text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.

companyName: EAGLE MATERIALS INC

ticker: EXP

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.

stage1Category: Third-Party Risk

stage1Method: unanimous


text: Risks from Cybersecurity Incidents To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.

stage1Category: Strategy Integration


text: Risk Management Personnel The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 38 years of IT experience, 33 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.

stage1Category: Management Role


text: Monitor Cybersecurity Incidents Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Directors Oversight The Audit Committee of the Company's Board is responsible for overseeing the Company's cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; and • Compliance status and efforts with regulatory requirements and industry standards.

stage1Category: Board Governance


text: In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Champion Homes, Inc.

ticker: SKY


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT Risk Register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • tabletop exercises conducted by outside counsel periodically to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Information Technology, Intellectual Property, and Data Security and Privacy."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of risk assessment and risk management, including cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and emerging threats; • progress on cybersecurity projects; • incident reports; • lessons learned from past events; and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital and Information Officer.


text: Our management team, including our Chief Digital and Information Officer and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our information security and cybersecurity program is based on a cybersecurity framework that is designed to protect against operational risks related to cybersecurity.

companyName: CORVEL CORP

ticker: CRVL


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees the day-to-day security operation, and our Chief Information Officer ("CIO") oversees our secure development activities.


text: Third-Party Risk Management: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.


text: The Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a Cybersecurity Incident Response Plan which contains processes and procedures related to security incident handling.


text: We also have vendor assessment processes to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our agreements with third parties may include various compliance requirements, data protection terms, audit or monitoring rights, and notification requirements in the event the third party experiences its own cybersecurity event.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our information security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees and is supplemented with periodic social engineering tests.


text: We engage consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. In the last three fiscal years, we have not experienced any material cybersecurity incidents or costs.


text: Cybersecurity Governance As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer ("CEO"), is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer ("CEO") who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our CEO, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.


text: Our cybersecurity and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. Such leaders in our organization hold industry recognized certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Global Information Assurance Certification (GIAC).


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibility and has delegated responsibility for oversight of this risk to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. The Audit Committee oversees our enterprise risk assessment process, and cybersecurity represents an important component of our overall approach to risk assessment. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Governance: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Vice President ("VP") of Global Technology, and other members of management.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: The Audit Committee receives regular presentations and reports from our VP of Global Technology on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The VP of Global Technology, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Viasat Cybersecurity Risk Management, Strategy and Governance Disclosure Viasat builds, maintains, and operates satellite and telecommunications systems, infrastructure and services used by both government and commercial customers across the globe. We recognize the importance of building a resilient cybersecurity program focused on reducing cybersecurity risk to our customers, partners and our own organization. Our Cybersecurity Engineering organization, at the direction of the Board of Directors, has developed and implemented a cybersecurity risk management and technical assistance program intended to protect the confidentiality, integrity and availability of the services provided and the information stored, processed or transmitted by our critical systems and infrastructure, while assisting staff to develop, operate and maintain secure products and services.

companyName: VIASAT INC

ticker: VSAT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees our management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. With the Inmarsat acquisition, the Senior Vice President, Global Security of Inmarsat joined the cybersecurity team, bringing their experience including senior cybersecurity and intelligence roles within the UK Ministry of Defence and Central Government. The operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known internally as our "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework 2.0, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our indentification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.


text: Risk Management and Strategy The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: DIH HOLDING US, INC.


text: We recognize our recent acquisition of Inmarsat represents an opportunity to build on the existing cybersecurity risk programs incorporating and integrating the strengths of both legacy cybersecurity organizations. The Inmarsat Cybersecurity Team has historically been guided by the NIST Cybersecurity Framework. The legacy Viasat and Inmarsat cybersecurity organizations will report to Viasat's CISO and are actively integrating the two legacy companies' cybersecurity policies, processes, and operations, as well as combining the cybersecurity functions into a single organization, with appropriate focus on the overall Viasat and Inmarsat satellite service network integration activities.


text: Functionally, our cybersecurity team performs internal and external risk assessments and testing on both internally and externally developed systems, as well as certain third-party and supply chain partner ecosystems based on our assessment of their respective operational criticality and risk profile. Depending on the risks presented, this may include some combination of manual and automation-driven testing methods and supply chain risk management activities such as hardware and software assurance assessments, anti-counterfeit measures, and the use of trusted suppliers. Compliance with security policies, procedures, and standards are assessed, and depending on the potential risks posed to us, third-party assessments may be performed, including penetration tests, red team engagements, gap assessments, and compliance certification assessments. We also conduct several 3rd party compliance and audit assessments, including PCI DSS Tier 1 Merchant and Service Provider, ISO 27001, UK Cyber Essentials Plus, and DFARS 252.204-7012 High Assurance assessments.


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as, payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers, including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC) ISACs.


text: Our cybersecurity engineering teams have personnel dedicated to detection engineering activities that leverage threat intel gathered to mitigate the impact of security events. Security detection and operations teams are responsible for detection activities including 7x24 staffed Cybersecurity Operations Centers responsible for monitoring our service provider networks and internal corporate and development environments. Various automated tools are used for detection and remediation, with support from experienced detection and response analysts and engineers.


text: When security events do occur, we employ a security incident response process that is designed to contain, eradicate, and recover operations as quickly as possible, while preserving forensic evidence for further analysis and potential attribution. We leverage multiple third parties for incident response and forensic support on retainer as necessary to assist during the incident response and remediation phases. We also maintain cybersecurity insurance in the event of cybersecurity related damages or data loss as a result of a cybersecurity incident or unauthorized data disclosure.


text: During fiscal year 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.


text: The Company's Audit Committee is responsible for overseeing the Company's internal controls including oversight over our risk management program and cybersecurity. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from the Company's overall risk management system and processes. The Company seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Canopy Growth Corp

ticker: CGC


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security incudes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party incident response retainer to assist us in the event of an incident, Security playbooks, and recovery procedures also form part of our incident response capabilities. We do conduct Red Team/ Blue Team exercises with 3rd parties to help us assess our resiliency and the performance of our capabilities. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. On the basis of the monthly report, the CFO with the support of the VP, Information Technology evaluate and report to the Audit Committee. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.


text: The Audit Committee oversees the Company's risk management program, including the management of cybersecurity threats. The Audit Committee receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company's approach to overseeing cybersecurity threats with the Company's CFO and other members of senior management.


text: The VP, Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: The VP, Information Technology has been with our Company for over five years in the roles of Director, Global IT Engineering & Sr Director, Global IT Engineering. Prior to joining our Company, the VP, Information Technology was the founder, President and CEO of RjR Innovations, a North American industry leader in IT Service Management. Throughout his 27-year career within the Information Technology industry, he has been an ITIL Best Practice Conference Speaker & Keynote Speaker at several events. The VP, Information Technology is supported by the Senior Director Cybersecurity & IT Risk who has over ten years in a senior cybersecurity leadership role. He holds certifications in CISM (Certified Information Security Manager) from ISACA and PCIP (Payment Card Industry Professional) from the PCI Security Standards Council.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, have not materially affected and are not reasonably likely to materially impact our operations materially, including our business strategy, results of operations, or financial condition.


text: Cybersecurity incidents are inevitable in the current threat environment. We believe that it is a question of "when" not "if" a cybersecurity incident will occur. As a result, we commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents, including the amount of information that can be extracted from our systems by threat actors, whether internal or external.

companyName: U-Haul Holding Co /NV/

ticker: UHAL

stage1Category: None/Other


text: We take a cross-departmental approach to addressing cybersecurity risk, which includes input from senior management, our Cybersecurity Council (a taskforce comprised of representatives from primary corporate functions across our Moving and Storage, Property and Casualty Insurance, and Life Insurance subsidiaries), other team members, and oversight by the Board and its Audit & Cyber Committee. We commit resources to cybersecurity and risk management processes to analyze the changing cybersecurity landscape and respond to ongoing and emerging threats. We monitor and assess the threat landscape on an ongoing basis. Our Cybersecurity Council reviews cybersecurity risks. In addition, we have a set of Company-wide policies and procedures that directly or indirectly relate to cybersecurity. These policies go through an internal review process and are approved by members of management.


text: The Company's Director, Data Privacy & Security leads the IT security team and is responsible for coordinating and implementing our information security program. The Director, Data Privacy and Security also reports on cybersecurity matters to senior management and informs on such matters to the Audit & Cyber Committee of the Board. IT security team members have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we perform simulations and tabletop exercises with members of the Cybersecurity Council and other team members involved in incident response. We involve external resources and advisors as needed. Team members have on-demand online access to cybersecurity training through our online U-Haul University.


text: We have expanded investments in IT security and improved access control and identity and authentication management, and engage consultants as needed. We test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party consultants. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, mitigation, and remediation. The cybersecurity team collects data on cybersecurity threats and risk areas and conducts risk assessments. We conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of our third-party service providers. Our assessment of risks associated with our use of third-party service providers is part of our overall cybersecurity risk management framework.


text: The Audit & Cyber Committee and the full Board participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit & Cyber Committee reviews the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, recent enhancements to the Company's defenses, and management's progress on its cybersecurity initiatives. In addition, the Board and the Audit & Cyber Committee discuss recent threats and how the Company is managing those threats.


text: Despite our work to identify and address cybersecurity risks, we experience threats to our data and systems. We have experienced cybersecurity incidents in the past, including breaches of our data and systems. To date, none of those cybersecurity incidents has resulted in a material impact on our business strategy, results of operations or financial condition. However, the impacts of cybersecurity incidents in the future could be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents are inevitable, and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us" in Item 1A- Risk Factors in this Annual Report.


text: We believe cybersecurity is critical to advancing our technological advancements. As a clinical stage biotechnology company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks and have developed our own practices and framework, which we believe enhance our ability to identify and manage cybersecurity risks. Our Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The IT Risk Committee and our cybersecurity consultant, which has extensive information technology and program management experience, regularly brief the Audit Committee on our cybersecurity and information security posture and the Audit Committee is apprised of any cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Audit Committee retains oversight of cybersecurity because of its importance. In the event of any incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Audit Committee, as appropriate.


text: As a clinical stage biotechnology company, we must also comply with extensive regulations, including requirements imposed by the U.S. Food and Drug Administration related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet SEC disclosure requirements. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We will require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors" for a discussion of cybersecurity risks, including, without limitation, the risk factor under the heading "We may be subject to security breaches or other cybersecurity incidents that could compromise our information and expose us to liability". Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Risk management and strategy Our cybersecurity program is designed to safeguard our information systems and protect confidentiality, integrity, and availability of those information systems and the information residing therein. Our cybersecurity risk management program is integrated with our broader enterprise risk management programs under the oversight of our Chief Administrative Officer ("CAO") and the Enterprise Risk Management Committee. The CAO reports to the CEO and is responsible for our overall information and data security strategy, cybersecurity risk policies and procedures, as well as evaluating and managing any material risks from cyber threats. Our Chief Information Security Officer ("CISO") reports directly to our CAO and leads our cybersecurity and compliance department.

companyName: TRIUMPH GROUP INC


text: The cybersecurity and compliance department, in conjunction with our Computer Security Incident Response Team ("CSIRT"), designs, implements, and executes continuous monitoring processes for our information systems. Our monitoring programs include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CSIRT is responsible for the detection and assessment of cybersecurity threats and incidents in accordance with a formal risk assessment matrix established in cooperation with our Cybersecurity Disclosure Committee. This risk assessment matrix establishes a framework for notification of an incident to the Cybersecurity Disclosure Committee and, if appropriate, the Audit Committee or Board of Directors. The CISO also partners with internal functions such as finance, legal, and internal audit, as well as third-party consultants who perform risk-based assessments against the National Institute of Standards and Technology ("NIST") 800-171 Rev2 and Cybersecurity Maturity Model Certification with recommendations, in designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategy, helping ensure such programs and strategy align with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee or Board of Directors.


text: In the event of a cybersecurity incident, the CSIRT has an Incident Response Plan that outlines the steps that are designed to help ensure regulatory requirements are met and cyber vulnerabilities, if any, are addressed. We periodically conduct "tabletop" exercises to simulate cybersecurity incidents and help ensure that we are prepared to respond to such incidents in accordance with our internal policies and programs, as well as applicable laws and regulations. In addition, tabletop exercises allow us to identify areas for potential improvement and maturation of our Incident Response Plan, or other aspects of our cybersecurity risk management program. These exercises have included participation by members of our Cybersecurity Disclosure Committee, including our CAO and Chief Financial Officer.


text: We have established a supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to assess and evolve our oversight processes to mature how we manage cybersecurity risks associated with the products and services we procure. We generally require our suppliers to adopt security practices based on industry-recognized standards.


text: We have experienced, and may experience in the future, either directly or through our supply chain or other channels, cybersecurity incidents. To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks associated with cybersecurity, refer to "Our business could be negatively affected by cyber or other security threats or other disruptions" in Item 1A. Risk Factors.


text: Our Board of Directors has overall responsibility for risk oversight and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee reports on its activities, findings, and other matters to the full Board of Directors quarterly, or more frequently as events or circumstances may require. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The CAO and CISO present an update to the Audit Committee on our cybersecurity risks and risk management strategies and processes at each regularly scheduled, quarterly meeting. These presentations include assessments on the threat landscape; emerging risks, threats, or vulnerabilities; updates on our risk management activities, including investments in risk mitigation and governance; compliance with laws and regulations; internal controls; and updates on incidents.


text: To test and evaluate the effectiveness of our cybersecurity program, we are subject to annual audits of our program by an outside audit firm who specializes in both information technology and cybersecurity assessments. These assessments include a review of general IT controls, external penetration assessments, internal penetration assessments and security awareness testing of our staff.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: At the management level, we have established two committees that are directly involved in managing and responding to cybersecurity risks and incidents: the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee. The Enterprise Risk Management Committee is responsible for assessing enterprise risk and overseeing our enterprise risk management programs, including the cybersecurity risk management programs described above. The Cybersecurity Disclosure Committee is a subcommittee of our Disclosure Committee and is responsible for assessing the materiality of identified cybersecurity incidents resulting from our monitoring programs described above and informing the Chair of the Audit Committee, the Audit Committee, or the Board of Directors, as appropriate. The CISO has responsibility for notifying the CAO and the Cybersecurity Disclosure Committee of potentially material cybersecurity incidents based on an established policy and risk assessment matrix that incorporates an evaluation of quantitative and qualitative factors such as potential impact on results of operations and financial condition, compliance with laws and regulations, and impact on key stakeholders such as employees and business partners. The CISO has over fifteen years of cybersecurity risk management experience and has served the Company for over twenty years in various roles involving managing information technology, security and compliance functions, including developing key enterprise capabilities such as security engineering and strategies on information security risk management.


text: The CAO and Chief Financial Officer are members of both the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee and are supported by our information security, compliance, contracts, treasury, investor relations, operations, and supply chain organizations so that identified issues can be addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Cybersecurity is one of the top operational risks facing TMCC. We and other financial institutions continue to be targets of ever evolving cybersecurity threats and cyberattacks. As a result, we devote significant resources to a cybersecurity program designed to minimize such risks and protect TMCC, along with data from our customers and clients.

companyName: TOYOTA MOTOR CREDIT CORP


text: Cybersecurity Risk Management and Strategy TMCC's cybersecurity program is designed to identify and assess internal and external cybersecurity threats to and within TMCC's business and operations and to take action aimed at protecting the Company, mitigating and managing cybersecurity risk, and in time of attack, to respond expeditiously to minimize the impact of the attack.


text: Managing cybersecurity threats is a component of our broader enterprise risk management program, which establishes a risk management framework that seeks to identify, assess, and monitor risks that could materially impact our business, customers, clients, employees and stakeholders.


text: TMCC's cybersecurity program utilizes a variety of controls that are designed to identify, prevent, detect, respond to, and recover from cybersecurity threats and events. Those processes and controls include: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity risk policies and standards, implementing controls, monitoring the environment, and responding to cybersecurity incidents; • periodic cybersecurity awareness training for employees and contractors on our policies and emerging cybersecurity threats, including phishing awareness; • internal and independent cybersecurity testing, including penetration testing and tabletop exercises, to assess vulnerabilities of our information systems and evaluate our cyber defense capabilities, technical safeguards and resiliency; • identifying and managing cybersecurity risk of our critical third-party suppliers; • periodic cybersecurity risk assessments for our information systems and applications; • cybersecurity monitoring and response processes employing cross functional teams to identify, assess, escalate, investigate, contain, and remediate incidents; and • incident response and recovery plans.


text: As part of TMCC's cybersecurity program, TMCC engages with assessors and third-party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: TMCC's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third-party service providers with access to TMCC's systems and data, as well as such third-party service providers' adherence to certain cybersecurity standards and processes. As appropriate, TMCC requires such third-party service providers to agree to be subject to cybersecurity evaluations by TMCC.


text: Although, we and our third-party service providers have experienced cybersecurity incidents, which have resulted in adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. However, we expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."


text: The purpose of the Cybersecurity Committee is to assist the Board in fulfilling its oversight responsibility with respect to its information technology use and protection, including enterprise cybersecurity and data privacy, among other things. The Cybersecurity Committee receives, reviews, and discusses reports from members of management, as appropriate or required by law, including but not limited to the Chief Information Officer, Chief Information Security Officer, Chief Risk Officer, Chief Legal, Compliance and Administrative Officer, and other officers or employees as appropriate, regarding TMCC's practices, management and functioning of technology operations and information security, cybersecurity and data privacy risks. The Cybersecurity Committee reports to the Board regarding its activities, its receipt of reports regarding material cybersecurity and data privacy issues, material issues found in vulnerability assessments or penetration testing, and reports from the Chief Information Officer and Chief Information Security Officer.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: TMCC's cybersecurity program is administered by our Chief Information Security Officer. We believe our Chief Information Security Officer and our information security team have the appropriate expertise, background, and depth of experience to manage cybersecurity and data privacy risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, information security leadership roles, military experience, academia, ongoing internal and external training, and regular discussions with consultants and industry peers with applicable knowledge and expertise regarding emerging cybersecurity threats.


text: When a cybersecurity threat or incident is identified, the Chief Information Security Officer works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, the Cybersecurity Committee, and the Board, as necessary, regarding significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, employees and stakeholders, and continues to provide regular reports until such incidents are concluded.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for Barber-Nichols ("BN"). Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: Our CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment including risks associated with ransomware; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: We may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Senior IT Manager and IT Manager regularly inform our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices, which are integrated into the Company's overall risk management system. To protect the Company's information systems from cybersecurity threats, the Company uses various security technologies and tools that help the Company identify, escalate, investigate, manage, resolve and recover from security incidents in a timely manner. These efforts include: • ongoing collection of threat intelligence and environment awareness through monitoring, • data protection management and vulnerability monitoring through data loss prevention and exfiltration tools, • cybersecurity risk management processes and practices, • control assurance, • secure development of new products, • identity and access management, • incident response, auditing and monitoring, and • maintaining a 24x7 security operations center to allow for always available incident response.

companyName: NetApp, Inc.

ticker: NTAP


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into our incident and risk management processes. In the event we identify a cybersecurity incident, our senior management, consisting of the Chief Financial Officer, Chief Security Officer (CSO), and Chief Legal Officer, review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.


text: The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engages third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services or occurs on our systems, within our supply chain, or on our end-user customer systems, or if stored data is improperly accessed, customers may reduce or cease using our solutions, our reputation may be harmed and we may incur significant liabilities."


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CSO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the company, related metrics, and any incidents or issues that require attention from the Board of Directors.


text: The CSO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.


text: NetApp's CSO, in coordination with the Chief Information Security Officer (CISO) is responsible for leading the assessment and management of cybersecurity risks. The current CSO and CISO each have over 30 years of experience in IT and information security.


text: The CSO and CISO stay informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.


text: Our Board of Directors and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee of the board on a quarterly basis reviews cybersecurity risks and our board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. The board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, the board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining limited access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Operational Risks."


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We are developing processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we use or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks from cybersecurity threats include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.


text: We have not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. We rely extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including conducting scans of the threat environment and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats, including risk assessments, incident detection and response, end-point detection and response, network security controls, access controls, physical security, systems monitoring, a vendor risk management program, and penetration testing. We work with third parties (including professional services firms, threat intelligence service providers, and penetration testing firms) from time to time that assist us to identify, assess, and manage cybersecurity risks.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Our information security team reviews enterprise level cybersecurity risks at least annually, and key cybersecurity risks are identified, tracked, monitored, and addressed in alignment with our overall enterprise risk management program.


text: We utilize third-party service providers to perform certain business functions. We seek to engage reliable and reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we may review the cybersecurity practices of such provider, contractually impose obligations on the provider, conduct information security risk assessments, and conduct periodic reassessments during their engagement.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cyber-security risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Audit Committee is responsible for overseeing risks from cybersecurity threats, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from our Vice President – Information Technology (Chief Information Officer) concerning our significant cybersecurity threats and risks, and the processes we have implemented to address them.


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.

companyName: BrightView Holdings, Inc.

ticker: BV


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Vice President – Information Technology (Chief Information Officer) is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. Beginning in fiscal 2024, this team began meeting monthly to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.


text: We view cybersecurity threats as a shared responsibility. All new employees with company email addresses receive cybersecurity training as part of their onboarding, as well as annual training. We also periodically publish a cybersecurity newsletter to these employees related to topics such as phishing, social engineering, and insider-threat awareness.


text: Our overall information security risk management approach is designed to enable us to assess, identify and manage major risk exposures, including from material risks from cybersecurity threats, in a timely manner. As part of our information security risk management program, we perform risk assessments in which we map and prioritize information security risks identified through the processes described below. These assessments inform our information security risk management strategies and oversight processes and we view cybersecurity risks as one of the key risk categories we face.

companyName: ORACLE CORP

ticker: ORCL


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems. During fiscal 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, if a cyberattack or other security incident results in unauthorized access to or modification or exfiltration of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.


text: Our corporate security and information security programs are designed to help us prevent, prepare for, detect, respond to and recover from cybersecurity threats. We leverage industry standard security frameworks to evaluate our security controls. Relevant personnel collaborate with subject matter experts throughout the process to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate a potential security incident. We continually conduct security and privacy reviews to pinpoint risks associated with our products, services and enterprise. We also employ various monitoring tools to track suspicious or anomalous activity across our networks, systems, and data, and we simulate cyber threats to proactively address vulnerabilities. Finally, we routinely train our employees on cybersecurity matters.


text: This program includes processes for triaging, assessing the severity of, escalating, containing, investigating and remediating information security events, as well as meeting legal obligations and minimizing customer impact and brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from a cybersecurity incident. Periodic tabletop exercises are conducted to test and reinforce our incident response controls, with incident severity and priority assessed on an ongoing basis.


text: We also conduct external and internal risk management audits to assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. We conduct periodic penetration testing to identify vulnerabilities in our products, services, and systems. We also undergo security-related industry certifications and attestations by external auditors, including System and Organization Controls (SOC) 1, SOC 2, International Organization for Standardization (ISO) 27001, 27017 and 27018, Cloud Security Alliance Security Trust Assurance and Risk (CSA STAR), Payment Card Industry Data Security Standard (PCI DSS) and other compliance frameworks. Additionally, our vendor risk management program identifies and mitigates risks associated with third-party service providers, including those within our supply chain and those with access to our customer or employee data or systems. We use the findings from these and other processes to review our information security practices, procedures and technologies.


text: Cybersecurity is an important area of focus for our Board of Directors. Our information security risk management program is designed to allow our Board of Directors to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board of Directors oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee (F&A Committee). As reflected in its charter, the F&A Committee assists the Board of Directors with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management, including Mr. Screven, our Executive Vice President and Chief Corporate Architect (Chief Corporate Architect). In turn, the F&A Committee reports to the full Board of Directors on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Corporate Architect, Chief Privacy Officer and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.


text: Index to Financial Statements Our Chief Corporate Architect is responsible for day-to-day identification, assessment and management of the information security risks we face. Our Chief Corporate Architect studied computer science at Carnegie Mellon University and has been with Oracle since 1986 in a number of positions. In his current role as Chief Corporate Architect, he drives technology and architecture decisions across all Oracle products and leads companywide strategic initiatives, including with respect to industry standards and security, to ensure that product development is consistent with Oracle's overall long-term strategy.


text: Our Chief Corporate Architect is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Chief Corporate Architect and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Chief Corporate Architect, who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board of Directors and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board of Directors and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.


text: We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program as well as cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo annual evaluations of our cybersecurity program, conducted by our cybersecurity external advisory firm.


text: Our cybersecurity program evaluation identified various risks and issues that we continue to mitigate to further improve our program. This includes: • Establishing a cybersecurity training program for users. • Implementing a third-party risk management program to support our existing Third-Party Risk Management Policy and process to assess the risks associated with our critical third-party vendor engagements. • Testing our Cybersecurity Incident Response Plan. • Establishing additional processes for identifying cybersecurity threats and vulnerabilities within the environment in which we operate. • Enhancing our technical security management safeguards and configurations.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We have a relationship with various law firms to assist with advisory on legal aspects of containing incidents and communicating accordingly.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") contractor. Our IT consultant leverages their over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents.


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives quarterly updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.


text: Cybersecurity Risks We maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, and quantify and evaluate their associated impacts and risk levels. A Cybersecurity Risk Register is also leveraged to track identified cybersecurity risks to date and update treatment of such risks accordingly.


text: For additional information, see "Item 1A—Risk Factors." In the last two reporting years, we did not experience any material cybersecurity incidents or threats.


text: Cybersecurity is a significant and integrated component of Central Plains Bancshares, Inc. risk management strategy. As a financial services corporation, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, The Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect The Company.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: To prepare and respond to incidents, the company has implemented a multi-layered cybersecurity strategy integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information and network security, data management, business continuity and disaster recovery, privacy, third-party risk management, and incident response. The company engages third-party consultants and independent auditors to, among other things, conduct penetration and vulnerability tests, monitor systems, perform cybersecurity risk assessments, and conduct audits.


text: The Information Technology Department is primarily responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the IT Manager who reports directly to the Executive Vice President/Chief Operations Officer (COO). The IT Manager has more than seven years of experience with the company and additional years of experience in the information technology ("IT") field. The IT Manager is assisted in overseeing Information Technology by an IT Managed Service Provider firm. The IT Manager and COO oversee the information security program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security & Network System Policy identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Commit and information from committee meetings and testing is reported to the Board.


text: The company has implemented an Incident Response Plan to provide a structured incident response process for information security incidents that affect any of the information technology systems, network, or data of the company. The Incident Response Plan is implemented and maintained by the COO.


text: On a periodic basis, but not less than annually, the COO, with the assistance of IT Department and Compliance/Risk Management staff, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessments, the company's processes and policies may be revised to protect against any anticipated threats or hazards to the security or integrity of such information.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested when possible. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the company.


text: Internal Controls, Audit, and Testing Regular internal monitoring is integral to the risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration and vulnerability testing to test the effectiveness of security controls and preparedness measures is conducted at least annually (generally quarterly for external testing and every 12 to 18 months for internal testing) or more often, if warranted by the risk assessment or other external factors. The COO and IT Manager determine the scope and objectives of the penetration and vulnerability analysis and audits.


text: Service Providers Like many companies, the company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the company maintains a Vendor Management Program, which is implemented through a Vendor Management Program Policy and includes an onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Program is audited as part of IT audits.


text: Employees and Training Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the company. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: At least annually, the Annual Electronic Data Processing Report & Risk Assessment is presented to the Board. The report provides an overview of IT operations, core providers, IT policies, audit and testing information, and IT strategic accomplishments and future planned IT initiatives. The report also includes an IT Risk Assessment and risk matrix. IT audit findings are included on the Master Exam/Audit Tracking Report of Action Items which is presented to the Board bi-monthly.


text: Program Adjustments The COO, with the assistance of the IT Manager, monitors, evaluates, and adjusts the Information Security & Network Systems Policy considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan To ensure that information security incidents can be recovered from quickly and with the least impact to the company and its customers, the company maintains an Incident Response Policy which is designed to work in conjunction with the Disaster Recover/Business Continuity Plan. The COO is responsible for implementing and maintaining the Incident Response Policy.


text: Risk management and Strategy We have processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties. We engage third-party consultants and legal advisors in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: American Outdoor Brands, Inc.

ticker: AOUT