text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk, including network segmentation, deployment of enhanced detection tools, and monitoring compliance with security standards. We conduct cybersecurity risk assessments, penetration tests, purple team exercises, and data restoration testing through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various methods including the use of attestations and certifications of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The risk-based approach of the NIST Framework enables us to design and implement cybersecurity programs that are specific to our network architectures, customer environments, and institutional resources.


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), develops and directs our information security strategy and policy, security engineering, operations and cyber threat detection and response. Our CISO has 22 years of experience in cybersecurity and 16 years in cybersecurity management, received a bachelor of science in management information systems and a masters of business administration from Rochester Institute of Technology, and is a Certified Information Systems Security Professional. Cybersecurity strategy and updates are reviewed by our executive leadership team on a monthly basis and are presented to other internal committees. The audit committee receives a regularly scheduled report on cybersecurity matters and related risk exposure from our CISO, chief technology officer or other similar officers. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.

companyName: Optimum Communications, Inc.

ticker: OPTU

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: We have experienced, and will continue to experience, cyber incidents in the normal course of our business. Notwithstanding the approach we take to cybersecurity risk management, we may not be successful in preventing or mitigating a cybersecurity incident that could have a significant adverse impact on our business and reputation. See "Risk Factors" above for additional information on risks related our business, including from risks related to cyber attacks, data security incidents, information and system breaches, and technology disruptions and failures. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

stage1Category: Strategy Integration


text: Risk Management and Strategy As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: Summit Materials, LLC

stage1Category: Risk Management Process


text: We have developed a cyber incident response plan which provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. Dedicated members of our information security team, led by our Vice President, Infrastructure, constantly monitor threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we periodically perform simulations and drills at both a technical and management level.

stage1Method: majority


text: Internally, we have a security awareness training platform which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. We have also partnered with an industry expert's incident response group to help deconstruct, manage and mitigate impact from any cyber-related incident. We also purchase insurance to help protect us against the risk of cybersecurity breaches.


text: The Corporate Governance and Nominating Committee of our Board of Directors oversees management of risks associated with corporate governance, including cybersecurity. This committee meets regularly with Corcept management and reports to the full Board of Directors.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT

stage1Category: Board Governance


text: To date, we have not had a significant cybersecurity breach or attack that has had a material impact on our business or results of operations, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors–Risks Related to Our Industry and Our Business–Other Risks–We are dependent on information technology. Our systems and infrastructure face certain risks, including cyber security risks and data leakage risks," cyber-attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cyber-attack, there can be no assurance that our efforts will be effective in preventing breakdowns or breaches in our systems.


text: Role of the Board Our Board of Directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the Board of Directors in particular is responsible for reviewing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the Board of Directors, including members of the Audit Committee, receives periodic reports from our Chief Information Officer and Vice President, Infrastructure to assess the primary cybersecurity risks we face. Our Chief Accounting Officer reports directly to the Board of Directors on our company-wide enterprise risk management, which includes an evaluation of cyber risks and threats.


text: Role of management Our Chief Information Officer, together with our Vice President, Infrastructure, is responsible for the day-to-day management of our cybersecurity risks.


text: We have a security incident response plan in place. We use this incident response plan as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The incident response plan is a set of coordinated procedures and tasks that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.


text: Our Chief Information Officer and our VP, Infrastructure have extensive experience in the information technology area, including cybersecurity. In particular, our Chief Information Officer has over 10 years of professional experience in the information security area, including as a result of his service as an IT VP at companies such as Prologis, and holds certifications relating to cybersecurity. Further, our VP, Infrastructure has over 15 years of professional experience in the information security area, including as a result of roles of increasing responsibility at Summit Materials and his service as a senior systems engineer at various companies.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, or availability of our information technology systems or any information residing therein. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Bloom Energy Corp

ticker: BE


text: We design and assess our program based on the Center for Internet Security ("CIS") 18 Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS 18 Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Periodic risk assessments are designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.


text: Index to Financial Statements • A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls. • Our Internal Audit department which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment. • Periodic cybersecurity awareness training for our employees and contractors with access to our information technology systems. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including incidents that could be indicators of attack against availability, integrity and confidentiality of information systems. • A third-party risk management process for service providers, suppliers, and vendors that includes examining their security postures and assessing their data and system protection controls.


text: Our business has not been materially affected by cybersecurity incidents to date. For a discussion of how cybersecurity risks could materially affect us in the future, please see the risk factors set forth under the caption Part I, Item 1A, Risk Factors — Risks Related to our Operations.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the Audit Committee on these and other activities. The Audit Committee receives periodic reports from management on our cybersecurity risks, including presentations from our Chief Information Officer, internal security staff, and external experts. This includes updates to the Audit Committee, as appropriate, regarding any significant cybersecurity incidents, or multiple incidents that could be significant in the aggregate. These updates may occur in between regularly scheduled Audit Committee meetings.


text: At the management level, the Enterprise and Risk Management Committee (the "ERM Committee") discusses cybersecurity topics, including any potentially material cybersecurity incidents, as part of its oversight of the company's significant risks. Our management team, including the Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including: • periodic briefings from internal security personnel; • periodic reviews of risk management measures implemented to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, including our incident response plan; • threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and • alerts and periodic reports produced by security tools deployed in our IT environment.


text: Our Chief Information Officer has more than 20 years of cybersecurity and information technology experience and she has served as the Chief Information Officer for multiple technology companies. Similarly, the members of the ERM Committee possess significant risk management experience obtained by their collective years of experience at Bloom and other companies of similar or greater complexity.


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises, to inform our cybersecurity risk identification and assessment. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate certain cybersecurity incidents, as well as to comply with applicable reporting obligations.

companyName: AIR LEASE CORP

ticker: AL


text: Our board of directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the audit committee. Throughout the year at each quarterly meeting, the audit committee receives updates on our cybersecurity program from senior management, including in connection with program enhancements, audits of the program and employee cybersecurity training. Our Head of Information Technology is a Certified Information Systems Security Professional who has provided program management and enterprise cybersecurity services across different organizations for over twenty years, has a Master of Information Technology Management and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our Head of Information Technology reports directly to our Chief Financial Officer.


text: For a description of the risks from cybersecurity threats that are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "A cyberattack could lead to a material disruption of our information technology ("IT") systems or the IT systems of our third-party providers and the loss of business information, which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs."

stage1Category: None/Other


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy AIR takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. AIR regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems according to its cybersecurity policies, standards, processes, and practices, which are integrated into its overall approach to enterprise risk management. To protect its information systems from cybersecurity threats, AIR uses various security tools that help it identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. AIR's cybersecurity program is designed to align with the National Institute of Technology Standards Cybersecurity Framework 1.1, which provides a structured approach for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Apartment Income REIT Corp.


text: AIR's technology team, under the leadership of AIR's Senior Vice President of Technology, who has over 30 years of technology management experience, defines an annual work plan designed to maintain strong cybersecurity maturity, set improvement objectives of key controls and systems, including feedback from third-party assessments, and identify and implement on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of our annual planning, management conducts regular tabletop testing of our incident response plan to increase awareness, establish key decision-making criteria, ensure effective communication among key stakeholders, and comply with AIR's disclosure obligations. AIR also partners with third-party experts to assess the effectiveness of our cybersecurity prevention and response systems and processes (e.g., periodic penetration testing and assessments of IT general controls). AIR also engages vendors to enhance cybersecurity safeguards and improve incident response and updates or replaces systems and applications as appropriate to improve data processing and storage management and enhance security. To further protect AIR's information systems, we structure and monitor our relationships with third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected AIR and we believe are not reasonably likely to have a material adverse effect on AIR, including its business strategy, results of operations, or financial condition. For additional information on cybersecurity risks and potential related impacts on AIR, refer to "Our business and operations would suffer in the event of significant disruptions or cyberattacks of our information technology systems or our failure to comply with laws, rules and regulations related to privacy and data protection." in Part I, Item 1A. Risk Factors.


text: Our Board of Directors oversees AIR's risk management process, including cybersecurity risks. The Audit Committee oversees AIR's enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. AIR's Senior Vice President of Technology reports, typically on a quarterly basis, to the Audit Committee on AIR's cybersecurity profile risk assessment and technology environment and the broader technology landscape. The Audit Committee also independently engages consultants to conduct cybersecurity assessments and, preparedness analyses, and to provide the Board with ongoing training concerning cybersecurity risk governance.


text: AIR's Senior Vice President of Technology, in coordination with other members of AIR's management, is responsible for leading the assessment and management of cybersecurity threats. AIR has implemented a governance program for its cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents, as well as identifying responsible teammates to facilitate the implementation of cybersecurity priorities. These teammates report regularly to senior management and to the Board on risk identification, safeguards, and mitigation steps. AIR has developed and implemented policies to identify and mitigate cybersecurity risks and provides training to teammates at onboarding and annually thereafter. Updates are communicated to all teammates, and actionable guidance is provided when new risks arise.


text: As a key component of Polaris' Enterprise Risk Management process, Polaris' cybersecurity risk management program is designed to align with industry-standard cybersecurity frameworks and includes processes related to each of the following functions: identification, protection, detection, response, and recovery. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. Our cybersecurity team engages third-party security experts to assist with our processes for assessing, identifying, and managing risks from cybersecurity threat, including, for example, assessment of the maturity of our cybersecurity risk management program, penetration testing, employee awareness testing, phish testing, and incident monitoring and response, including conducting tabletop exercises.

companyName: Polaris Inc.

ticker: PII


text: Equinix Risk Management and Strategy Equinix has processes for assessing, identifying, and managing material risks from cybersecurity threats, both integrated into our Governance, Risk and Compliance Program (the "GRC Program") and existing within our Information Security function ("InfoSec") led by our Chief Information Security Officer ("CISO").

companyName: EQUINIX INC

ticker: EQIX


text: Our cybersecurity risk management program is under the direction of our Senior Vice President and Chief Digital and Information Officer, who has 30 years of technology leadership, and staffed by a cybersecurity team that includes personnel with a range of information and product security experience, from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications and more than twenty years of experience. The Senior Vice President and Chief Digital and Information Officer received reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Executive Cybersecurity Council meets as appropriate and receives updates from the Senior Vice President and Chief Digital and Information Officer and the cybersecurity team regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.


text: Our full Board of Directors provides oversight of our cybersecurity risk management program and receives updates on the program from the Senior Vice President and Chief Digital and Information Officer on a quarterly basis, or more frequently as appropriate. Those updates include information regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including any learnings from external cybersecurity incidents.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Regulatory, Intellectual Property, Cybersecurity and Privacy Risks" in this annual report on Form 10-K.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, and monitoring and detection tools to allow our information security team members to assist us in identifying vulnerabilities in our systems before they are exploited by malicious threat actors. Leadership for our information security team, including our Chief Technology Officer, consist of professionals with cybersecurity expertise across multiple industries.

companyName: Proto Labs Inc

ticker: PRLB


text: We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

stage1Category: Third-Party Risk


text: As part of our cybersecurity risk management system, our information security team tracks and logs privacy and security incidents across our Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group including legal, SEC regulation and information security professionals to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cyber security threats. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board for consideration. Our executive leadership team regularly discusses cyber risks and trends and, should they arise, any material incidents with the audit committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy Abbott's cybersecurity risk management process is designed to identify and assess internal and external cybersecurity threats and vulnerabilities to and within Abbott's business and operations, and analyze and prioritize risks from cybersecurity threats to inform strategies and action plans aimed at mitigating and managing these risks.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: ARDELYX, INC.

ticker: ARDX


text: Abbott's cybersecurity program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity policy and requirements, implementing protections, and monitoring and responding to cybersecurity incidents; • periodic cybersecurity awareness training for relevant employees and contractors on Abbott policies and emerging cybersecurity threats, including phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of Abbott's information systems and hardware; • cybersecurity risk assessments for Abbott's systems and applications; • cybersecurity monitoring and response processes intended to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery plans.


text: In addition, risks from cybersecurity threats are integrated into Abbott's enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify and assess risks that could materially impact Abbott's business and operations.


text: As part of Abbott's cybersecurity program, Abbott regularly engages with assessors and third party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: Abbott's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third party service providers with access to Abbott's systems and data, as well as such third party service providers' adherence to certain cybersecurity standards and processes. As appropriate, Abbott requires such third party service providers to agree to be subject to cybersecurity evaluations by Abbott.


text: A discussion of how Abbott's business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats is contained in Item 1A. Risk Factors under "Abbott depends on sophisticated information systems and maintains protected personal data, and a significant cybersecurity incident or other disruption affecting these information systems or protected personal data could have a material adverse effect on Abbott's business, financial condition and results of operations."


text: The board of directors has risk oversight responsibility for Abbott, which it administers directly and with assistance from its committees. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to ERM, including risks from cybersecurity threats, and the steps management has taken to monitor and mitigate those risks. The audit committee receives reports semiannually from Abbott's Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on Abbott's cybersecurity strategy and program. In addition, the audit committee conducts an annual review of the ERM process, including the program structure, risk assessment, and risk mitigation.


text: The public policy committee assists the board of directors in fulfilling its oversight responsibility with respect to product cybersecurity, and receives reports at least annually on this topic from the CIO and CISO.


text: The CISO leads Abbott's cybersecurity strategy and program and its cybersecurity and privacy incident response team that is responsible for monitoring the detection of cybersecurity incidents and executing Abbott's cybersecurity incident response process, as needed. Pursuant to the process, the team is responsible for the investigation and resolution of cybersecurity incidents, including reporting to an Abbott senior management-level committee on detection, mitigation, and remediation of significant cybersecurity incidents. The CISO reports to the CIO, who has overall responsibility for the cybersecurity program and organization.


text: Abbott has two cross-functional senior management-level committees that assess Abbott's material risks from cybersecurity threats – one that oversees Abbott's cybersecurity program and another that oversees the cybersecurity incident response process.


text: The CISO has extensive technology work experience, having served in various roles in risk management, including information security audit and assessments, developing cybersecurity strategy/programs for enterprise and product security, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CISO has also held leadership positions in several health sector industry organizations developing cybersecurity standards and best practices.


text: The CIO has extensive technology work experience at S&P 100 companies overseeing and executing technology strategies in complex, global, highly matrixed environments. The CIO provides executive leadership on technology strategy, policy, and capabilities across the Abbott enterprise.


text: The foundation of risk oversight at Equinix is our Governance, Risk and Compliance Committee ("GRCC"), led by our Chief Compliance Officer, and overseen by the Nominating and Governance Committee of our Board. The GRCC is a global, cross-functional group currently comprised of our most senior leaders, across functions such as Legal, Compliance and Risk Management. The GRCC considers enterprise and emerging risks via Equinix's Enterprise Risk Management Program (the "ERM Program"). Our ERM Program focuses on the identification, assessment, management, monitoring and reporting of key business risks. Risk identification involves periodic risk surveys and/or risk interviews with key business process owners and executives to identify key strategic, operational, financial, regulatory, compliance and external risks at the enterprise level. We completed a global risk assessment in 2023 to identify enterprise risks. In addition, the ERM Program also includes an Emerging Risks Team of business leaders at Equinix, representing a majority of business functions, that meets monthly to identify fast-moving, potentially impactful risks.


text: The GRCC prioritizes top enterprise and emerging risks for reporting to, and dialogue with, our executive staff at least quarterly, and from this discussion, risks are presented to the Nominating and Governance Committee to consider for further assessment and report-out either to a committee or the full Board as appropriate.


text: The ERM Program works with those responsible for a given area of risk to gather, evaluate, and prioritize risk information for this assessment process through use of an enterprise risk profile document. Top risks, including those related to cybersecurity, are evaluated through a detailed risk assessment, and the risks are reexamined periodically as needed. InfoSec performs an annual refresh of an information security risk profile document as required by this process, and the results of such assessment are reported out for escalation, prioritization and reporting on an annual basis.


text: Cybersecurity Risk Management and Strategy Equinix cybersecurity risk management activities and outcomes are guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and assessed by a third party. In addition, our cybersecurity program is certified globally against the International Organization for Standardization ("ISO") 27001 standards. Currently, our cybersecurity program includes the following key categories of security controls with many security capabilities serving under each category Governance, Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Contingency Planning, Incident Response, Data Security, Continuous Monitoring, Maintenance Controls, Media Protection, Physical Protections, Risk Assessment, Third-Party Risk Management, System and Communications Projection, and System and Information Integrity.


text: Equinix has also implemented controls designed to identify and mitigate cybersecurity risk associated with our use of third-party service providers, such as security risk assessments. We use a variety of inputs in such assessments, including information supplied by the third parties and regular monitoring.


text: Equinix conducts regular employee training on how to spot suspicious activity, educates employees on potential security risks, and periodically runs simulations of cyber incidents for employees across various functions to assess and refine response capabilities. Equinix also offers a role-based security certification for its software engineering employees.


text: Equinix's cybersecurity risk management processes are carried out in the context of broader business objectives and are integrated into Equinix's broader risk management processes as described above in "Equinix Risk Management and Strategy".


text: Equinix relies on its internal InfoSec team, and does not generally engage any consultants, auditors, or other third parties in connection with processes for assessing, identifying and managing risks from cybersecurity threats. However, Equinix does regularly engage with law enforcement communities with the intent to continuously improve and enhance its cybersecurity program.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Nominating and Governance Committee oversees our GRC Program per its charter, reviewing and considering developments related to the GRC Program and reporting on the GRC Program's activities and recommendations to the full Board.


text: Information security risks have been deemed by our Board to be of critical importance to Equinix, and thus the Nominating and Governance Committee receives quarterly updates on cybersecurity and the full Board receives a briefing on cybersecurity at least annually. These briefings are conducted by our CISO and members of the InfoSec leadership team, and cover topics such as key risk indicators, the status of strategic programs, operational updates and key initiatives, past and future action plans, and InfoSec functional updates.


text: In the event of a material cybersecurity incident, the full Board would be convened on a frequent basis to receive updates and provide oversight.


text: The Company understand that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Information Security Steering Committee ("ISSC") is a key element of our cybersecurity strategy. The ISSC is chaired by the CISO and comprises of a cross-functional group from various functions in the company. The ISSC aims to align our security and compliance programs with business objectives. Specifically, the ISSC (i) facilitates identification of risk-based priorities and trade offs; (ii) aims to ensure economies of scale and consistency of information security and compliance across IT assets at the company.; (iii) reviews and approves information security policies; (iv) reviews requests for policy and risk exceptions to provide a "Risk Acceptance Authorization"; and (v) serves as a communications channel and steward to cultivate a culture of trust across the enterprise.


text: The ISSC currently meets quarterly. In addition, various subcommittees meet on an as-needed basis to address business needs. At the ISSC, topics such as changes to the InfoSec risk register, notable issues, and information security projects are discussed.


text: Our CISO has extensive experience leading global security and IT organizations. He also serves on a public company board as an independent director providing cybersecurity expertise. Team members supporting our program have relevant education and information security experience.


text: Risks From Cybersecurity Threats Although we believe we have a robust program to protect against cybersecurity risks, we may not be able to prevent a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for further discussion of cybersecurity risks.


text: Cybersecurity is a critical part of our enterprise risk management. The Board, through its Audit Committee, oversees enterprise risk management, including cybersecurity. To more effectively address cybersecurity threats, we have numerous security layers within our least privilege network approach which is managed by our Information Technology Department. Our cybersecurity programs align with numerous standards and continues to grow and develop as new technologies emerge. Further, we have regular user awareness testing and trainings in place which helps keep all end users and executive leadership up-to-date on the most current threats. The global head of Information Security, possessing credentials in both information technology ("IT") and cybersecurity, provides regular updates to senior management. Additionally, they provide at least an annual update, or more frequently if necessary, to both the Audit Committee and the full Board regarding the current threat landscape at Balchem, cybersecurity technologies, mitigation strategies, industry trends and best practices that we follow, major cybersecurity incidents (if any), and other areas of importance. The global head of Information Security has responsibility over cybersecurity management globally and reports directly to the Chief Financial Officer. Additional activities to maintain and enhance information security are discussed below.

companyName: BALCHEM CORP

ticker: BCPC


text: • Reliable, Scalable Systems and Infrastructure Our information security systems, infrastructure, and processes are built on and follow the U.S. National Institute of Standards and Technology ("NIST") framework for information security, which is a set of guidelines, accepted standards, and best practices for mitigating organization cybersecurity risks published by NIST. We continue to make significant investments in industry-leading and advanced technologies as part of our strategy to strengthen our security posture, business continuity capabilities, and ability to protect and safeguard systems and stakeholder data. Our Information Security Program and systems are tested and assessed annually by an independent third party. • Automation and Artificial Intelligence We have implemented automated systems to proactively test attack vectors by emulating inside and outside threats resulting in the validation of our ability to detect and defend against a cyber attack. Artificial intelligence is used as part of early warning systems designed to detect, alert, and respond to potential cyber threats. • Training


text: Recognizing that information security, stakeholder data, and privacy principles involve more than just systems and infrastructure, we provide semi-annual cybersecurity education and training to all users with access to IT systems, devices, or applications. Internal social engineering phishing campaigns are conducted regularly with the goal of building a culture of cybersecurity, as well as raising awareness and reinforcing best practices across the organization.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: We apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers and cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based services and platforms. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: KELLANOVA


text: While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors - Operational Risks - Disruptions or breaches of our information systems could adversely affect us" for a discussion of cybersecurity risks.


text: In the event of a possible cybersecurity incident, we would immediately implement our crisis management plan, which includes the following steps: (1) Internal reporting and review of the incident or development (2) Gathering and assessing information (3) Developing and implementing a communications strategy (4) Monitoring and evaluating a response


text: (5) Debrief and recovery As part of the gathering and assessment of information in step 2, we will consider various factors to make a materiality determination of the incident, including business impact, potential costs, impacted data, scope of the incident, possible litigation or regulatory implications, and reputational damage.


text: Risk Management and Strategy We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security, privacy, information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: FLUOR CORP

ticker: FLR


text: We have integrated cybersecurity risk into our broader enterprise risk management framework. Our cyber risk program leverages internationally recognized standards as appropriate. We use a combination of technology controls, human oversight and processes to actively monitor and protect our network and systems. All employees participate in a number of information security training programs. Employees receive training on how to spot and report cyber risks and events through our global cybersecurity awareness program. In addition, we hold cybersecurity risk insurance.


text: We engage outside experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.


text: To manage risks associated with third-party service providers, we typically require new vendors with access to our computing environment or sensitive data to undergo a risk assessment from our information security team. We conduct periodic reviews of these vendors to evaluate compliance with our cybersecurity policies. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of material cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.


text: Cybersecurity is overseen by our Board of Directors with assistance from the Audit Committee. Our Board of Directors receives quarterly reports from management which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, current and projected threat assessments and ongoing efforts to prevent, detect and respond to critical threats.


text: Our Audit Committee, which is responsible for oversight of cybersecurity risks, periodically reviews and discusses with management, including the Chief Information Officer, risk issues associated with cybersecurity and policies and controls intended to mitigate those risks.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for cybersecurity. Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The team includes senior professionals, many with more than 15 years of cybersecurity expertise and industry certifications such as Certified Information Security Systems Professional, CompTIA Security+, Global Information Assurance Certification, and Certified Ethical Hacker. Members of the team are provided with opportunities to attend external training, conferences, and other events to keep abreast of the latest cybersecurity trends. Our CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our CISO reports to our Chief Information Officer, who meets with our Audit Committee at least annually to discuss cybersecurity risk and related issues. These meetings may encompass a broad range of topics, including: • cybersecurity initiatives and strategies, • cybersecurity events, • emerging threats, • regulatory requirements, and • industry standards.


text: The Company, as a part of its program has a documented cybersecurity incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of cybersecurity intelligence and risk sharing organizations. Employees undergo security awareness training.


text: In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework to report and document such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. Cybersecurity incidents are regularly reported to the Chief Information Officer and certain critical events are reported to the CEO and the crisis management team comprised of senior executives. We also have protocols in place by which certain cybersecurity incidents are reported to the Board of Directors as part of their oversight of cybersecurity matters.


text: Cybersecurity Risks, Threats and Material Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results or operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we are not aware of any cybersecurity incidents through the date of this report that have materially affected us, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks we face can be found in Item 1A of this 10-K, which should be read in conjunction with the foregoing information.


text: Our management recognizes the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: Our chief technology officer and the Cybersecurity Incident Response Team ("IRT") are responsible for assessing and managing cybersecurity risks. The IRT is comprised of individuals with expertise in information security, technology, legal and risk management. The IRT continually monitors cybersecurity incidents and potential threats. It liaises with external cybersecurity experts and industry partners to stay current on emerging threats and best practices. The diverse expertise of the IRT members enables comprehensive risk assessment and swift responses to mitigate the potential impact of breaches or other cybersecurity incidents.


text: We actively engage consultants, outside counsel and other technology experts to enhance our cybersecurity risk management processes, who perform regular assessments and evaluations of the effectiveness of our cybersecurity measures. In addition to third party engagements, we maintain rigorous oversight of cybersecurity risks associated with our use of third party service providers. Vendor management processes are employed to evaluate vendors' cybersecurity practices, assess risk position and implement measures to mitigate potential threats arising from these external relationships.


text: The Board of Directors has been designated to oversee cybersecurity risk management. Its members possess diverse expertise, which enables them to effectively evaluate the adequacy of our cybersecurity measures and challenge management's approach when necessary. The chief technology officer provides regular updates to our chief executive officer and Board of Directors on cybersecurity risks, ongoing initiatives, incidents, response activities and strategies. The Board of Directors acknowledges cybersecurity as a strategic risk and a priority for the Company. The Board of Directors is actively involved in the oversight of our cybersecurity risk management efforts, ensuring alignment with our overall business objectives.


text: Our commitment to cybersecurity resilience is rooted in the collaborative efforts between management, the IRT and the Board of Directors. We continuously strive to strengthen our cybersecurity measures to protect our systems, data, customers and stakeholders from evolving threats. To date, cybersecurity incidents and risks have not materially affected us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy. Kellanova has established a cybersecurity program (the "program") that is designed based on reviewing industry common practices and recognized frameworks (i.e., NIST and ISO, among others). The Company works to evolve its program to address material risks from cybersecurity threats. The program is developed from a top-down strategic risk management approach.


text: The program includes processes that identify how security measures and controls are developed, implemented, and maintained, as well as cybersecurity and information security training and awareness. The program includes a risk management process designed to identify internal and external cybersecurity threats and vulnerabilities to the Company's business and operations, assess the likelihood and potential impact of the threats and vulnerabilities to the Company, and assess and prioritize the risks from cybersecurity threats and vulnerabilities to inform action plans and strategies to mitigate and manage these risks. The program's risk assessment process, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: recognized frameworks, likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others.


text: Members of our senior management, including our Chief Executive Officer, Chief Financial Officer, and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions.

companyName: Prime Medicine, Inc.

ticker: PRME


text: The Company has an Enterprise Risk Management ("ERM") program to address enterprise risks, and cybersecurity is a risk category evaluated and identified by that function. One of the leaders of the ERM process is Kellanova's Vice President, Internal Audit, and the process includes individuals with designated areas of focus and subject matter experts across Kellanova, including cybersecurity leaders. As the enterprise risk owner for cybersecurity, the Chief Digital and Information Officer supports the Chief Information Security Officer ("CISO") and the information security team, which includes a Governance, Risk, and Compliance (GRC) function, to manage cybersecurity risk. The information security team collaborates on privacy and security governance.


text: Our computer systems have been and will likely continue to be subjected to cybersecurity threats. To date, we have not experienced a cyber security threat that has materially affected the Company, including its business strategy, results of operations, or financial conditions.


text: Additionally, in Item 1A Risk Factors under the headings of "Risks Related to Our Intellectual Property and Technology", and "Technology failures, cyber incidents, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business", forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Governance. The Kellanova Board of Directors has risk oversight responsibility for Kellanova, which it administers directly and with assistance from its committees. Oversight of the information security program sits with the Audit Committee. The Audit Committee has oversight responsibilities with respect to ERM, including cybersecurity, information security and data protection risk exposures, and the steps management has taken to monitor and control these exposures. In addition to periodically providing the Executive Management Team with information and cybersecurity briefings, the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") provide at least biannual updates to the Audit Committee regarding cybersecurity, including on strategy and the Company's cybersecurity program. For cybersecurity incidents, the Company's cybersecurity incident response plan includes a process for incidents to be evaluated for material impact. The escalation protocol includes reporting of security incidents to members of the Kellanova Executive Management Team and reporting of any cyber incidents that could have a material impact on the Company to the Audit Committee.


text: As mentioned above, the CISO is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has work experience in various roles in risk management, including developing information and cybersecurity strategy/programs, information security audit and assessments, cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CISO has experience leading enterprise global efforts to align systems to industry-accepted standards and practices, as well as regulatory compliance requirements. The CISO has degrees in the areas of management of information systems and cybersecurity, and also maintains several information security and technology certifications, including as a Certified Information System Security Professional ("CISSP") and Boardroom Certified Qualified Technology Expert ("QTE").


text: The CISO reports directly to the CDIO, who is a member of the Kellanova Executive Management Team. The Company's CDIO has technology experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CDIO has been in role since February 2019, bringing experience from overseeing and executing technology as European CIO at the Company, and over 20 years of experience leading IT strategy and change initiatives in the consumer packaged goods and manufacturing industries.


text: Organizations across the globe are experiencing cybersecurity incidents at an increasing rate, and cybersecurity threats are increasingly sophisticated and constantly evolving. We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. These risks are evaluated on an ongoing basis as part of our overall risk management strategy. As discussed in more detail below, we have policies and procedures in place to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats amongst employees, detect intrusions into our systems, and respond to cybersecurity incidents. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or detect every incident timely.

companyName: MEDIFAST INC

ticker: MED


text: Risk Management and Strategy We have established processes for assessing, identifying, and managing material risks from cybersecurity threats and have integrated these cybersecurity processes into our overall risk management system. Specifically, we have adopted a cybersecurity framework that, where appropriate, aligns with the NIST's Cybersecurity Framework, and we have maintained systems that, where appropriate, are PCI compliant under current standards.


text: We regularly review our Incident Response Plans to ensure readiness if and when an incident does occur, including through live testing via planned and surprise tabletop exercises. In the event of a cybersecurity incident, if a system does become non-operational, we maintain disaster recovery capabilities to return to normal operation in a timely manner.


text: Our cybersecurity processes to assess and identify cybersecurity risks includes periodic risk assessments, deployment of security monitoring tools for continuous monitoring of our information systems, periodic testing for vulnerabilities in our systems, periodic testing of employees' cybersecurity awareness, receiving cybersecurity alerts, among other procedures. Our Information Security ("IS") department, which reports to the Vice President, Information Security, evaluates cybersecurity risks and works to design and ensure implementation of appropriate controls and safeguards in alignment with our business objectives and operational needs. Management periodically reviews cybersecurity risks as part of the overall risks to the company as part of the enterprise risk management program. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: We engage various third parties to assess, test, or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including but not limited to: consultants who assist with assessing risks, assist with our PCI compliance assessments, assess our systems alignment with the NIST Cybersecurity Framework, and test and/or scan for vulnerabilities.


text: We rely on software, hardware, and network systems, including cloud-based technology, that are either developed by us or licensed from or maintained by third parties to maintain operations. In the ordinary course of our business, we collect and utilize proprietary and customer information and data. We utilize systems designed to protect customer information and prevent fraudulent transactions and other security breaches. We rely on third-party software products to secure our credit card transactions.


text: Furthermore, we maintain a process to evaluate and manage risks associated with third-party service providers. We conduct cybersecurity assessments of our key vendors before engagement, maintain continued monitoring during the engagement, and maintain the ability to discontinue our engagement with a key vendor if their cybersecurity posture fails to meet pre-established standards.


text: The Company, from time to time, experiences or is subject to a variety of incidents that arise during the ordinary course of its business. As of the date of this report and based upon the Company's experience, current information, and applicable laws, we do not believe that these incidents are material, or will have or have had a material adverse effect on business strategy, results of operations, or financial position. However, future cybersecurity incidents could materially affect our strategy, results of operations, or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the company.


text: The Board of Directors has responsibility for oversight and approval of our cybersecurity risk management processes, and the Board has established an oversight mechanism for cybersecurity risks.


text: Senior executives provide the Board of Directors with quarterly updates concerning cybersecurity risks and the Company's cybersecurity strategies and objectives. In addition, members of management briefed on specific issues attend Board meetings to provide additional insight into the specific issues being discussed, including risk exposure.


text: The Board works with our senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company's cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. If a significant cybersecurity incident occurs, it will be reported promptly to the Board near the time of discovery.


text: The IS department is charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. On a day-to-day basis, IS informs the Vice President, Information Security concerning cybersecurity risks and events, including any mitigation and remediation efforts. Our Vice President, Information Security joined the Company in September 2022, and is responsible for approving IS policies and procedures, implementing controls, monitoring and detection programs, and employee training on cybersecurity risks, and reports cybersecurity risks and strategies directly to executive leadership. He has over a decade of security experience, received his Master of Science in Computer Information and Information Systems Security/Information Assurance from Norwich University, and holds various certifications including Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP).


text: Cybersecurity incidents are escalated to the cybersecurity incident response team ("CIRT") who is responsible for overseeing our incident response strategy, including remediation. Significant cybersecurity incidents are escalated to the Company's Incident Response Materiality Assessment Committee ("IRMAC") that assesses and evaluates whether the incident is material using criteria based on our enterprise risks. This committee is comprised of a cross-functional team that consists, in part, of employees at the management level and members of the executive team. As noted above, if a significant cybersecurity incident occurs, it will be reported promptly to the Board on an ad hoc and as-needed basis. Otherwise, management reports cybersecurity risks and developments to the Board quarterly.


text: The CIO has extensive technology work experience at S&P 100 companies overseeing and executing technology strategies in complex, global, highly matrixed environments. The CIO provides executive leadership on technology strategy, policy, and capabilities across the Abbott enterprise.


text: Cybersecurity threats have become significantly more numerous and sophisticated over time, and the oil and gas industry in particular is highly targeted by malicious actors seeking to attack oil and gas infrastructure to disrupt operations. Because we are focused on mineral and royalty interests, we do not maintain any material physical infrastructure; nonetheless, being an industry participant increases our exposure to external attacks. We are committed to safeguarding our information technology systems and data and managing the risks associated with cybersecurity threats and implemented governance structures, processes, and technologies designed to prevent, detect, investigate, and mitigate any incident that could pose a cybersecurity risk.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Our Vice President, Information Technology ("VP IT"), with support from our Information Technology Infrastructure Team ("Infrastructure Team" and, together with the VP IT, the "Cybersecurity Team"), has primary responsibility for the assessment and management of risks from cybersecurity threats. Collectively, the four members of the Cybersecurity Team have over 75 years of cybersecurity-related experience in both the private and public sectors, including perimeter and internal network security, secure email gateway, B2B and B2C eCommerce, on-premises and cloud storage environment security, and ransomware protection solutions. In addition, members of the Cybersecurity Team have multiple network-security certifications relevant to the technologies we deploy.


text: Our Board of Directors provides oversight over our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management regularly and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.


text: Our VP IT, the Manager of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by NIST and ISO, as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: Gatos Silver, Inc.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. If applicable, these committees periodically report to the Board of Directors on their risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program and our Board of Directors is involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis. The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management process and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks, including cybersecurity.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Financial Officer ("CFO"), who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CFO was previously the chief financial officer for other mining companies where he was responsible for information technology security at such companies. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Our information technology systems may be vulnerable to disruption and cyberattacks, which could place our systems at risk from data loss, operational failure or compromise of confidential information." in this annual report on Form 10-K.


text: Risk Management & Strategy Shentel's Risk Management Program defines the framework for risk identification and assessment, including cybersecurity risks. Our overall Risk Management Program integrates processes for assessing, identifying and managing material risks from cybersecurity threats. Cybersecurity risks are identified through various means including, but not limited to, regularly conducted security assessments, external and internal penetration testing, data privacy assessments, external security evaluations, the testing and implementation, as applicable, of new technologies, and continuing education and awareness of existing and new threat vectors, industry trends, changes in the environment and changes in the overall technology landscape. Pursuant to our Information Security Program, once a cybersecurity risk is identified, the Information Security team, in collaboration with other areas of the organization, will assess the risk and implement an appropriate response. Security risk assessments comprise the reasonably foreseeable impacts to the Company and its stakeholders due to the threats and known vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.


text: To mitigate or address risks, Shentel leverages acceptable and well-known security tools and services allowing Shentel to maintain a robust security posture. Our Information Security Program addresses risks through a wide spectrum of measures, including enhanced monitoring, endpoint protection, multifactor authentication, privileged account security, web and email filtering and comprehensive internal employee training. Our security protocols are rooted in industry standards and guidelines issued by respected bodies such as the National Institute of Standards and Technology, the Department of Homeland Cybersecurity and Infrastructure Security Agency, and the Center for Internet Security. In addition, we regularly consult with external advisors regarding opportunities to enhance and strengthen our policies and practices.


text: With respect to third-party service providers, our Information Security Program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of actual or reasonably suspected information security incidents occurring on their systems that may affect our systems or data, including personal information.


text: Should a security breach or incident occur, the Chief Information Officer (the "CIO") in collaboration with the Company's General Counsel, Chief Accounting Officer (the "CAO") and Chief Operating Officer (the "COO") will evaluate the materiality of any specific incident. The Company's Chief Executive Officer (the "CEO") and Chief Financial Officer (the "CFO") will ultimately decide if an incident is material. Considerations of materiality will include a variety of factors, including, for example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.


text: The Information Security Program is intended to provide effective governance and oversight for assessing cybersecurity risks, recognizing that no program, no matter how well designed and implemented, can prevent all potential cybersecurity risks and that the benefits of any potential controls or mitigations should be considered in relation to their costs. While we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and threats have not materially affected our business strategy, results of operations or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 18 years of experience in the information technology and information security fields and the CIO has over 28 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.


text: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee periodically on cybersecurity and other information technology risks and opportunities. Additionally, the Audit Committee, with guidance from the CIO, General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually. In the case of an information security incident or breach, the Director of Information Security and CIO will follow the Company's Incident Response Plan and follow communication protocols within the plan, which, depending on the severity of the incident, include escalation timelines and responsibilities that involve updating the Audit Committee and the Board of Directors, as applicable.


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing monthly training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: The Company has engaged third parties to perform information security risk assessments and testing on a periodic basis. It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support security incident detection and response activities. In order to identify and manage risk from third parties, the Company has implemented a third-party cybersecurity risk management program involving the assessment of information security risk related to the third-party, with consideration given to the inherent risk level, the adequacy of the third-party's control environment to mitigate those risks, and areas of residual risk. The breadth and depth of the assessment activities are designed to be commensurate with the nature and scope of the services provided by the third party.


text: The oversight of the Company's cybersecurity risk management processes are integrated into the Company's enterprise risk management process. Our board of directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, to improve long-term organizational performance and to enhance stockholder value. A fundamental part of risk management is not only understanding the most significant risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for a given company. The involvement of our full board of directors in reviewing our business is an integral aspect of its assessment of management's tolerance for risk and also its determination of what constitutes an appropriate level of risk. In connection with its reviews of the operations of our business, the board of directors addresses the primary risks associated with our business including cybersecurity. In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business and operating results."


text: Cybersecurity Governance While our full board of directors has overall responsibility for risk oversight, it has delegated oversight of certain risks to its committees, including the oversight of risks from cybersecurity threats. The board of directors delegated the oversight of cybersecurity risks to the Audit, Risk and Finance Committee, which oversees controls for the Company's major financial and security risk exposures. The board of directors, through the Audit, Risk and Finance Committee, oversees the design and implementation of the Information Security Program. The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.


text: The Information Security group and senior leadership are responsible for assessing and managing risks from cybersecurity threats. The Information Security group is led by the Company's CISO, who is also responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.


text: The Information Security group, senior leadership and the CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Information Security Program. At least quarterly, the CISO provides updates to the Audit, Risk and Finance Committee, which includes updates on the overall Information Security Program status and compliance, cybersecurity related risks, and recommended changes to the Information Security Program. Senior members of our Information Security and Internal Audit functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee.


text: The consideration of cybersecurity threats are integrated into our overall risk management program. We engage external consultants who are experts in the field of cybersecurity and meet at regular intervals to evaluate current conditions and address any cybersecurity threats accordingly. We also provide continuous training to our employees regarding the risks related to cybersecurity. We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. Governance.

companyName: SenesTech, Inc.

ticker: SNES


text: Our board of directors are responsible for the oversight of risks from cybersecurity threats. At least annually management reports to our board of directors about such risks. Our chief financial officer, Thomas Chesterman, has direct management responsibility in assessing and managing such risks. Mr. Chesterman has prior academic and professional experience in cybersecurity.


text: Cyberattacks represent a threat to water, wastewater and electric utility systems. There have also been increasing threats to the information that companies maintain that have resulted in unauthorized disclosure of private customer, employee, director and corporate financial information.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition ("SCADA") system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage.


text: Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.


text: Registrant expects to continue to increase its investment in information technology to monitor and address cyber threats and attempted cyber-attacks, and to improve its posture in addressing security vulnerabilities. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.


text: Registrant has adopted a cybersecurity incident response policy, plan and set of specific instructions, which are annually reviewed by the IT cybersecurity team members. Registrant is also taking actions intended to strengthen its cybersecurity posture and to improve its cybersecurity incident response plans and operating procedures. Despite the actions Registrant has taken and is taking and the fact that, to its knowledge, it has yet to experience a cybersecurity incident, there can be no assurance that Registrant will not experience a cybersecurity incident.


text: Risk management, oversight and response Cyber risk management is an ongoing iterative process that requires continuous identification, assessment and management of possible cyber threats and has become a vital part of Registrant's overall risk management efforts. Registrant's cybersecurity team assesses ongoing cybersecurity threats and vulnerabilities to prioritize and implement mitigation factors and defense to help contain and combat identified risks.