate their nature and severity, as well as to identify mitigations and assess the impact of those mitigations on residual risk.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: We maintain a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0, as well as other standards. We utilize policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity management, security information and event management systems and insider threat management systems. We also carry insurance that provides protection against certain potential losses arising from a cybersecurity incident.


text: Our policies require that certain of our employees and contractors complete mandatory security awareness training upon hire or engagement and annually thereafter. The training covers essential topics such as phishing awareness, password security, data protection, social engineering, physical security and compliance requirements. Additionally, targeted training is provided based on roles, responsibilities and access levels to ensure relevance and effectiveness. The awareness and training program also includes practical exercises, such as simulated phishing attacks, to reinforce training objectives and improve understanding of security vulnerabilities. We also participate in a variety of initiatives and groups for collaboration and for increasing our security knowledge and awareness.


text: Our cybersecurity risk management processes include a third-party risk management program that assesses risks from vendors and suppliers. The program includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.


text: We maintain a robust Cybersecurity Incident Response Program intended to help us respond to an incident, prevent or minimize system disruption or the loss of data, recover business-critical services and facilitate compliance with any applicable legal obligations. Our program includes a written response plan that provides a framework for handling cybersecurity incidents based on the severity of the incident and the formation of a cross-functional incident response team staffed in accordance with the relevant severity level. The plan also sets out a coordinated approach to assessing the severity of potential and actual incidents and their impacts, containing, investigating, documenting, mitigating and remediating incidents, including reporting findings and keeping senior management, the Board of Directors and other key stakeholders and third parties (such as insurance providers and incident response professionals) informed and involved as appropriate. Our cybersecurity team regularly tests our cybersecurity controls through penetration testing, vulnerability scanning, and attack simulation.


text: Additionally, in connection with our cybersecurity risk management processes, we engage consultants, including outside counsel, to review our processes or programs, benchmark and opine on best practices. We conduct tests on our ecommerce sites to identify control gaps and prioritize process improvements that align with our business and cybersecurity strategy. We also periodically engage a third-party independent review of our cybersecurity program against the NIST Cybersecurity Framework 2.0 to provide an independent assessment and perspective measured against industry standards. In addition, members of senior management participate in periodic tabletop exercises with third-party experts on crisis management best practices to apply their learnings to the company's business continuity, enterprise risk and cybersecurity programs.


text: Our overall cybersecurity program includes: security tools, technologies and processes, control reviews and penetration tests; cybersecurity awareness training exercises for our employees, including phishing simulations to raise internal awareness of manipulated electronic communications; and an annual review of System and Organization reports for critical third-party service providers.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our cybersecurity strategy is developed in close collaboration with business stakeholders and is led by our Chief Information Security Officer (CISO). This strategy forms the foundation of our information security programs and supports effective cybersecurity risk management. Cybersecurity risk management is the responsibility of our information security team, which is overseen by our CISO. Our cyber fusion team, a subset of the information security team, is responsible for incident response, endpoint security management, detection engineering, vulnerability management, and threat intelligence. The cyber fusion team partners with technology and business stakeholders to strengthen the resiliency of our systems. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to the escalation procedures in our Cybersecurity Incident Response Plan. As described above, for incidents assessed at elevated severity levels, our CISO, crisis management team and legal team promptly engage a cross-functional incident response team to assess and monitor the incident to comply with applicable legal requirements.


text: Our CISO has served in this position since 2021 and has over two decades of experience in developing robust security programs across various industries. His previous positions include Deputy CISO for the Federal Reserve System, Chief Business Security Officer at ADP and cybersecurity leadership roles at Equifax. Before joining Equifax, he held positions in information security, compliance and internal audit at McKesson Corporation, Fifth Third Bank and AT&T. He also holds numerous industry certifications and serves as the Board Secretary of the Retail & Hospitality Information Sharing and Analysis Center.


text: Board of Directors The Audit Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. This includes the responsibility for reviewing and discussing with management and the Board of Directors our information technology use and protection, including, but not limited to, data governance, privacy, IT risks, compliance, cybersecurity and significant legislative and regulatory developments that could materially impact us, as well as the evaluation with management of the implementation and effectiveness of our controls to monitor and mitigate these risks and the oversight for any investigations related to specific cybersecurity or technology incidents. To fulfill this responsibility, the Audit Committee receives regular reports about cybersecurity risks from our CISO, and receives updates more often as needed, including in the event of a significant cybersecurity incident in accordance with our Cybersecurity Incident Response Plan. These regular reports periodically include information regarding the implementation and administration of the registrants cybersecurity processes, cybersecurity governance processes, status of projects relating to cybersecurity, cybersecurity matters relating to any particular products or services, summaries of any material cybersecurity threats or incidents and responses thereto, regulatory updates, updates on cybersecurity trends and the results of any assessments performed by internal stakeholders or third-party advisors.


text: Our Board of Directors retains responsibility for the oversight of our overall risk management systems and processes and our CISO provides periodic reports to the full Board of Directors on cybersecurity risk. The Board of Directors also participates in educational sessions relating to cybersecurity matters.


text: Cybersecurity Governance The Company's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats and is responsible for oversight of the Company's information security programs, including risk of cybersecurity threats. The Audit Committee, which supports the Board of Directors in the oversight of the Company's information security program, oversees managements design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of Board members with diverse expertise, including technology, financial and risk management experience.


text: The Audit Committee and full Board receive periodic briefings from management on our cyber risk management programs. The Company also has an internal disclosure committee made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committee meets on a quarterly basis to ensure they are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to the Board and Audit Committee as needed.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and infrastructure. This program includes the implementation of a set of system, network and application level controls to protect our data and systems. These controls are monitored for cybersecurity risks and incidents by internal staff and our third-party service provider and are updated as necessary to protect the Company.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Item 1A Risk Factors - Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations.


text: Our overall cybersecurity program includes: security tools, technologies and processes and control reviews; cybersecurity awareness training exercises for our employees, including phishing simulations to raise internal awareness of manipulated electronic communications; and an annual review of System and Organization reports for critical third-party service providers.


text: Cybersecurity Risk Management and Strategy We use technology in substantially all aspects of our business operations, and our ability to serve customers effectively depends on the reliability of our technology systems. Greater use of technology and digitization in operations has delivered benefits to our business, while also exposing us and others in our industry to new vulnerabilities in corporate and operational systems. Additionally, our business operations leverage third-party vendors and systems, which makes us susceptible to various cyber threats.

companyName: SYSCO CORP

ticker: SYY


text: The scale, scope, and complexity of our business raises a multitude of interdependent risks, which can vary over time. A primary responsibility of our leadership team, subject to oversight by our Board of Directors and specifically, our Board's Technology Committee, is to design and implement processes to identify, prioritize, assess, monitor and manage enterprise-level risks associated with cybersecurity threats. We have a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the cybersecurity risk landscape.


text: Our cybersecurity oversight function, which is led by our Chief Information Security Officer (CISO) and also includes our Chief Information Officer (CIO), Chief Executive Officer, Chief Financial Officer and General Counsel, directly oversees the cybersecurity and risk management process, which incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. The cybersecurity oversight function meets at least quarterly to discuss key risks and to discuss mitigation strategies. The results of our cybersecurity team process are communicated to the leadership team and its risk & reputation committee (the RRC) at least quarterly.


text: The Technology Committee of the Board of Directors oversees cybersecurity risks and receives cybersecurity reports from our CISO and regularly conducts in-depth cybersecurity discussions. Our CIO and CISO have extensive experience in the areas of cybersecurity and risk management. Our CISO has more than 20 years of experience in Information Technology, including cybersecurity leadership roles. Our CIO, who oversees the cybersecurity team and reports directly to our Chief Executive Officer, has over 20 years of experience in information technology strategy, services, operations, risk and cybersecurity for large global enterprises.


text: Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by internal and external cybersecurity experts. The multifaceted nature of our cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. We have established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which includes (i) the completion of due diligence before engaging with any third party, (ii) controls for response to mitigate any significant risks, and (iii) assessments and reviews during the course of the relationship. Additionally, we have ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.


text: We seek to detect and investigate suspected attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we still remain potentially vulnerable to known or unknown threats. Our cyber incident response plan includes an escalation process if a cybersecurity incident meets specific rating criteria to trigger action designed to minimize potential disruptions and protect the integrity of our operations. The cyber incident response plan has been reviewed by external experts and is reviewed internally annually. We also conduct periodic cybersecurity tabletop exercises where we perform walkthroughs of cyber incident scenarios with senior management to test and enhance preparedness.


text: During the year ended June 29, 2024, the company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the company, including its business strategy, results of operations, or financial condition. Nevertheless, the company recognizes cybersecurity threats are ongoing and evolving and has seen an increase in cyberattack volume, frequency and sophistication. We are committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the company assess, identify, and manage these risks. For more information on the company's cybersecurity risks, refer to Item 1A, "Risk Factors."


text: Cybersecurity risks are included in the risk universe that the RRC evaluates, with input from information security subject matter experts at the company, to assess top risks to the enterprise. The RRC process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating cybersecurity risk into the overall RRC process in this manner assists the company in identifying, assessing, and managing material cybersecurity risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board of Directors' Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: During the year ended June 28, 2025, the company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the company, including its business strategy, results of operations, or financial condition. Nevertheless, the company recognizes cybersecurity threats are ongoing and evolving and has seen an increase in cyberattack volume, frequency and sophistication. We are committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the company assess, identify, and manage these risks. For more information on the company's cybersecurity risks, refer to Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.


text: The identification and assessment of cybersecurity risk are integrated into our overall risk management systems and processes, which are managed by senior management and overseen by the Board of Directors. Cybersecurity risks related to our business, privacy and compliance issues are identified and addressed through a multi-faceted approach that includes third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with the aforementioned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our IT and accounting teams.


text: Cybersecurity incident events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises that simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: To date, we have not experienced any known cybersecurity incidents that have materially affected or are reasonably likely to materially affect us in the future, including our business strategy, results of operations, or financial condition.

companyName: TELEFLEX INC

ticker: TFX


text: Our management, represented by our Director of IT, Marcus O. Pegues, and our Senior Vice President of Finance and Chief Accounting Officer, Robert D. Velasquez, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Marcus O. Pegues is an experienced information technology professional in our information technology department and has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues possesses a proven track record of guiding our organization through strategic technology, risk mitigation, process improvement initiatives, and digital transformations. He also possesses extensive experience in technology and cybersecurity, gained over his career spanning more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.


text: Robert D. Velasquez, CPA, is an experienced risk management professional in our finance and risk management function and has served as Senior Vice President, Finance and Chief Accounting Officer since March 2022. Mr. Velasquez currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Velasquez leads the Company's cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Information technology failures and data security breaches could harm our business," which discussion is included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board of Directors ' Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Marcus O. Pegues has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues has guided, in coordination with other management staff, strategic technology, risk mitigation, process improvement initiatives, and digital initiatives. His experience in technology and cybersecurity, spans a career of more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.


text: Cyberattacks continue to evolve in sophistication and frequency. Among other things, an attack could impair our ability to interact with customers and suppliers, fulfill orders, generate invoices, collect and make payments, ship products, provide support to customers, fulfill contractual obligations and otherwise perform business functions.


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks resulting from cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 50 years of technology risk and cybersecurity work experience supporting multiple life science organizations.


text: Industry standard frameworks including International Organization of Standardization (ISO)/27001 and National Institute of Standards and Technology (NIST) are the foundation of the Program, which includes but is not limited to the fundamental security principles of least privilege access, event monitoring, vulnerability management, education, third-party risk management and incident response. The Program leverages external subject-matter experts that assist with identifying and remediating security risks present in our environment through threat hunting and vulnerability/control testing with a focus on the latest attack vectors. These external experts bring to bear risk mitigation tactics based on current threats observed across multiple organizations with similar risk profiles.


text: Key Program activities include: • Annual risk assessment to evaluate our profile against cyber risk threats; • Global policies based on the guiding principles of security by design and least-privilege access; • Maintenance of a critical incident response plan and simulation programs, which include procedures to comply with material security incident reporting requirements in collaboration with key members of Executive Management; • A communication framework designed to ensure that the individuals managing the Program are informed about, and in position to monitor the prevention, detection, mitigation, and remediation of, cybersecurity incidents; • Internal and external security assessments and testing to determine our susceptibility to compromise, lateral movement, privilege escalation and overall cybersecurity internal control posture; • Routine phishing simulations to identify areas for control enhancement and additional training; • Periodic end-user security training and cyber-threat awareness; • Suite of tools and processes to minimize the risk of security compromise in addition to detect controls alerting of potential malicious activity; and • Review and approval process focused on evaluating cybersecurity posture and internal controls relating to third party service providers.


text: The Audit Committee of the Board of Directors receives an update from the members of management referenced above on our security posture on at least an annual basis, and more often as needed. The Audit Committee provides oversight as to the status of our cybersecurity apparatus and overall Program management (including with respect to the identification and implementation of planned security enhancements), while also advising on risk mitigation activities to address the latest threats.


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks associated with cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 60 years of technology risk and cybersecurity work experience supporting multiple life science organizations. The Program is also closely aligned with the Legal and Global Compliance organizations to oversee adherence with legal, regulatory and contractual requirements from an information security and data privacy perspective.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity processes to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our approach to assessing, prioritizing, and effecting cybersecurity processes and projects is based on standards from the National Institute of Standards and Technology (NIST).

companyName: TENNANT CO

ticker: TNC


text: We have established an enterprise risk management (ERM) program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of table top exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office (CIO) and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third-parties.


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team (CSIRT) and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the SLAs in place with third parties, and the role third parties may play in specific response scenarios. Our CIO has more than 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles, including nearly 20 years in such positions in the manufacturing industry. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies. Effective February 2, 2024, our CIO has retired from employment and continues to serve as our CIO as a contractor through April 2024. During this time, he will continue his existing duties including oversight and management of cybersecurity risks. An active search is underway for a new CIO.


text: The CIO and CSIRT, in combination with the Senior Vice President, Technology and Innovation and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: The Vice President, CIO provides comprehensive quarterly briefings to the Audit Committee. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our quarterly meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The CIO and CEO provide updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, as well as tabletop exercises for tactical response readiness. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Tennant Company. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity processes to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our approach to assessing, prioritizing, and effecting cybersecurity processes and projects is based on standards from the National Institute of Standards and Technology ("NIST").


text: We have established an enterprise risk management ("ERM") program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office ("CIO") and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third parties.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing.


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team ("CSIRT") and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the service level agreements ("SLAs") in place with third parties, and the role third parties may play in specific response scenarios. Effective February 2, 2024, our CIO retired from employment and continued to serve as our CIO as a contractor through May 2024. During that time, he continued his existing duties including oversight and management of cybersecurity risk. In June 2024, the Company announced the hiring of a new CIO who will lead the enterprise technology team. The new CIO has over 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies.


text: The CIO and CSIRT, in combination with the Senior Vice President, Chief Transformation Officer and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of Board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Terex bases its enterprise-wide cybersecurity program on the National Institute of Standards and Technology's Cybersecurity Framework to ensure our cybersecurity measures are rigorous, adaptable, transparent and aligned with best practices in the industry. We take a comprehensive approach to cybersecurity risks, with a multi-layered cybersecurity strategy based on prevention, detection and mitigation. Primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program rests with our Vice President ("VP") Cybersecurity and Senior Vice President ("SVP") Chief Digital Officer. Our VP Cybersecurity has significant cybersecurity education/training and many years of industry experience in the field of cybersecurity. In addition, our SVP Chief Digital Officer offers added in-depth knowledge with significant experience leading technology teams. Terex also has a Global Cybersecurity Group ("GCG"), consisting of management and non-management team members, that is tasked with the continuous development and implementation of information security policies and controls.

companyName: TEREX CORP

ticker: TEX