text: The Company's Manager of Information Technology & Facilities (the "IT Manager") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the board of directors, in collaboration with relevant information technology personnel, insurance providers, legal counsel and, when necessary, external cybersecurity firms specializing in forensic investigations.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB

secItem: Item 1C


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Training sessions are held regularly at the senior and executive management levels to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Third-Party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

stage1Category: Strategy Integration

stage1Method: unanimous


text: Management's Role in Managing Risk The IT Manager plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Manager and members of senior management meet regularly and provide comprehensive briefings to both the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;

stage1Category: Management Role

stage1Method: majority


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Manager regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

stage1Category: Board Governance


text: Cyber Risk Management Personnel The IT Manager directly reports to senior management. The IT Manager regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our IT Manager, whose over eleven years of information technology experience in the financial services industry has provided him with in-depth knowledge and experience which are instrumental in developing and executing our cybersecurity strategies.


text: Monitoring Cybersecurity Incidents The IT Manager and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Manager provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

stage1Category: Risk Management Process


text: Risk management and strategy We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurirty risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the board as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant enviornements. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Executive VP and Chief Financial Officer evaluates material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular updates on cybersecurity program key metrics, outstanding vulnerabilities, and emerging cybersecurity risks.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Director of Information Technology, under the supervision of our Executive VP and Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Director of Information Technology is responsible for informing our Executive VP and Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Executive VP and Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Executive VP and Chief Financial Officer.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving operational continuity and the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management has been delegated to the Audit, Finance and Risk Committee of the Board (the "Audit Committee"), which interacts with the Company's ERM function, the Company's Global Vice President of Information Technology, the Company's Director of Cyber Security, and other members of management and relevant management committees and councils.


text: Collaborative Approach: The Company has adopted a cross-functional approach toward identifying, prioritizing, and implementing the means to protect information technology systems and its employees from cybersecurity threats. Additionally, the Company has established communications protocols and processes to escalate cybersecurity incidents to engage management as needed to make timely decisions regarding incident response, recovery, and any required disclosures.


text: Technical Safeguards: The Company uses an array of complex technologies and services to protect its information systems and employees from cybersecurity threats. Examples include firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. These safeguards are evaluated and improved through learnings derived from vulnerability assessments, penetration tests, and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has defined and maintains cross-functional incident response and recovery plans that will guide the Company's response to a cybersecurity incident. These plans are reviewed by senior management and are evaluated through tabletop exercises on a regular basis.


text: Third-Party Risk Management: The Company uses a risk-based approach to identify and manage cybersecurity risks from third parties, including vendors and service providers. The focus of these efforts is to identify and mitigate threats that could impact Company operations.

stage1Category: Third-Party Risk


text: Education and Awareness: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.


text: The Company engages third parties in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, vulnerability assessments, tabletop exercises, and other activities focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments influence the Company's tuning of cybersecurity policies, standards, processes and practices, the results of which are shared with the Board and the Audit Committee.


text: The Global Vice President of Information Technology and Director of Cyber Security work in close partnership with the Company's senior leadership team to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. This collaboration work includes activities in support of the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and to report such threats and incidents to the Audit Committee and others when appropriate.


text: The Global Vice President of Information Technology earned a Bachelor of Science Degree in Management Information Systems from Western Connecticut State University and has served in various roles in information technology and information security for over 30 years, including serving in leadership roles of two large public companies. The Director of Cyber Security earned a Bachelor's Degree in Information Systems from Western New England University and has extensive cybersecurity leadership experience, including expertise in threat data analytics, digital forensics, and data recovery. Prior to joining the Company, the Director of Cyber Security formed and served as CEO of a successful incident response and cybersecurity consulting firm.


text: Impacts of Cybersecurity Threats To date, there have been no cyber security threats or incidents that have materially impacted our operations or financial condition. However, as a result of risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we continue to allocate substantial resources to sustain and enhance our cyber security capabilities, which allocation of resources has in turn materially affected our business strategy and processes. Despite these investments, we cannot be certain that the protective measures and processes implemented will be successful or adequate to counter all current and emerging risks and threats. A significant cybersecurity incident involving our systems and data, or those of our customers, business partners or vendors, could have a materially adverse effect on our business strategy, results of operations and financial condition.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards. These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.


text: The Company's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.


text: We recognize the importance of developing, implementing, and maintaining processes for assessing, identifying and managing material risks from cybersecurity threats.

companyName: HURCO COMPANIES INC

ticker: HURC


text: Risk Management and Strategy We continue to invest in strengthening our cybersecurity strategy and platform and, as specifically set forth below, have integrated cybersecurity risk management into our broader enterprise risk management process. This integration will promote cybersecurity considerations as an integral part of our decision-making processes and operational practices. Our information technology department works closely with our senior management team to consistently identify, evaluate, and manage cybersecurity risks in alignment with our business strategy and objectives and operational needs.


text: cross-functional teams responsible for managing the Company's (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: We regularly monitor alerts from governmental authorities and industry experts, as well as third party system and organizational controls reports, to remain informed about prevailing and developing cybersecurity threats and bad actor tactics. We also periodically engage third party consultants to conduct independent assessments of our cybersecurity readiness and control effectiveness; to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices; and to inform our cybersecurity strategy. Further, we work with third party experts and leverage external resources to evaluate known vulnerabilities in existing systems and provide remediation steps, as appropriate, and/or otherwise further protect the organization from cyber risk or threats, in each case including cybersecurity threats associated with our use of any third-party service provider.


text: Based upon results of the foregoing, we deploy a wide variety of technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced endpoint detection and response, next-generation firewalls with intrusion detection systems, access and credential controls, and multifactor authentication. We have also developed, implemented, and maintain a cyber incident response plan, which is periodically reviewed and updated and includes procedures for addressing and recovering from cyber incidents while reducing the impact on the business and operations. This plan provides a framework for identifying, controlling, and mitigating the attack while reducing the recovery time and keeping the executive management team and Audit Committee of our Board of Directors informed.


text: Notably, our cybersecurity strategy and incident response plan intentionally prioritize frequent and automated backup and recovery processes in an attempt to minimize the potential for critical data loss and/or business interruption. In doing so, we use systems that provide immutable backup and recovery of files and virtual machines, encryption of data at rest and in transit to protect against unauthorized access, and transmission of copies offsite at predetermined, recurring, and frequent intervals.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors oversees cybersecurity risk management as part of its risk oversight function and oversees the design and effectiveness of management's implementation of our cybersecurity risk management program, procedures, and contingency plans. Senior management plays a critical role in informing the Audit Committee on cybersecurity risks. More specifically, the information technology department regularly informs executive management, including the Chief Executive Officer, Chief Financial Officer and General Counsel, on all aspects pertaining to cybersecurity risks and incidents; and the Audit Committee receives periodic reports from executive management, senior information technology leadership, and risk management personnel on our cybersecurity and information security risks and postures on a regular basis. These periodic reports include detailed updates on our activities preparing for, preventing, detecting, responding to, and recovering from cyber incidents, if applicable.


text: Senior management with primary oversight responsibility for day-to-day cybersecurity risk management includes our Chief Executive Officer, Chief Financial Officer, Director of Information Technology, General Counsel, Corporate Controller, and Chief Accounting Officer. The group's collective education and experience informs our cybersecurity risk assessment and management process and includes, among others, the following: higher education degrees (including master's level or equivalent) in computer science and/or technology; decades of experience in the information technology and computer science field; experience configuring and maintaining firewalls, VPNs, and endpoint security frameworks for sophisticated, multinational organizations; proficiency in programming languages; certifications as developers and network engineers; and responsibility for managing large-scale international implementations of enterprise resource planning software systems for global companies.


text: Risk Management and Strategy Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas. This integration ensures a holistic approach to risk management, enabling us to address cybersecurity risks in the context of broader organizational risks.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: We build and evaluate our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The NIST CSF offers a thorough set of guidelines and best practices to help us establish a strong cybersecurity posture. Utilizing the NIST CSF enables us to systematically identify, assess, and manage cybersecurity risks pertinent to our business operations. However, it's important to highlight that using the NIST CSF as a guide does not imply that our cybersecurity program meets any specific technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is grounded in a zero-trust framework and employs a multi-layered approach to ensure comprehensive protection. This approach includes:


text: Awareness and Training for Employees: We conduct regular phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats. These initiatives aim to enhance employee awareness and preparedness against potential cyber threats.


text: Security Tools and Technologies: We utilize advanced security tools and technologies, along with control policies and active review procedures, to strengthen authentication and access protection. This includes implementing multi-factor authentication, encryption, and continuous monitoring of network activities.


text: Third-Party Risk Management: We have established a rigorous third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information. This ensures that our partners adhere to our cybersecurity standards and do not introduce vulnerabilities into our environment.


text: Risk and Vulnerability Management: Our risk and vulnerability management program encompasses both proactive and predictive defenses. We regularly assess, remediate, and validate our security measures to address emerging threats and vulnerabilities. This includes conducting vulnerability scans, penetration testing, and threat intelligence analysis.


text: Managed Detection and Incident Response: We employ advanced endpoint protection and managed detection and response services to quickly identify and respond to potential security incidents. Our incident response team is equipped to handle various types of cyber threats and minimize their impact on our operations.


text: In evaluating the risks identified as a part of the annual assessment process, our information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk, including any potential impact on our customers and our employees. These risks are then prioritized and monitored by the information technology team.


text: We conduct periodic testing of software, hardware, defensive capabilities, and other information security systems to assess our cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, we consider both our individual risks and industry standards.


text: The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact on us, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.


text: The information technology department, led by our Director of Information Technology & Services ("IT Director"), is responsible for our cybersecurity program. The IT Director, along with a third party provider with significant cybersecurity experience, manages information security, infrastructure, and compliance. This collaboration ensures that our cybersecurity practices are aligned with industry standards and best practices.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Audit Committee receives briefings from the IT Director regarding our cybersecurity risk management program at least annually. These briefings include updates on our cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of CTO, a publicly traded diversified REIT. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: As an externally managed company, the Company relies on CTO's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.


text: CTO's cybersecurity processes and practices are integrated into CTO's risk management and oversight program. In general, CTO seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that CTO collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. CTO utilizes a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's management team.


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.


text: Technical Safeguards: CTO and the MSP deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: CTO and the MSP have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan is tested and evaluated on a regular basis.


text: Third-Party Risk Management: CTO and the MSP maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of CTO's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: CTO, through the MSP, provides regular training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: CTO and the MSP engage in the periodic assessment and testing of CTO's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of CTO's cybersecurity measures and planning. The MSP regularly assesses CTO's cybersecurity measures, including information security maturity, and regularly reviews CTO's information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and CTO will adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.


text: As noted above, the Company relies on CTO's information systems and the MSP in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect CTO's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with written information security incident response plans adopted by CTO and the Company. These members of CTO's management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at CTO, the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented an information security and cybersecurity risk management program ("Program") intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems. Our Program takes a risk-based approach and is integrated into our overall enterprise risk management program. We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a benchmark to ensure that our Program is maintained in line with industry best practices. This does not imply that we meet any particular technical standards, specifications or requirements, but it does mean that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system. This means that if any business unit's systems are compromised, there is less risk that another business unit will be impacted by that event. This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.


text: periodic risk assessments and penetration tests, which are integrated within our enterprise risk management framework processes, designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any); annual management reporting to the Board;


text: reporting of the scope, objectives and results of internal audits on the procedures performed to validate the effectiveness of our control environment related to our information security systems and security controls to the Audit Committee at least two times a year;


text: annual cybersecurity awareness training, including phishing simulation campaigns, to educate employees on recognizing cybersecurity threats and preventing actions that could unintentionally grant unauthorized access to our systems;


text: deployment of endpoint protection software, supported by external managed services, to attempt to proactively detect and block malicious code from affecting our systems; a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess risk, monitor alerts, perform penetration testing or otherwise assist with aspects of our security controls and response to cybersecurity incidents; and a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior security breach, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition and results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a discussion of certain risks related to cybersecurity, refer to the risk factor titled " Cybersecurity incidents affecting our information technology systems could disrupt business operations or cause the release of highly sensitive confidential or personal information, resulting in adverse impacts to our reputation and operating results and potentially leading to litigation and/or governmental investigations, fines and other penalties " in Part I, Item 1A. Risk Factors herein.


text: The Company assesses its program based on guidance from the National Institute of Standards and Technology ("NIST"). This does not imply that the Company meets any particular technical standards, specifications, or requirements, only that the Company uses the NIST as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business.


text: Cybersecurity Governance Our Board maintains oversight responsibility relating to our Program, with assistance from the Audit Committee. At least annually, our management team (including the leaders of our Information Technology and Internal Audit teams) provides an update regarding our Program to the Board. This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year. The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any significant cybersecurity incidents.


text: Our management team, including our Senior Vice President and Chief Financial Officer, Senior Vice President and General Counsel, Vice President, Information Technology, and Vice President, Internal Audit, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our Program and our Vice President, Information Technology, supervises both our internal information security personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel and external consultants engaged by us, as well as alerts and reports produced by security tools deployed in our information technology environment.


text: Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis and corporate governance. For additional details about our management team and their experience, refer to the Executive Leadership page on the Company's website at https://www.amphenol.com/governance/leadership.


text: Risk Management and Strategy The company maintains a multi-layered approach to cybersecurity risk management which leverages technology and human oversight. The company uses active and passive methods designed to continuously monitor information systems and assess, identify, and manage potential vulnerabilities and threats. This digital-security management process is integrated into the company's broader enterprise risk management framework.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: The company utilizes active monitoring techniques (e.g., penetration testing), designed to leverage multiple sources of threat intelligence and vulnerability scanning complemented by endpoint protection and network systems. The company has a rapid-response protocol designed to investigate system alerts of potential cybersecurity threats, and the company's incident response plan provides a structured approach to inter-departmental assessment, mitigation, and resolution of cybersecurity threats. The company conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program.


text: The company maintains strategic relationships with third-party cybersecurity experts and coordinates with various law-enforcement partners, each of whom may be engaged to provide additional investigative and remediation support. The company's senior security leadership conducts periodic, in-depth reviews with the company's enterprise risk management team and internal and external auditors to evaluate the effectiveness of the company's cybersecurity systems, controls, and management processes.


text: The company conducts a security assessment for potential suppliers and service providers, which includes detailed interviews, questionnaires, and cyber-risk scoring. This process extends beyond initial engagement, with ongoing monitoring to identify emerging security risks or changes in suppliers' risk profiles.


text: The company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the company under the heading "Cybersecurity incidents may hurt the company's business, damage its reputation, increase its costs, and cause losses," included as part of the company's risk factor disclosures in Item 1A of this Annual Report on Form 10-K. To date, the company is not aware of any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the company, including its financial condition, results of operations, or business strategies.


text: The Board of Directors of the company (the "Board"), primarily through its Audit Committee, oversees the company's cybersecurity program. The company's CIO and CSO regularly report to the Audit Committee on the current state of the company's cybersecurity program (including the current threat landscape, cybersecurity risks, and any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for enhancements that the Audit Committee deems appropriate.


text: The CIO and CSO receive regular reports from the company's cybersecurity department, both historical and real-time, about the company's global cybersecurity status. The company believes this approach enables the CIO and CSO to monitor the company's global security status and to identify and assess potential threats. The company has established written policies and procedures to ensure that cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). The company's security organization assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to the management team. If management determines a cybersecurity incident is material, the company's incident response plan and its disclosure controls and procedures set forth the process for any required disclosures and require management to promptly inform the Board.


text: Under the direction of the CIO, the CSO is responsible for global cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, physical security, fraud and security awareness and training. The CSO has over 20 years of security experience and holds a degree in IT and cybersecurity, along with maintaining certifications in risk, information security, data privacy, legal investigations, and audit, among other disciplines. The other members of the company's security organization also have extensive cybersecurity, business, and technology experience and all hold certifications in their area of expertise.


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have a comprehensive and systematic cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program follows a risk-based approach, which prioritizes the cybersecurity risks according to their likelihood and impact and allocates the appropriate resources and actions to mitigate these risks and leverages the National Institute of Standards and Technology (NIST) framework.

companyName: AGREE REALTY CORP

ticker: ADC


text: The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants and board oversight. The program is reviewed and updated on a monthly basis, or whenever there is a significant change in our environment, operations, or objectives.


text: Engagement and Oversight of Third-parties We have contracted a reputable, global third-party external Security Operations Center ("SOC") to ensure that cybersecurity processes, tools, and monitoring are operating continuously. The SOC service provides a holistic view of our security landscape using a cloud-native Security Incident & Event Management platform, removing security siloes to gain actionable insights and providing continuous 24/7 detect and response services, as well as proactively identifying threats to prevent security disruptions.


text: We engage the SOC on a regular basis to conduct external audits and assessments of our cybersecurity posture and performance. The SOC provides independent and objective feedback and recommendations on how to improve our cybersecurity strategy, policies, processes, and controls. The SOC also assists the Company in identifying and prioritizing the most critical and emerging cybersecurity risks and threats, and to align our cybersecurity initiatives with the best practices and standards in the industry.


text: We also have a robust and rigorous oversight process for managing cybersecurity risks related to our third-party service providers. The process includes: conducting due diligence and background checks on the potential service providers; verifying their cybersecurity credentials, capabilities, and track record;


text: establishing clear and specific contractual terms and conditions regarding the Company's cybersecurity expectations, obligations, and the responsibilities of the service providers;


text: conduct quarterly business reviews of service providers including security operations performance and recommendations; and monitoring and auditing the service providers' performance, compliance, reporting and escalation procedures for any cybersecurity issues or incidents identified through quarterly business reviews.


text: Risks from Cybersecurity Threats While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - We face risks relating to information technology and cybersecurity attacks, loss of confidential information and other business disruptions " and "Item 1A – Risk Factors - The use of artificial intelligence presents risks and challenges that may adversely impact our business and operating results or that of our tenants ".


text: Board of Directors' Oversight Our board of directors takes an active and informed role in our risk management policies and strategies. Our executive officers, which are responsible for our day-to-day risk management practices, present to the board of directors on the material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity and is responsible for reviewing the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, the Chief Information Officer ("CIO") provides quarterly updates to the audit committee with respect to security improvement projects, cybersecurity incidents, mitigation, and management.


text: Management's Role Managing Risk Our CIO is responsible for developing and overseeing matters related to cybersecurity and serves as the Company's Chief Information Security Officer. The CIO has over 25 years of experience in information technology and is certified as an IT Business Relationship Management Professional (BRMP), Six Sigma Blackbelt and Lean Office Champion. The CIO reports directly to the Chief Operating Officer, who is accountable for the overall information technology and security strategy and governance of the Company.


text: We have a comprehensive and continuous cybersecurity training program for our employees, which aims to raise their awareness and knowledge of cybersecurity threats and challenges, and to enhance their skills and competencies in preventing and responding to the cybersecurity incidents. The program covers the Company's cybersecurity policies, guidelines, cybersecurity best practice guidelines, cybersecurity scenarios and simulations.


text: In connection with improving the management of cybersecurity risk, the Company has: audited our systems with the help of information security consultants; completed ransomware simulations and enhanced our Disaster Recovery and Business Continuity Plan to reflect lessons learned;


text: implemented information security policies to monitor for and notify if personnel take potentially malicious actions against the company, such as forwarding sensitive emails or uploading data to non-approved cloud services; conducted recovery simulation of our proprietary database to determine restoration timing;


text: conducted penetration testing and remediated all issues identified; and enhanced e-mail filtering software to limit the possibility of phishing or ransomware attacks.


text: Monitor Cybersecurity Incidents We have a well-defined and tested cybersecurity incident response plan, which outlines the roles and responsibilities, procedures and protocols, tools and resources, and communication and escalation channels that will be activated and implemented in the event of a cybersecurity incident. The plan aims to detect and contain the incident, analyze and assess its nature, scope, and severity, and restore and resume the normal operations and functions of the Company.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: We do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See "Security breaches and other disruptions could compromise our information and expose us to liability, which could cause our business and reputation to suffer." in "Item 1A. Risk Factors" for additional information.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 15 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.


text: In an effort to protect our resources from cyber threats, we maintain a security program that includes multiple layers designed to prevent, mitigate, detect, defend against, and remediate these threats. These include, but are not limited to, continuous vulnerability assessment and remediation, annual penetration testing conducted by a third party, security and monitoring tools that are monitored by a 24x7 SOC (Security Operations Center) and Incident Response Planning. Additionally, all employees are required to take annual cyber security training that aligns with our risks and current cyber trends such as ransomware, BEC (business email compromise,) phishing, and social engineering.


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, our gathering and compression and water handling services, processing and recording financial and operating data, oversight and analysis of our operations and communications with the employees supporting our operations and our customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: Antero Midstream Corp

ticker: AM


text: Attacks on our assets or security breaches in our systems or infrastructure could lead to the corruption, loss or unauthorized use of such data, delays in production or delivery of our production to customers, difficulty in completing and settling transactions, challenges in maintaining our books and records, environmental damage, communication interruptions or other operational disruptions. We seek to address these risks by safeguarding assets, data and operations through the cybersecurity risk management processes described below:


text: Risk Assessments We assess our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities via continuous automated processes that are complemented by manual processes that are executed on both a routine and ad hoc basis. These processes are designed to prevent, detect and investigate activities and events that could pose a cybersecurity risk or threat to us, and include, but are not limited to, monitoring and evaluating cybersecurity intelligence information published or provided by certain United States federal government agencies as well as private cybersecurity groups. Our risk assessment processes are conducted, monitored and reviewed by our security and compliance team as well as third-party consultants. In addition, we perform cybersecurity tabletop exercises with our information technology ("IT") department throughout the year. We also engage a third-party consultant to conduct an annual penetration test of our systems, networks and data infrastructure to complement our risk assessment processes and activities. These risk assessments help evaluate the likelihood and potential impact of cybersecurity incidents.


text: Our Vice President – IT oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: We monitor and manage our cybersecurity risk and threat exposure through prioritized remediation efforts. Any cybersecurity risk or threat that requires corrective action is managed by our security and compliance team together with certain business partners and IT specialists, as deemed necessary. Potential solutions are assessed in alignment with risk, business and cybersecurity priorities and our controls and security architecture. Plans to remediate cybersecurity risks are approved and monitored regularly for completion.


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our Vice President – IT to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.


text: Cybersecurity Training and Awareness We train our users throughout the year using a wide variety of methods on cybersecurity-related topics, including how to identify and report potential social engineering including phishing through emails, text messages and phone calls. Formal training on cybersecurity practices begins when an employee is hired and is re-administered annually. We also require third-party contractors with access to our systems be trained on these topics. In addition, special training is held both formally and informally for groups that entail higher threat risks.


text: Our IT polices are designed to address and manage all aspects of our IT environment, including cybersecurity, and we review and update our policies regularly as part of our risk management processes. We deploy both an internal Protection of Personal Identifiable Information Policy and a publicly available Privacy Notice to help us understand and respect the privacy of the individuals whose data we have custody over. We monitor our data collection practices, policies and notices in an effort to comply with the evolving nature of applicable data privacy and security laws.


text: Our cybersecurity risk management processes are integrated into our enterprise risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered to be an important component of our enterprise risk management approach. Our cybersecurity strategies are based on standard cybersecurity frameworks, including the National Institute of Standards and Technology and the International Organization for Standardization.


companyName: ANTERO RESOURCES Corp

ticker: AR


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our Vice President – IT, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our Vice President – IT oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our Vice President – IT regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or similar role, which included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy distribution and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.

stage1Category: None/Other


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or in similar roles, which have included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy production, distribution, and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.


text: Cybersecurity Risk Management and Strategy The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and information.


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of the providers' criticality to its business and the providers' cybersecurity risk profile.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Cybersecurity and Data Privacy."


text: Cybersecurity Governance The Company's Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of the Company's cybersecurity risk management program.


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Human Resources and Technology Officer (the "CHRTO").


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CHRTO or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CHRTO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes the Company's CHRTO, who has more than 20 years of experience across various industries, and the Company's Director of Cybersecurity, who has 29 years of IT experience, including eight years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.


text: The Cybersecurity Steering Committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by the Company; and alerts and reports produced by security tools deployed in the IT environment.


text: Our business relies on computer systems to provide customer information, process customer transactions, communicate, and provide other general information necessary to manage our business. We also rely on a payment card industry- compliant third party to protect our customers' credit card information.

companyName: Waste Connections, Inc.

ticker: WCN


text: We assess, identify and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security team is directed at protecting all aspects of data and how information is stored, transmitted, processed and used in business processes.


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has served in that role with us since 2004 and has extensive experience with cybersecurity and information technology at the Company.


text: Our vendor risk management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. We also have requirements for third-party service providers which include regulatory compliance and meeting NIST Cybersecurity Framework policy and standards. Our agreements with third-party service providers include cybersecurity provisions to address risks.


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology, including through the use of Artificial Intelligence (AI), in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."


text: Cybersecurity is an integral part of risk management at Nabors. We rely on our technology infrastructure and information systems to interact with clients, vendors, operate our drilling rigs, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, mitigation, and preparedness for recovery of any such incidents whether perpetrated on the Company or our stakeholders. The Risk Oversight Committee of our Board has direct oversight of our management of cybersecurity risks.


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology. Our Enterprise Risk Management Committee and our Vice President of Information Technology report to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;


text: We have a cross-functional approach to addressing cybersecurity risk, with digital technology, legal, and the corporate audit functions presenting to the Enterprise Risk Management Committee on key cybersecurity topics; and On at least an annual basis, the full Board of Directors receives a comprehensive cybersecurity review, including director education from third-party cybersecurity experts.


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity Governance reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity Governance has over 15 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.


text: The Technology and Safety Committee of the Board of Directors reviews the integrity of information technology systems, including the potential for cybersecurity threats. In addition, the Risk Oversight Committee monitors management's identification and evaluation of major strategic, operational, regulatory, information technology, cyber security and other external risks inherent in the Company's business. Activities include mandatory training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. The Enterprise Incident Response Team also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Enterprise Incident Response Team escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: We leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to drive strategic direction and maturity improvement and engage third-party security experts to conduct risk assessments and program enhancements. Additionally, we evaluate our controls environment annually using other relevant standards like Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model.


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Our approach to mitigating information technology and cybersecurity risk comprises a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of our critical IT Systems and information related to our business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, we have aligned our cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines. For example, we have aligned our processes with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and assess our cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKYWEST INC

ticker: SKYW


text: Our cybersecurity risk management processes include a cybersecurity incident response plan, and we have invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to our IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom we may share data, and regular system reviews and security exercises. Our cybersecurity risk management program is a component of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: While we work closely with accredited third-party cybersecurity firms, where appropriate, to audit our security architecture, our Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing our cybersecurity risk assessment processes, our security processes, and our response to cybersecurity incidents.


text: For the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Audit Committee members also receive presentations on cybersecurity topics from our Vice President of Information Technology and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer and Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Vice President of Information Technology has more than 25 years of experience managing and leading IT and cybersecurity teams. Our Vice President of Information Technology participates in the Aviation ISAC organization, an international membership community of airframers, airlines, airports, satellite manufacturers, aviation services, and their supply chains that collaborate to prevent, detect, respond to, and remediate cyber risk through threat intelligence sharing and best practices.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Governance Related to Cybersecurity Risks Our management, with involvement and input from our audit committee, performs an annual enterprise-wide risk management (ERM) assessment to identify and manage key existing and emerging risks for our company. Our ERM process seeks to identify both the potential impacts to our company of a particular risk and the likelihood and proximity of any such risk. Our management team is responsible for implementing and overseeing our ERM process. Cybersecurity is among the risks identified for board of directors' level risk oversight as a result of our most recent ERM assessment, with our audit committee of the board of directors having been delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks.

companyName: Blueprint Medicines Corp


text: Our information security team is led by the SVP of IS, who reports to our chief financial officer. Our SVP of IS has over 25 years of experience managing and securing technology infrastructure. The information security team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The information security team also institutes and maintains controls for our systems, applications, and databases.


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any notable cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.