text: Cybersecurity Risk Management and Strategy The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Our Vice President of IT is tasked with continuous monitoring of our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee and other stakeholders, and ongoing training and awareness of employees. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.

stage1Method: unanimous


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of an incident having occurred at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the event. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee which will convene to review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.


text: Cybersecurity Governance and Oversight The governance of our cybersecurity risks involves active and informed participation from our management team, our Audit Committee, and our Board. The Audit Committee, which receives regular updates from the Cybersecurity Committee, maintains oversight of our cybersecurity strategies and risks and will consider such updates as part of the Company's overall risk management program. This oversight includes briefings on the nature of the risks we face, the steps we are taking to mitigate these risks, and any significant cybersecurity incidents that have occurred. In addition, our Vice President of IT will provide reports and updates to the Audit Committee and to the full Board as the need arises. All Board members may attend the meetings of the Audit Committee during which cybersecurity is discussed and will be included in any tabletop exercises as they are planned.

stage1Category: Board Governance


text: We have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.


text: Cybersecurity Risk Management and Strategy The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Cybersecurity Committee members rely on the cybersecurity experience of the Company's head of IT, which includes more than twenty years of experience in cybersecurity and information technology, with focused expertise on cybersecurity strategy, architecture, policy, and processes. Remaining team members have a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").


text: Our Vice President of IT is tasked with continuously monitoring our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.

stage1Category: Management Role


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of a cybersecurity incident at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the incident. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee, which will appropriately review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Kartoon Studios, Inc.

ticker: TOON


text: Risk Management and Strategy Computer viruses, malware, phishing attacks, denial-of-service attacks and similar cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.

companyName: YELP INC

ticker: YELP


text: We have implemented and maintain various information security measures, processes, standards and policies, as applicable, designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, as well as the data of our users, customers, partners and employees ("Information Systems and Data"): • Risk Identification and Assessment. The Engineering Security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various internal resources as well as third-party products and services. For example, depending on the environment, system and data, we use manual and automated tools, including third-party cybersecurity software; subscription reports and services from threat intelligence service providers; scans of the threat environment; audits; and threat assessments. • Risk Management. Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, as applicable to specific environments, systems and data, our Security Incident Response Plan, our Vulnerability Management Policy, data encryption, network security controls and data segregation. • Vendor Management. We also have a vendor management program to manage cybersecurity risks associated with our use of third-party service providers, such as AWS, Oracle and Workday, to perform various functions throughout our business. The program includes risk assessments, security questionnaires and security assessment calls with vendors' security personnel as appropriate. Depending on the nature of the services provided, the characteristics of the affected Information Systems and Data, and the identity of the provider, our process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider and imposing contractual obligations related to cybersecurity on the provider. • Employee Engagement and Education. In addition to the processes and practices described above, we work to empower employees to recognize and respond to cybersecurity risks. For example, we regularly host hackathons, which encourage our Product and Engineering teams to collaborate to test creative ideas, including for security solutions. In addition to keeping employees informed about cybersecurity best practices throughout the year, our IT and Engineering Security teams host "Hacktober" each October to promote security awareness in honor of National Cyber Security Awareness Month. Hacktober consists of activities such as weekly trivia challenges to help educate employees about how they can securely access corporate systems, recognize and report phishing email attempts, and take other actions to protect Yelp. To test employee readiness, these teams also send simulated phishing emails that direct employees to additional training if they engage with the email contents.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section titled " Risk Factors—If our security measures are compromised, or if our platform is subject to attacks that degrade or deny the ability of users to access our content, users may curtail or stop use of our platform. "

stage1Category: Strategy Integration


text: Our Board oversees the Company's aggregate risk profile and risk management process. The Board administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer, our Vice President of Engineering Security and our Director of Engineering Security. Each of these individuals has extensive industry experience developed through a significant career in engineering, IT and systems management, and security, respectively. Our Chief Technology Officer received a B.A. in Computing and Artificial Intelligence, and his experience includes the development of intrusion detection and firewall functionality for products at a global technology company. Our Vice President of Engineering Security received an M.S. in Business Analytics, with a focus on Computer and Information Systems, and her experience includes more than 15 years in systems management and administration at a major U.S. financial institution. Our Director of Engineering Security received an M.S. in Telecommunications Networks with a specialization in Security, is a Certified Information Systems Security Professional, and has more than 15 years of experience building security programs, including building and leading the incident response team at a global software company.


text: Our Chief Technology Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Technology Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Director of Engineering Security works with our Chief Technology Officer and Vice President of Engineering Security to develop a cybersecurity strategy that aligns with our business strategy and is responsible for implementing that strategy through his leadership of the day-to-day operations of our Engineering Security team.


text: Our Vulnerability Management Policy and Security Incident Response Plan are designed to escalate certain cybersecurity vulnerabilities and incidents, respectively, to members of management depending on the circumstances, including the Vice President, Director and other members of the Engineering Security team. Our Security Incident Response Plan also provides for escalations to our General Counsel and other members of the Legal team, as well as for notification of our Chief Technology Officer. The Engineering Security team and other members of management work with the incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: Our cybersecurity governance program adopted the Center for Internet Security Critical Security Framework as the structure to help detect and mitigate threats through risk-based controls designed to protect Titan Machinery's information, systems, and network.

companyName: Titan Machinery Inc.

ticker: TITN


text: Risk Management and Strategy Computer viruses, malware, phishing attacks, denial-of-service attacks and other cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.


text: Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.

companyName: Compass Group Diversified Holdings LLC


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, and prevention and protection capabilities. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations.


text: We also apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers, including those in our supply chain that have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk process. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

stage1Category: Third-Party Risk


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.


text: Both the board of directors and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our board of directors and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the board of directors in a timely manner.


text: Risk Management and Strategy Cybersecurity risk management and strategy is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.


text: Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.


text: CorEnergy's information security program is managed by our President and Chief Financial Officer, whose information technology team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Financial Officer provides periodic reports to our Board, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.

companyName: CorEnergy Infrastructure Trust, Inc.


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats to us and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of


text: Index to Financial Statements Information Technology and our Senior Director of Information Security. The topics reported by the Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats to us, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology, information security and engineering for over 14 years and within Mueller for four years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information technology and information security within Mueller for over 20 years.


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are charged with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST"). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Independent Assessments We regularly engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including 24/7 detect and response services, network activity monitoring, phishing prevention, penetration testing and periodic IT security maturity assessments. As part of these efforts, we have engaged third-party cybersecurity providers to help deploy and monitor these safeguards and to assist in the event of a security incident or similar issue by conducting forensics reviews and assisting more broadly with the mitigation and remediation of any such event.


text: Third-Party Risks We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness All employees are required to complete information security awareness training upon joining the Company. Based on individual phishing test performance and job requirements, additional training may be offered or required on an as-needed basis.


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. For information regarding cybersecurity risks that may materially affect us, see the risk factors titled "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," and "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation" as well as "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation" under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.

stage1Category: Incident Disclosure


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes, including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats that we may face in our operations and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of Information Technology and our Senior Director of Information Security. The topics reported by the


text: Index to Financial Statements Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats we face, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology for over 20 years and within Mueller for over five years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information security and engineering within Mueller for over 21 years.


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are responsible for addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST") and combined with the Center of Internet Security ("CIS") controls framework are used to develop actionable steps for improving technical defenses and protecting against common threats. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Independent Assessments We engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. See "Item 1A. RISK FACTORS" - "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation," and "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation."


text: Our cybersecurity measure is primarily focused on ensuring the security and protection of computer systems and networks. We utilize a third-party service provider, as well as internal resources, to monitor and, as appropriate, respond to cybersecurity risks. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We also periodically scan our environment for any vulnerabilities and perform penetration testing. In addition, to promote security awareness, we provide cybersecurity risk training to all employees at least annually.


text: Oversight responsibility for information security matters is shared by the Board, Chief Financial Officer ("CFO"), VP of Internal Audit and our internal information technology ("IT") resources. Our CFO and VP of Internal Audit oversee our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives quarterly updates from IT and the third-party IT service provider on cybersecurity and information security matters. The CFO communicates with the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Board for timely and accurate reporting of any material cybersecurity incident.


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: PRECIGEN, INC.

ticker: PGEN


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program, and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors-If we experience a significant breach of data security or disruption in our information systems, our business could be adversely affected." in this annual report on Form 10-K.

stage1Category: None/Other


text: Cybersecurity Governance Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Chief Operating Officer ("COO") who serves as the chairman of the security steering team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. The security steering team also includes the leadership of our Information Technology ("IT") team. The IT team consists of seasoned security professionals well-versed in emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents. Precigen also employs the use of cybersecurity vendors to actively monitor and remediate cybersecurity threats and incidents. Management, including the COO, regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity updates. Such updates cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.


text: Our board of directors has overall oversight responsibility for our risk management and is charged with oversight of our cybersecurity risk management program. The board is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry's best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.


text: Our Adviser engages in the periodic assessment and testing of our Adviser's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Adviser adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: NEXPOINT DIVERSIFIED REAL ESTATE TRUST

ticker: NXDT


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall risk management, our Adviser's cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and Chief Compliance Officer and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.


text: Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser's internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.


text: Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company's and our Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: Our Adviser maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser's evolving information security policies, standards, processes and practices.


text: Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Adviser. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Adviser, including the Adviser's Director of Information Technology.


text: The Adviser's Director of Information Technology, in coordination with relevant senior management and personnel of the Adviser, which includes our Adviser's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Adviser's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Adviser's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified Network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect our ability to pay dividends to our stockholders".


text: As one of the critical elements of the Company's overall risk management, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay distributions".


text: Our business depends on information technology systems and networks, which we protect from cyber threats that could harm our data, operations, and reputation. We have invested in security measures designed to safeguard the data of our customers and employees, prevent, detect, and respond to cyberattacks, and comply with data privacy requirements.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: Cybersecurity Governance Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. We use a risk-based and layered approach to prevent, detect, and respond to cyberattacks, and leverage external partnerships for threat intelligence.


text: Our management is responsible for risk identification, risk management and risk mitigation strategies associated to cybersecurity related information technology risks, including fully documenting our cybersecurity policies and procedures and cybersecurity risk management program as well as implementing a cybersecurity risk management program and ensuring compliance with our cybersecurity policies and procedures. Our Senior Vice President of Quality, GMP Operations, and Information Technology leads our Information Technology team, which includes experienced and information security professionals and has expertise in various aspects of cybersecurity, such as network security, data protection, incident response, threat intelligence, and security awareness. Our Information Technology Team's expertise is supplemented by external consultants who provide specialized services and independent assessments of our cybersecurity posture and capabilities.


text: Management has appointed a Cybersecurity Incident Response Team (the "CSIRT") which is operationally responsible for coordinating, executing, and managing cybersecurity incident response activities. The CSIRT is comprised of experienced information security personnel from our Information Technology team. The CSIRT's responsibilities include, among other things, incident identification and escalation to designated members of management. Among the designated members of management who are required to be notified are our Chief Executive Officer and our Chief Financial Officer.


text: Our Board of Directors has appointed its Audit Committee as its primary body to oversee management's risk identification, risk management and risk mitigation strategies related to cybersecurity related information technology risks.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: SOUTH 8 ENERGY, LLC


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A. Risk Factors."


text: Cybersecurity Governance Our cybersecurity program addresses potential risks, implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from a third-party that provides relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. The third-party provider provides regular data protection and cybersecurity reports to our senior management who then provides regular reports to the Audit Committee and the Board of Directors. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Risk Management and Strategy As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement when responding to such issues. Additionally, our cybersecurity program is regularly audited by independent third parties, and we incorporate regular information security training as part of our employee education and development program. We maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Hanesbrands Inc.


text: Because we are aware of the risks associated with third-party service providers, we also have implemented robust processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.


text: We also understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. Our policies provide explanations of the types of information we collect, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.


text: Some of the other steps we have taken to detect, identify, classify and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Conducting security maturity posture assessments, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a regular basis; • Utilizing industry-standard technologies, processes, and capabilities designed to protect our systems and data and detect potential suspicious activity; • Adopting a vendor risk management program, which includes cybersecurity and data privacy audits, classifying vendor, service provider or business partner risk based on several factors and evaluating and monitoring related risk mitigation efforts; • Providing security and privacy training and awareness to our employees; • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training; and • Maintaining cyber liability insurance.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For additional information regarding the ransomware attack we announced on May 31, 2022, see the section captioned "Overview - Ransomware Attack" under Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations" below. Other than this ransomware attack, as of the date of this report and for the years presented, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operational Risks - Any inadequacy, interruption, integration failure or security breach with respect to our information technology could harm our ability to effectively operate our business and have a material adverse effect on our business, results of operations, financial condition and cash flows" under Part I, Item 1A "Risk Factors" above.


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.


text: The Board regularly reviews our cybersecurity and other technology risks, controls and procedures. The Board receives reports from our Chief Executive Officer and Chief Information Officer at least twice annually regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. In addition, our cybersecurity infrastructure is overseen by our Chief Information Security Officer, who reports to our Chief Information Officer. Our Chief Information Security Officer has served in various roles in information technology and information security for over 20 years, including most recently leading the information security function of McCormick & Company. He holds a Ph. D. in information assurance & security, along with industry certifications that include ISACA Certified Data Privacy Solutions Engineer and Certified Information Security Manager and EC-Council's Certified Chief Information Security Officer certification. Our Chief Information Officer reports to our Chief Executive Officer and has served in various roles in information technology and information security for over 25 years, including as head of enterprise architecture for VF Corporation. Our Chief Information Officer holds an MBA along with various industry certifications, including SAP Enterprise Architect certification and TOGAF certification.


text: Furthermore, management of Hanesbrands prepares, and the Audit Committee reviews and discusses, an annual assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated annually and is designed to bring to the Audit Committee's attention our most material risks for evaluation, including cybersecurity risks.


text: Risk Management and Strategy As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement when responding to such issues. Additionally, our cybersecurity program is regularly assessed by independent third parties, and we incorporate regular information security training as part of our employee education and development program. We maintain cybersecurity insurance as part of our comprehensive insurance portfolio.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors in Item 1A."

companyName: Douglas Emmett Inc

ticker: DEI


text: Some of the other steps we have taken to detect, identify, classify and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures; • Conducting targeted assessments and penetration tests throughout the year, using both internal and external resources; • Conducting security maturity posture assessments, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a regular basis; • Utilizing industry-standard technologies, processes, and capabilities designed to protect our systems and data and detect potential suspicious activity; • Adopting a vendor risk management program, which includes cybersecurity and data privacy audits, classifying vendor, service provider or business partner risk based on several factors and evaluating and monitoring related risk mitigation efforts; • Providing security and privacy training and awareness to our employees; • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training; and • Maintaining cyber liability insurance.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For additional information regarding the ransomware attack we announced on May 31, 2022, see the section captioned "Overview - Ransomware Attack" under Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations " below. Other than this ransomware attack, as of the date of this report and for the years presented, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operational Risks - Any inadequacy, interruption, integration failure, breach or cybersecurity incident with respect to our information technology could harm our ability to effectively operate our business and have a material adverse effect on our business, results of operations, financial condition and cash flows" under Part I, Item 1A "Risk Factors" above.


text: The Board regularly reviews our cybersecurity and other technology risks, controls and procedures. The Board receives reports from our Chief Executive Officer and Chief Information Security Officer at least twice annually regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. Our cybersecurity infrastructure is overseen by our Chief Information Security Officer, who reports to our Chief Strategy, Transformation, Analytics and Technology Officer. Our Chief Information Security Officer has served in various roles in information technology and information security for over 20 years, including most recently leading the information security function of McCormick & Company. He holds a Ph. D. in information assurance & security, along with industry certifications that include ISACA Certified Data Privacy Solutions Engineer and Certified Information Security Manager and EC-Council's Certified Chief Information Security Officer certification.


text: The Company annually reviews its overall risk profile with the Audit Committee and full Board of Directors. Assessing, identifying and managing material risks from cybersecurity threats are integrated into the Company's overall risk management processes.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee as necessary, regarding any significant cybersecurity incidents.


text: The Audit Committee of the Company's Board of Directors has oversight in the management of risks associated with cybersecurity. The Audit Committee is briefed regularly on cybersecurity matters, including meeting with the Company's Chief Technology Officer at least annually and receiving a memorandum quarterly regarding cybersecurity. In addition, the Audit Committee discusses cybersecurity with other members of management and the internal audit staff at each quarterly meeting. The Audit Committee reports to the full Board of Directors quarterly regarding cybersecurity.


text: Management of the Company plays an integral role in assessing and managing risks from cybersecurity threats. The Company has a dedicated technology services department, led by the Company's Chief Technology Officer. The Company also has an in-house internal audit staff that is involved in risk management of cybersecurity threats. The Company solicits input from key employees regarding the overall risk environment, including cybersecurity threats. The Company requires all employees to complete cybersecurity training semi-annually and periodically facilitates penetration tests on the Company's systems.


text: The Company's Chief Technology Officer reports to the Executive Vice President – Operations. In addition, as discussed in more detail below, any cybersecurity incident is reported to the Company's legal department. While the Company's Executive Vice President – Operations and the members of its legal department do not have a technology services background, we believe that the Company's Chief Technology Officer and technology services team possess the requisite background and experience to effectively manage the Company's cybersecurity needs.


text: The Company also engages with third parties on an as-needed basis to advise and assist in managing cybersecurity risks. When the Company utilizes third-party services that include web-based platforms or data collection stored on third-party servers, it reviews the service provider's SOC1 attestation reports on internal controls and inquires regarding controls and procedures utilized by such third parties with respect to cybersecurity of the Company's data.


text: The Company has in place a cybersecurity incident response plan. Procedures for addressing cybersecurity incidents include reporting incidents up to senior management, including the Company's legal department for analysis. If a cybersecurity incident were determined to be material, the Company's disclosure committee would address appropriate public disclosures. As noted above, management regularly reports to the Audit Committee regarding the current cyber threat environment and the controls and procedures meant to address such risks. If a cybersecurity incident were determined to be material, the Audit Committee would be informed promptly.


text: The Company carries cyber risk insurance, but there can be no assurance that losses from a cybersecurity incident would not exceed the insurance coverage.


text: The Company is subject to risks associated with cybersecurity threats. Although the Company has not experienced a cybersecurity incident that materially affected or, to the Company's knowledge, is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, the Company has, from time to time, experienced threats to and breaches of its data and systems. The Company faces risks associated with security breaches through cyber attacks, cyber intrusions, or otherwise, as well as other significant disruptions of its information technology networks and related systems. These risks are described in more detail under Item 1A. Risk Factors.


text: The CISO leads our Information Security team and is responsible for establishing and maintaining the Enterprise Information Security Policy (the "Policy"). Our CISO has over a decade of experience in information security strategy, audit and risk management, as well as technical leadership expertise. To stay abreast of the evolving threat landscape, the CISO is active in the cyber community through discussions with peer groups, industry experts and law enforcement agencies. Members of the Information Security team have backgrounds in cybersecurity or experience applicable to their roles, including relevant industry certifications.

companyName: Evercore Inc.

ticker: EVR


text: The Company's Chief Technology Officer reports to the Company's Executive Vice President and Chief Administrative Officer. In addition, as discussed in more detail below, any cybersecurity incident is reported to the Company's legal department. Although the Company's Executive Vice President and Chief Administrative Officer and the members of its legal department do not have a technology services background, we believe that the Company's Chief Technology Officer and technology services team possess the requisite background and experience to effectively manage the Company's cybersecurity needs. The Company's Chief Technology Officer has extensive information technology and program management experience from service in the government and private and public Fortune 100 companies. He has expanded the Company's cybersecurity program over the last several years resulting in a robust enterprise security posture focused on preventing cybersecurity incidents, while simultaneously increasing the Company's system resilience in an effort to minimize the business impact if an incident should occur.


text: The Company has in place a cybersecurity incident response plan. Procedures for addressing cybersecurity incidents include reporting incidents up to senior management, including the Company's legal department for analysis. If a cybersecurity incident were determined to be material by the Company's legal department, the Company's Audit Committee would be informed promptly and the Company's disclosure committee would address appropriate public disclosures. As noted above, management regularly reports to the Audit Committee regarding the current cyber threat environment and the controls and procedures meant to address such risks.


text: Although the Company has not experienced a cybersecurity incident that materially affected or, to the Company's knowledge, is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, the Company has, from time to time, experienced threats to and breaches of its data and systems. The Company faces risks associated with security breaches through cyber attacks, cyber intrusions, or otherwise, as well as other significant disruptions of its information technology networks and related systems. These risks are described in more detail under Item 1A. Risk Factors.


text: Managing information technology ("IT") and cybersecurity risks, including maintaining confidentiality and privacy for our clients and employees, is critical to the successful operation of our business. We are aware that there are risks presented by cybersecurity, and are committed to preventing and mitigating such risks by following the below framework.


text: Board of Directors Oversight The Audit Committee of the Board of Directors is charged with a majority of the risk oversight responsibilities on behalf of the Board of Directors, including risks associated with IT and cybersecurity. The Board of Directors and the Audit Committee are updated periodically on cybersecurity matters. Our Chief Financial Officer ("CFO") and General Counsel both report directly to our Chief Executive Officer ("CEO") and periodically meet with the Audit Committee in conjunction with a review of our quarterly and annual periodic SEC filings to discuss important risks we face, highlighting any new risks that have arisen since the prior meeting. Specifically with respect to cybersecurity, our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") join our CFO and General Counsel to provide updates directly to the Audit Committee, along with third party experts engaged to recommend enhancements to and improve the Company's cybersecurity practices. In addition, all non-management members of the Board of Directors are invited to attend all committee meetings, regardless of whether the individual sits on the specific committee. Board of Directors members have access to senior executives, including our CFO and General Counsel, and in addition to periodic reports, we maintain formal processes for escalating live issues to the Audit Committee and the Board of Directors, as described below.


text: On a day-to-day basis, our CISO leads our cybersecurity program with support from senior leadership. Our Information Security program is a bespoke program created for the Company and is guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Information Security team is composed of three core functional areas, which work collaboratively to seek to keep our assets secure: • Governance, Risk, & Administration. Responsible for setting policy, maintaining and conducting risk assessments, ensuring regulatory compliance in partnership with our legal and compliance team, coordinating audits, evaluating new technology platforms, and the development and oversight of the Company's data governance, vendor risk management, and training programs. • Security Operations. Responsible for monitoring our security posture on an ongoing basis, including alert response and escalation. This team is supported by a third-party security firm that serves as the Company's Security Operations Center and performs continuous (24x7x365) monitoring of security across the enterprise. • Security Architecture. Responsible for managing and maintaining security systems and identity management programs, as well as oversight and performance of security reviews for key technology platforms.


text: Our Enterprise Information Security Policy contains existing controls to protect information systems (and the data hosted within) and to educate personnel as to the proper use, disclosure, modification, or destruction of that data. The Policy is further intended to reasonably protect our systems and data against internal and external threats that could impact it. We periodically review this Policy for improvements and request each account user to read and attest to the Policy annually. We employ a Defense-in-Depth approach to information security, which includes adoption of network perimeter, endpoint, and end-user controls in accordance with the Policy. We are focused on improvement of our security posture; we are periodically assessed by internal and external audits, as well as third-party security experts, such that our program continues to address and respond to evolving threats.


text: Education and awareness to cyber threats is a core component of our information security program. All employees undergo dedicated cybersecurity training as part of their onboarding process and on an ongoing basis. In recent years, we have enhanced our employee education and awareness program to focus on engagement, including through frequent phishing campaign assessments, communications from our CISO and reinforcement from other senior leaders on relevant cyber threats. We have also engaged third-party experts to perform penetration tests and assess our response mechanisms and hosted tabletop exercises with senior leaders to test our incident response preparedness. These organizations, as well as other third parties that do business with us, are reviewed as part of our Vendor Risk Management program. To foster prompt response to incidents, recovery of lost data, and minimal impact to strategic operations in emergency events, we maintain, test, and regularly review our Incident Response, Disaster Recovery and Business Continuity Plans.


text: Incident Response Plan We have adopted an Incident Response Plan to provide a formal framework for responding to security incidents. The overall purpose of the framework is to provide procedures designed to protect and preserve the availability, integrity and confidentiality of the Company's information and network assets, regardless of format. The plan was designed with the objective of performing timely investigations and assessments of the severity of the incidents (including the sensitivity of the information compromised), taking all appropriate measures to contain and control damage to customers resulting from the incident, returning to normal operating conditions as quickly as possible, and taking appropriate steps to comply with our legal and regulatory obligations, including our disclosure obligations under the securities laws.


text: The Incident Response Plan establishes procedures for assessing threats, determining when escalation of threats is required, and establishing a coordinated, multi-functional response to mitigate the impact of any incidents. After becoming aware of an incident, our cybersecurity team will review the incident against several critical questions to guide our immediate response. If an incident requires escalation, our core response team, which includes our CIO, CISO, General Counsel, CFO, Chief Compliance Officer, and other business leaders, is responsible for analyzing the materiality of the incident (including whether the incident qualifies as a material cyber event under SEC cybersecurity rules) and leading our response. The core response team is responsible for involving other corporate and business leaders throughout the organization as appropriate for communication and incident resolution, as well as communicating with the Board of Directors regarding the incident and management's response as appropriate.


text: Impact of Cybersecurity Risk During the period covered by this report, we are not aware of any cyber incidents that, individually or in the aggregate, have been material to our operations or financial condition. Additionally, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. For a discussion of cybersecurity risk, see the information contained under the heading "Our business is subject to various cybersecurity risks" in Item 1A. "Risk Factors" in this Form 10-K.


text: On a day-to-day basis, our CISO leads our cybersecurity program with support from senior leadership. Our Information Security program is a bespoke program created for the Company and is guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Information Security team is composed of three core functional areas, which work collaboratively to keep our assets secure: • Governance, Risk, & Administration. Responsible for setting policy, maintaining and conducting risk assessments, ensuring regulatory compliance in partnership with our legal and compliance team, coordinating audits, evaluating new technology platforms, and overseeing the Company's data governance, vendor risk management, and training programs. • Security Operations. Responsible for monitoring our security posture on an ongoing basis, including alert response and escalation. This team is supported by a third-party security firm that serves as the Company's Security Operations Center and performs continuous monitoring of security across the enterprise. • Security Architecture. Responsible for managing and maintaining security systems and identity management programs, as well as performing security reviews for key technology platforms.


text: Our Enterprise Information Security Policy contains existing controls to protect information systems (and the data hosted within) and to educate personnel as to the proper use, disclosure, modification, or destruction of that data. The Policy is further intended to reasonably protect our systems and data against internal and external threats that could impact it. We periodically review this Policy for improvements and request each account user to read and attest to the Policy as updates are made. We employ a Defense-in-Depth approach to information security, which includes adoption of network perimeter, endpoint, and end-user controls in accordance with the Policy. We are focused on improvement of our security posture; we are periodically assessed by internal and external audits, as well as third-party security experts, such that our program continues to address and respond to evolving threats.


text: Incident Response Plan We have adopted an Incident Response Plan to provide a formal framework for responding to cybersecurity incidents. The overall purpose of the framework is to provide procedures designed to protect and preserve the availability, integrity and confidentiality of the Company's information and network assets, regardless of format. The plan was designed with the objective of performing timely investigations and assessments of the severity of the incidents (including the sensitivity of the information compromised), taking all appropriate measures to contain and control damage to customers resulting from the incident, returning to normal operating conditions as quickly as possible, and taking appropriate steps to comply with our legal and regulatory obligations, including our disclosure obligations under the securities laws.


text: Our Board and management recognize the importance of maintaining the trust and confidence of our customers, business partners and employees. The Board provides oversight of our risk management program and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, processes, and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the digital information that we collect and store by identifying and mitigating cybersecurity threats and appropriately responding to cybersecurity incidents if and when they occur.

companyName: Travel & Leisure Co.

ticker: TNL


text: Cybersecurity Risk Management and Strategy Our ERM program is designed to identify the top risks applicable to us and document risk mitigation plans and initiatives by management. We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we face. As one of the critical elements of our overall ERM approach, our information security program is focused on the following key areas: • Governance: As discussed in more detail below under "Cybersecurity Governance," the Board's oversight of cybersecurity risk management is supported primarily by the Audit Committee of the Board (the "Audit Committee") and our Information and Privacy Risk Committee ("IPRC"), which is the key management-level governance body that oversees management of cybersecurity threat and data privacy risks. • Cross-Functional Approach: Through the IPRC, we have implemented a cross-functional approach to managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of significant cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by appropriate members of management in a timely manner. • Threat Assessment: We engage in an annual cybersecurity-focused risk assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the NIST and by engaging third-party experts to attempt to infiltrate our information systems. • Technical Safeguards: While no system is impenetrable, we deploy sophisticated technical safeguards that are intended to provide multiple layers of security designed to identify cybersecurity threats and protect our information systems from such threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. We leverage both internal and third-party resources to implement and monitor our technical security controls and perform threat and vulnerability assessments. Assessment results feed an iterative process intended to improve our cybersecurity posture and address the constantly evolving threat landscape on an on-going basis. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans for critical systems, applications and business functions that address our response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits" included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.