text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday's business strategy. Additionally, the Board has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.


text: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer ("CISO"). Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.

companyName: Workday, Inc.

ticker: WDAY

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Our CISO leads all aspects of our global cybersecurity program. Our CISO joined Workday in 2010 and has served as our CISO since April 2018. Our CISO has more than 20 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm. He also has a degree in information systems management.

stage1Category: Management Role


text: Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks. This team includes our CIO and our Chief Legal Counsel. This team contributes to the development of our cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions. This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.


text: Cybersecurity Risk Oversight and Risk Assessment We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: BOISE CASCADE Co

ticker: BCC

stage1Category: None/Other


text: One of the key functions of our board of directors is to provide informed oversight of our risk management processes. While management is assigned responsibility for the day-to-day response to material risks we face, our board of directors maintains responsibility for risk oversight, including risks related to cybersecurity threats. The Audit Committee of our board of directors is responsible for discussing risk exposures relating to cybersecurity, including current and emerging developments and threats, and the steps management has taken to monitor and control such exposures. The Audit Committee is composed of board members with diverse expertise, including financial, governance, and information security and controls, which equips them to oversee cybersecurity risks effectively.

stage1Method: majority


text: Our cybersecurity risk identification and assessment process is integrated into our enterprise risk management process. Our board of directors and key members of management across the organization rank previously identified risks, identify new or emerging risks, and provide commentary on the financial or strategic impact these risks could have on the Company. The risk survey responses are analyzed in the context of our business, recommendations are made where appropriate, and ownership of risk response is assigned to specific individuals. The results of this process are presented to our board of directors at least annually. In addition, our Information Technology (IT) Director provides quarterly updates to our board of directors on cybersecurity incidents, cybersecurity awareness activities, including results of mock-phishing exercises, regulatory and compliance matters specific to cybersecurity, and activities related to business continuity, including data validation and restore testing and tabletop exercises. Risk assessment for cybersecurity threats is embedded into these quarterly updates, with each topic discussed being assigned a risk level.

stage1Category: Risk Management Process


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT Director. Our current IT Director has been in his position since 2014 and has over 30 years of information technology, finance, and operational experience in our organization. Our IT Director is certified in governance of enterprise IT (CGEIT), is a Certified Data Privacy Solutions Engineer (CDPSE) and a Certified Information Systems Auditor (CISA). Our IT Director and other IT leaders systematically use the Control Objectives for Information and Related Technology (COBIT) framework as an IT governance framework and remain educated on other best practices in compliance, projects, and processes. In addition, our IT Director reviews our operational plan annually with our operating segments, which includes review and discussion of a cybersecurity risk management framework.


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRCO for purposes of informing the CRCO on related risks. The cybersecurity risk management function under the CRCO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.

companyName: Federal Home Loan Bank of Indianapolis


text: Our information services department, led by our IT Director, manages and continually enhances our information systems with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We work to install new and upgrade existing information technology systems. We recognize the importance of preventative controls in mitigating the risk from cybersecurity threats and have implemented measures such as anti-virus security, two-factor authentication, web filtering, browser isolation tools, and mobility safeguards to enable enhanced security on personal devices. In addition, we provide mandatory cybersecurity training to our employees around phishing, malware, and other cybersecurity risks to ensure that we are protected, to the greatest extent possible, against cybersecurity risks and security breaches.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage independent third parties to penetration test our systems, consult on security enhancements, and perform industrial control system audits. In addition, our IT-related internal controls over financial reporting are audited by our independent external auditors. These practices allow us to leverage specialized knowledge and insights, identify risks, and continuously improve our information technology internal controls and processes to respond to the evolving cybersecurity threats.


text: We also acknowledge the risks associated with third-party service providers. We employ a risk-based due diligence process of engaging and managing third-party relationships. The third-party management program is integrated into our enterprise risk management process to measure risks and evaluate current and evolving resource needs. We perform risk assessments of new and existing service providers, develop and maintain a proactive approach to address non-compliance, and establish monitoring plans based on risk scores. This process continues throughout the lifecycle of the third-party relationship. Initially, new third parties are segmented into risk categories based on reputational/sanction screenings, geographical location, contractual obligations, financial arrangements, data transfer/sharing agreements, subcontractor/additional entity relationships of the third party, and business relationship oversight feedback. When the ongoing risk monitoring identifies a change in risk profiles, monitoring plans are adjusted as appropriate to ensure proper controls are in place and due diligence is applied to mitigate higher-risk relationships. These practices are designed to mitigate risks related to data breaches and other security incidents originating from third-party service providers.

stage1Category: Third-Party Risk


text: Monitoring and Responding to Cybersecurity Incidents and Data Breaches Management reduces the risk of cyber incidents by monitoring network traffic through security controls, including firewalls, intrusion detection/prevention systems, anti-virus/anti-malware systems, cyber threat intelligence, and vulnerability monitoring tools. We use extended detection and response (XDR) technology to integrate network, endpoint, and cloud data to stop sophisticated attacks by detecting malware and exploit threats, including using artificial intelligence (AI) behavioral analytics. We also partner with a security operation center (SOC) to provide 24-7 outside monitoring services for additional support to the internal IT team.


text: We have an established cross-functional IT incident response team, which includes our IT Director, to respond to cyber incidents effectively and to coordinate communications that may be necessary in the event of an incident. The incident response team has a prescriptive plan to track cyber incidents and responses and has established communication protocols when an event occurs, enabling better reporting of such events. Our incident response plan includes involving law enforcement, as needed, depending on the nature of the attack. Members of the IT incident response team and data breach team, discussed in more detail below, maintain relationships with key suppliers and other entities in order to collaborate and communicate about ongoing cyber threats that may impact the Company.


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of the data breach response team members, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.


text: In addition, we perform quarterly incident response and data breach tabletop exercises, which are simulations of cybersecurity incidents that are designed to test the effectiveness of our incident and data breach response plans. These exercises identify potential process improvements, opportunities to enhance the incident and data breach response plans and help prepare for actual cybersecurity incidents.


text: Incident Response and Recovery Planning: We have established and maintain a cybersecurity incident response plan that addresses our response to a cybersecurity incident.

companyName: VERACYTE, INC.

ticker: VCYT


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage independent third parties to penetration test our systems, consult on security enhancements, and perform industrial control system audits. In addition, our IT-related internal controls over financial reporting are audited by both our internal auditors and independent external auditors. These practices allow us to leverage specialized knowledge and insights, identify risks, and continuously improve our information technology internal controls and processes to respond to the evolving cybersecurity threats.


text: Identify and assess cybersecurity risks through a variety of methods, including audits to information security standards, threat testing, and vulnerability scanning. Prioritize risks based on their potential severity, likelihood, and detectability.

companyName: NVE CORP /NEW/

ticker: NVEC


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a data breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of each team member, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.


text: We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, we have made it a priority to ensure the risk of cybersecurity threats is integrated into our risk assessment and risk management processes.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 21.

companyName: Federal Home Loan Bank of Chicago


text: In alignment with industry standards, such as the National Institute of Standards of Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risks through a layered approach throughout our environment and in our service provider arrangements, including software-as-a-service and infrastructure-as-a-service engagements. We look to continuously improve our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk management program, which works in tandem with the Bank's Enterprise Risk Management program, includes risk management practices, procedures, and technology solutions aimed at addressing potential cybersecurity threats faced by the Bank in alignment with the Bank's strategic plans, risks tolerance, and enterprise operational risk policy. Cybersecurity risk-mitigation processes include, but are not limited to, performing regular risk assessments to identify, understand and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, real-time network monitoring; on-going employee training to educate employees on how to identify and avoid various forms of social engineering; performing routine threat monitoring (including use of a third party service provider monitoring) and controls testing; and maintaining a vulnerability management program to timely identify and remediate cybersecurity risks. The Bank also maintains a Cyber Security Incident Response Plan (CSIRP) to determine how cybersecurity threats and incidents are identified, classified, escalated, mitigated and remedied. The CSIRP is implemented and maintained by the Bank's threat and incident response team and overseen by our Chief Information Security Officer (CISO). Additionally, the Bank maintains a business resiliency management program to mitigate and respond to critical disruptive events (such as fire, cybersecurity incidents, and power loss). Our business resiliency management program (as further discussed below) includes, but is not limited to, testing our disaster recovery plans and reviewing department level business continuity procedures.


text: We regularly engage with third parties, including cybersecurity experts, to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews. Additionally, the Bank seeks to identify, monitor and prioritize substantial risks from cybersecurity threats associated with our use of critical third parties. As part of its risk assessment, the Bank endeavors to use the information obtained from these efforts to reach a reasonable conclusion as to that third party's cyber risk management protocols.


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans.


text: During the period covered by this report, the risk from cybersecurity threats or incidents did not have a material impact on our strategy, results of operations, or financial condition. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident may result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of data, as well as the likely extent and effect of lost revenue, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank' risk tolerance conditions. Our Board of Directors provides oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated) controls.


text: Our Bank Operational Risk Oversight Committee (OROC) (a management level committee, consisting of members of our senior leadership) and its subcommittee, the Technology Risk Sub-Committee (TRSC) (consisting of representatives across the Bank, including from the Risk Management and Information Technology groups), are responsible for reviewing our cybersecurity risk management program's efforts and activities to track the progress of the program's support of the Bank's objectives. TRSC (and to the extent necessary, OROC) receives regular reporting from our CISO including information security metrics, material technology changes and cybersecurity threats being monitored. The Bank's Executive Team is the primary management committee for the Bank across all functions and receives reports from the OROC, Technology Risk Sub-Committee, and the CISO as appropriate on matters impacting cybersecurity risks.


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 13 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.


text: Our business resiliency management program is overseen by our Board of Directors and its Operations and Technology Committee, which provides oversight of the Bank's implementation of the program and maintenance of the plans that reflect the Bank's current operating environment and risk tolerance. The implementation of our business resiliency management program is delegated to our Executive Team and their designees, and the Bank's OROC is responsible for the direct governance, oversight and monitoring of the program.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 18.


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management program. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.


text: Cybersecurity Governance Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank's risk tolerance conditions. Our Board of Directors provides Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated)


text: oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and controls.


text: Cybersecurity Governance Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors and our Management Committee, the Bank's highest-level governance, strategic planning, oversight, and policymaking group, on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.

companyName: Federal Home Loan Bank of Boston


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 14 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risk, which includes intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risk can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering, such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. Refer to Item 1A — Risk Factors for a description of cybersecurity and other operational risks that may affect our information technology assets and data under our control.


text: In alignment with industry standards, such as the NIST Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.


text: We also maintain a business continuity program designed to ensure that resources and plans are in place to protect the Bank from potential loss during a disruption, which includes the unavailability of our information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. These business continuity resources and plans include, but are not limited to, maintaining a business continuity site to ensure continued operations, regular backing up of data and systems, testing our ability to operate on disaster recovery systems, and annually reviewing department level business continuity procedures.


text: We regularly engage with third parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, incident response exercises, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews.


text: Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents during the period covered by this report. However, to assess, identify, and manage risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested, and expect to continue to invest, significant resources to maintain and enhance our information security and business continuity programs designed to preserve the confidentiality, integrity, and availability of our information technology assets and data under our control. As a result, the risk of cybersecurity threats has materially affected our business strategy. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of each cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members, any loss of or unauthorized access to data, lost revenue, increased operating costs, litigation, and reputational harm.


text: The CISO and the CRCO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology with the Bank in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.


text: The business continuity program is overseen by the Finance Committee of our board of directors and includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Operational Risk Committee, a management level committee, including leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments throughout the Bank, is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the board of directors.


text: In alignment with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.


text: 2023 Cybersecurity Incident On November 19, 2023, we became aware of a cybersecurity incident that impacted certain of our systems. We promptly commenced an investigation, retained leading experts to assist the Company, notified law enforcement authorities, regulatory authorities and other stakeholders and followed our incident response plans. In addition, we took containment measures such as blocking access to certain of our systems resulting in varying levels of disruption to our businesses. The incident was contained on November 26, 2023.

companyName: Fidelity National Financial, Inc.

ticker: FNF

stage1Category: Incident Disclosure


text: Cybersecurity Governance Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.


text: Our Bank Technology Governance Committee, a management level committee, consisting of members of our senior leadership, including our chief risk officer and chief information officer, is responsible for approving policies to support the management and implementation of the cybersecurity program. This committee receives regular reporting from our director of information security similar to what is provided to the board of directors, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.


text: Cybersecurity Risk Management and Strategy The Bank has implemented processes for assessing, identifying, and managing risks from cybersecurity threats or incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition. Please refer to Item 1A. Risk Factors for a description of cybersecurity incident and threat risk.

companyName: Federal Home Loan Bank of Atlanta


text: The Bank's cybersecurity risk management framework for assessing, identifying, and managing risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data and include specific controls for the monitoring, mitigation, and reporting on cybersecurity risk management. Those processes include information security policies, incident response and business continuity plans focusing on the Bank's appropriate response to threats and incidents and operations and business continuance.


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee, and reported to the board. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses, and minimize the impact to service to members during a disruption event, which includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.


text: Risk Management and Strategy Cyber risk management is a critical component of our risk management framework. Processes for assessing, identifying, and managing material risks arising from cybersecurity threats are integrated in our policies and procedures, including our enterprise risk appetite, risk assessment, risk treatment, risk acceptance or exceptions, and third party risk management policies.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact with, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced minor cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service the Bank's members and protect the privacy of their data entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board's Enterprise Risk and Operations Committee oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.


text: The Bank's Security Governance Committee is led by the chief information security officer and has a cross-functional membership comprised of representatives from the Bank's operational risk, information security, information technology, legal, operations, and other departments that provide both specific, technical and multidisciplinary expertise to the committee. The committee has integrated oversight of the information security program, the physical security program, and is responsible for reviewing security policies and procedures, security exceptions and violations, the processes and standards to implement the policies and procedures defined in the cybersecurity risk management program, the Bank's cyber incident response plan, the security awareness program and implementation reports, and for providing guidance and monitor progress on major information security projects, and regulatory changes and requirements.


text: The Bank has a dedicated Information Security Department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk and that handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect the Bank against those risks, responsible for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.


text: The combined expertise of the Bank's chief information officer and the chief information security officer in cybersecurity include graduation in Computer Science, Certification in Risk and Information Systems Control (CRISC), Certification in Information Systems Security Professional (CISSP), and Certification in Information Systems Auditor (CISA), along with decades of experience in computer science, information and records security, business continuity, technology governance and compliance, technology risk services, cyber risk assessments, security operations monitoring and response, incident response, security strategy and architecture, awareness training, threat intelligence, identity and access management, vulnerability and penetration testing, maturity assessment, impact analysis, disaster events, recovery response, business resiliency, third party systems due diligence, deep knowledge of software systems and platforms, implementation methodologies, and various technology systems servicing internal and external customers.


text: The Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.


text: Bank policies and processes are designed such that the board would receive prompt and periodic information from management or the Security Governance Committee on any cybersecurity or information security incident or threat that may pose significant risk to the Bank and would continue to receive regular reports on any incident or threat until its conclusion. The Bank's Enterprise Risk and Operations Committee also receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, or more often, as necessary, the Enterprise Risk and Operations Committee discusses cybersecurity and information security risks with the Bank's chief information officer and chief information security officer.


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses and the impact to service to members during a disruption event. A disruption event includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service its members and protect the privacy of their data entrusted to the Bank, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems that could adversely impact our business in the event of a cybersecurity incident.


text: Cybersecurity Governance The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board of directors Enterprise Risk and Operations Committee (EROC) oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well as presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.


text: The Bank's Security Governance Committee is led by the chief information security officer and has a cross-functional membership comprised of representatives from the Bank's operational risk, information security, information technology, legal, operations, and other departments that provide both operational, specialized, technical and multidisciplinary expertise to the committee. The committee has integrated oversight of the information security program, the physical security program, and is responsible for reviewing security policies and procedures, security exceptions and violations, the processes and standards to implement the policies and procedures defined in the cybersecurity risk management program, the Bank's cyber incident response plan, the security awareness program and implementation reports, and for providing guidance and monitor progress on major information security projects, and regulatory changes and requirements.


text: T he Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.


text: Cybersecurity Risk Management Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 24 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.


text: Our Information Security Program consists of several elements including: • Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events. • Threat and Vulnerability Management. We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry. • Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes. • Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments. • Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.


text: While we maintain teams that specialize in cybersecurity and information technology, we also leverage third-party experts to provide objective feedback on our program and posture. These are accomplished via penetration tests, security posture assessments, and technology consulting. These independent evaluations help validate existing controls, identify potential focus areas, and aid in securely deploying technology in an increasingly complex environment.


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association and Mid-Sized Banking Coalition of America. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities. Some of the certifications held by our information security personnel include CERT Insider Threat Program Manager, GIAC Information Security Professional, GIAC Security Leadership, GIAC Continuous Monitoring, GIAC Certified Forensic Analyst, CompTIA Security+ and ISC2 Certified Information Systems Security Professional.


text: Board Oversight and Governance Our Board of Directors (the "Board"), in conjunction with management, is responsible for assessing which risks are warranted and acceptable, based on management's ability to: • identify and understand such risks; • measure the degree of exposure to such risks; • monitor the changing nature of the risk and related exposure; and • develop and implement processes and procedures to control such risks.


text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, through various committees including the Audit and Risk Committee and the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The CISO provides periodic reports to directors that permit them to measure management's compliance with the defined risk limits and to gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.


text: Executive Risk Committee. The Executive Risk Committee ("ERC") is responsible for oversight of our bank subsidiary's enterprise risk management framework and overall risk management practices and includes members of our Board, the board of directors of our bank subsidiary, and both executive and senior level management of the bank. The ERC oversees the policy review and approval program based upon the risk appetite of the Board, assists in the development and monitoring of risk identification and escalation processes, ensures that ongoing monitoring is in place to identify risks that could affect the achievement of the Company's key strategic goals and objectives, and ensures that the Board has the proper information to adequately assess the risks facing the Company. Cybersecurity reports and issues are presented at least quarterly to the ERC.


text: Information Technology/Security Committee. The Information Technology/Security Committee ("ITSC") is a management level committee that serves at the direction of the Board and provides oversight of the Company's information technology and information security programs. The members of the ITSC include management and leaders with an expansive background in information technology and cybersecurity. The ITSC meets monthly to review information security and information technology reports and issues. It reports meeting minutes to the Board and ensures the Board has the proper information to adequately assess the risks facing the Company by maintaining oversight of: • effective strategic information technology and information security planning and performance; • major projects, priorities, and overall performance; • the adequacy and allocation of resources; and • the risks involved with the information technology and information security functions.


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts. These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 25 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.


text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, primarily through the Audit and Risk Committee and the directors that serve on the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The Company's Information Technology/Security Committee and the CISO provide periodic reports to directors that permit them to understand the cybersecurity risk landscape, assess the Company's strategies and resources for addressing cybersecurity threats, measure management's compliance with the defined risk limits and gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.


text: Cybersecurity Risk Management and Strategy We are subject to the risk of a cybersecurity incident. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support our operations. For additional information, see Item 1A Risk Factors for a description of cybersecurity incident risk.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: We have a cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is part of our enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk Officer ("CRO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity framework that leverages both the National Institute of Standards and Technology framework and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.


text: Our Information Security Standards provide rules for the implementation of the EISP. These standards provide greater granularity on the Bank's requirements for the establishment, maintenance and continuous improvement of our information security program.


text: The ISIRP determines how information security incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the board of directors. The ISIRP also supports management's assessment of incident materiality.


text: The ISIRP also includes action plans for responding to third-party cybersecurity threats and incidents. We undertake due diligence of third-party systems with which we interact, in addition to requiring data protection covenants in the related third-party provider agreements, as appropriate. Our vendor management program includes ongoing monitoring and oversight of the third-party providers, including performance and information security reviews utilizing System and Organization Control reports, when available, and risk based re-assessment of high inherent-risk third-party providers on an annual basis. Any unsatisfactory reviews are escalated for consideration of appropriate steps to appropriately manage the related risk.


text: We leverage certain third-party providers to support our security event monitoring. In addition, certain third parties support our vendor security due diligence process. We may retain assessors, consultants, auditors, etc. to assist in the development/creation/monitoring of those processes for assessing, identifying, and managing cybersecurity incident risk.


text: Our business continuity program includes the maintenance of resources necessary to protect us from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity program includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate.


text: During the period covered by this report, we have not experienced any cybersecurity incidents that have had a material effect on our financial condition or results of operations. We assess the materiality of any cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect private information, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our board provides oversight of our risk management program, which includes cybersecurity risk management, via its Risk Oversight Committee. Among its responsibilities, the Risk Oversight Committee reviews and discusses, from a risk oversight point of view, reports on the Bank's current and emerging security risks, the metrics used to monitor security risks and management's views on the acceptable and appropriate levels of security risk. The Risk Oversight Committee also reviews and makes recommendations to the board regarding the approval of the EISP.


text: Our board's Security and Technology Committee ("STC") reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.


text: In addition, our board and/or the STC receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRO for purposes of informing the CRO on related risks. The cybersecurity risk management function under the CRO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management framework. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.


text: The CISO and the CRO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.


text: Our information security department, which is led by the CISO, is comprised of specialized professionals who are responsible for the day-to-day, hands-on management of the cybersecurity risk and who handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect us against those risks. The department is responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our information technology assets and data.


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 24 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.


text: For additional information, see Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management.


text: Cybersecurity Risk Management and Strategy We are subject to the risk of a cybersecurity incident. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support our operations. For additional information, see Item 1A Risk Factors for a description of cybersecurity incident risk.


text: We have a cybersecurity risk management program for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is integrated into the overall enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 25 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk and Compliance Officer ("CRCO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity program that leverages both the National Institute of Standards and Technology program and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.


text: Our Information Security Standards provide rules for the implementation of the EISP. These standards provide greater granularity on the Bank's requirements for the establishment, maintenance and continuous improvement of our information security program.


text: The ISIRP determines how information security incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the board of directors. The ISIRP also supports management's assessment of incident materiality.


text: The ISIRP also includes action plans for responding to third-party cybersecurity threats and incidents. We undertake due diligence of third-party systems with which we interact, in addition to requiring data protection covenants in the related third-party provider agreements, as appropriate. Our vendor management program includes ongoing monitoring and oversight of the third-party providers, including performance and information security reviews utilizing System and Organization Control reports, when available, and risk based re-assessment of high inherent-risk third-party providers on an annual basis. Any unsatisfactory reviews are escalated for consideration of appropriate steps to appropriately manage the related risk.


text: We leverage certain third-party providers to support our security event monitoring. In addition, certain third parties support our vendor security due diligence process. We may retain assessors, consultants, auditors, etc. to assist in the development/creation/monitoring of those processes for assessing, identifying, and managing cybersecurity incident risk.


text: Our business continuity program includes the maintenance of resources necessary to protect us from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity program includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate.


text: During the period covered by this report, we have not experienced any cybersecurity incidents that have had a material effect on our financial condition or results of operations. We assess the materiality of any cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect private information, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our board provides oversight of our risk management program, which includes cybersecurity risk management, via its Risk Oversight Committee. Among its responsibilities, the Risk Oversight Committee reviews and discusses, from a risk oversight point of view, reports on the Bank's current and emerging security risks, the metrics used to monitor security risks and management's views on the acceptable and appropriate levels of security risk. The Risk Oversight Committee also reviews and makes recommendations to the board regarding the approval of the EISP.


text: Our board's Security/Technology Committee reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.


text: In addition, our board and/or the Security/Technology Committee receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.


text: The Bank relies heavily on its information systems and other technology to conduct and manage its business and, as a result, it is subject to cybersecurity threat risk. Cybersecurity threats include potential unauthorized occurrences on or conducted through the Bank's information systems that may result in adverse effects on the confidentiality, integrity, or availability of its information systems or any information residing therein. Cybersecurity threat risks include, but are not limited to, malicious software or the exploitation of vulnerabilities, social engineering (e.g., phishing), denial-of-service attacks, viruses, and/or malware. As further described below, the Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats that are designed to protect the confidentiality, integrity, and availability of its information technology assets and data.

companyName: Federal Home Loan Bank of Dallas


text: Cybersecurity Risk Management and Strategy The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to identify, protect, detect, respond, and recover from cybersecurity threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.


text: The Bank's IT Security Program and policies establish safeguards to protect data and information that is used by the Bank's employees, independent contractors, and vendors. The goal of the Bank's cybersecurity risk management processes is to maintain and safeguard the confidentiality and integrity of the Bank's data, and to ensure system availability to protect against cybersecurity threats and vulnerabilities. The Bank maintains IT security policies that are reviewed at least annually and approved by the Bank's Chief Information Officer ("CIO"), appropriate management committees and, for its critical policies, the Bank's Board of Directors. To help ensure the effectiveness of the Bank's IT security policies, all employees are required to participate in annual IT security training and to review and acknowledge the Bank's IT security policies.


text: The Bank maintains an Enterprise Risk Management Framework which is updated and approved at least annually by its Board of Directors. The framework outlines the methodology and elements that are used to manage Bank-wide risks, including cybersecurity risks, and it assigns responsibilities for the Bank's enterprise risk management. The Bank's IT Security department measures cybersecurity risks by way of risk assessments that utilize a scale which includes both the likelihood and impact of risk occurrence. The scale used to measure likelihood and impact is tied to the criteria contained in the Bank's Enterprise Risk Management Framework.


text: The Bank also maintains Incident Response policies and procedures that are invoked in the event of a security breach or incident and which provide, among other things, guidance for the purpose of managing and executing the appropriate level of communication to executive management, the Board of Directors, government agencies, and/or the Finance Agency.


text: The Bank has a Business Continuity Program that sets forth the actions that would be taken to recover business processes in a timely manner in the event of a disruption. The Bank regularly tests its Business Continuity Plan to ensure its relevance and viability. Representatives from the Bank's Business Continuity team work closely with the Bank's business units and IT to help ensure that critical resources are available in the event of an interruption. To ensure its preparedness, the Bank updates its Business Continuity Plan semiannually. In addition, the Bank evaluates and analyzes threat scenarios, and it conducts periodic exercises to demonstrate the Bank's ability to run production systems from an alternate location and to seamlessly return to using production systems at its primary operations centers.


text: The Bank's vendors are subject to a formal vendor management process which includes an assessment of vendor risks (including cybersecurity risks) and ongoing monitoring. When warranted, the Bank seeks independent third-party reports related to the performance of its vendors, such as System and Organization Controls ("SOC") reports that are issued in accordance with Statement on Standards for Attestation Engagements No. 18.


text: While risks from cybersecurity threats have not materially affected nor are they currently expected to materially affect the Bank's business strategy, financial condition or results of operations, the Bank has invested and expects to continue to invest significant resources to maintain and enhance its cybersecurity program.