text: The Company considers its material cybersecurity-related risks, as described in more detail below and at Item 1A. Risk Factors, and applies various frameworks to establish controls that are reasonably designed to identify, protect, detect, respond to, and recover from significant cybersecurity incidents. The Company also tests its cybersecurity program to assess whether enhancements to cybersecurity measures are appropriate, such as additional detection and prevention capabilities. These tests may include the use of internal or third-party external risk assessments, and penetration testing. The Company also conducts periodic cybersecurity assessments, as appropriate, pursuant to its annual risk assessment process. Third party resources may also be used for these assessments.


text: As part of its cybersecurity program, CSX partners with a third-party to provide a managed service that is designed to enable continuous monitoring at its Security Operation Center ("SOC"). The SOC has established processes to identify, address, and remediate cybersecurity threats or vulnerabilities. This includes the engagement, where necessary, of third-party experts, advisors, and other cybersecurity professionals that have been retained by the Company to assist in responding to cybersecurity incidents or threats. Company processes also include various procedures for notifying members of the company's cybersecurity department, Chief Information Security Officer ("CISO"), legal department, accounting department, and others as applicable.

companyName: CSX CORP

ticker: CSX

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Company has processes designed to provide reasonable oversight for the identification of cybersecurity risks associated with certain third-party service providers. As appropriate, the Company requires certain third-party providers to complete a cybersecurity questionnaire, to provide Service Organization Control assessment results, if such results exist, or to agree to contractual language regarding cybersecurity and incident notification obligations in agreements with the company. CSX also has processes that help monitor risks associated with its key third-party vendors' technology systems, including, where appropriate, performing security assessments of cyber incidents through dashboard alerting for reported events. CSX's internal cybersecurity processes and disclosure protocols consider cybersecurity incidents involving key applications provided by third-parties.

stage1Category: Third-Party Risk


text: The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents as discussed in more detail in Item 1A. Risk Factors. In light of the numerous cybersecurity risks that CSX faces, it is reasonably likely that any of the related risks, individually or collectively, if significant, could materially affect the Company's operations, including but not limited to service interruption, train accident or derailment, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties.

stage1Category: Strategy Integration


text: Cybersecurity Governance The cybersecurity program and related risks at CSX are managed by the VP Technology and CISO. The Company's CISO is a Certified Information Systems Auditor with over 30 years of industry experience including information security leadership positions at multiple publicly-traded companies.

stage1Category: Management Role

stage1Method: majority


text: The CISO is notified of cybersecurity events as needed based on the Company's processes for addressing cybersecurity incidents and threats. The CISO is supported by a team that includes the SOC, which consists of the Deputy Chief Information Security Officer and other cybersecurity professionals as well as a team of third-party contractors. The SOC, with the assistance of outside third-parties as needed, analyzes, evaluates and remediates cybersecurity incidents and provides investigative information to the CISO. Depending on the significance of any specific cybersecurity incident or threat, and/or relation to prior incidents, the CISO will escalate relevant information, as appropriate, and the Company's legal and accounting groups, with assistance from other company departments and third parties, will assist in assessing potential SEC disclosure obligations. The CISO coordinates disclosure to other agencies, when necessary, including requirements under the Transportation Security Administration directives.


text: More significant cybersecurity incidents or threats may result in notifications to senior leadership and, if necessary, to the Audit Committee and the Board of Directors. Additionally, a cybersecurity governance briefing takes place quarterly with leaders from the Company's technology, operations, commercial, legal, and accounting departments to discuss cybersecurity risks, threats, and incidents, including updates from the SOC and an assessment of ways to mitigate and remediate any threats or incidents the Company may be facing.


text: The Company's Audit Committee of the Board of Directors oversees the Company's cybersecurity risk, mitigation strategies and overall resiliency of the Company's technology infrastructure. Such risk is managed as part of the Company's overall risk management and business continuity processes and is included in the ERM program, which is also overseen by the Audit Committee. The Audit Committee periodically reviews assessments of information security controls and procedures, any incidents that could have a potentially significant impact on the company's network, as well as potential cybersecurity risk disclosures. The Company's senior leadership team briefs the Audit Committee and Board of Directors at least annually on information technology and cybersecurity matters, including more frequent updates as circumstances warrant. Such annual updates include significant findings or updates by internal or external evaluations. The Audit Committee is apprised annually on emerging risks to the Company, including education on cybersecurity-related matters as needed. CSX has a cybersecurity expert on the Board and its Audit Committee to provide expanded oversight of the Company's cybersecurity and technology systems.

stage1Category: Board Governance


text: Cybersecurity Risk Management and Strategy Strong performance and reliability of the Company's technology systems are critical to operating safely and effectively, and protecting personal and customer data is essential to maintaining stakeholder trust. The Company has implemented processes designed to assess, identify, and manage material cybersecurity risks, as described further below. CSX maintains a cybersecurity framework that is integrated across the organization through people, processes and technology to help protect the personal information of its customers, its contractors and its suppliers as well as protect the integrity of its own operations. Cybersecurity is also integrated into the Company's Enterprise Risk Management ("ERM") program. The Company equips CSX systems with various cybersecurity tools, conducts vulnerability scans and provides critical cybersecurity information to application users, as appropriate. The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such activity and, as appropriate, proactive measures employees can take to safeguard company information and devices. The Company also provides cybersecurity awareness training to employees and conducts cybersecurity testing exercises to help maintain cybersecurity vigilance. With the assistance of third-party consultants, the Company conducts an annual cybersecurity exercise, which is often a "tabletop" scenario involving a cross-functional group responding to a hypothetical cybersecurity threat.


text: Cybersecurity Governance The cybersecurity program and related risks at CSX are managed by the VP Technology and CISO. The Company's CISO is a Certified Information Systems Auditor with over 30 years of industry experience including information security leadership positions at multiple publicly-traded companies. The CISO is supported by a team that includes the SOC, which consists of the Deputy Chief Information Security Officer ("Deputy CISO") and other cybersecurity professionals as well as a team of third-party contractors. The Deputy CISO has over 20 years of industry experience including federal cyber law enforcement.


text: The CISO is notified of cybersecurity events as needed based on the Company's processes for addressing cybersecurity incidents and threats. The SOC, with the assistance of outside third-parties as needed, analyzes, evaluates and remediates cybersecurity incidents and provides investigative information to the CISO. Depending on the significance of any specific cybersecurity incident or threat, and/or relation to prior incidents, the CISO will escalate relevant information, as appropriate, and the Company's legal and accounting groups, with assistance from other company departments and third parties, will assist in assessing potential SEC disclosure obligations. The CISO coordinates disclosure to other agencies, when necessary, including requirements under the Transportation Security Administration directives.


text: Insurance Coverage. We maintain insurance coverage relating to cybersecurity risks. As described in " Risk Factors — Operational and Model Risk," our insurance may not be sufficient to provide adequate loss coverage.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Cybersecurity Risk Management and Strategy We maintain a comprehensive cybersecurity risk management program modeled by relevant standards provided by organizations such as the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization (27001 - Information Security Standard). Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing.


text: We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those set by NIST as guidelines.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K. As of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to have a material adverse effect on us, our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight ("LCO") Committee and the review of materiality determinations of cyber incidents to the Audit Committee.


text: The LCO Committee is charged with, among other responsibilities, reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Further, the LCO Committee receives periodic reports on cybersecurity risks and management of those risks from our Senior Director of IT Governance, Risk and Compliance ("Senior Director"). The Senior Director's presentations to the LCO Committee include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance.


text: Our cybersecurity team is led by our Senior Director who reports directly to our Chief Financial Officer and is responsible for assessing and managing cybersecurity risks. The Senior Director is a Certified Information Security Professional and a Certified Information Systems Auditor with over 20 years of experience evaluating and remediating IT risk and leads security control implementation, risk and compliance monitoring, security tool management, and incident response planning. Reporting to the Senior Director, the Director of Information Security possesses expert knowledge in threat modeling and vulnerability testing methodologies. The Director of Information Security leads efforts to build security into all IT processes and procedures to protect against risks related to data leakage, broken authentication, injection flaws, improper encryption, and attacks on other application vulnerabilities.


text: Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced third-party cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce each risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures or cyber incidents could harm the Company's business" in this Annual Report. As of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to have a material adverse effect on us, our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight ("LCO") Committee and the review of materiality determinations of cybersecurity incidents to the Audit Committee.


text: The Chair of the Audit Committee is regularly informed by our CFO of both material and non-material cybersecurity risks and incidents. The full Audit Committee must be notified any time our incident response program has determined that a cybersecurity incident is material or requires reporting to a regulatory body.


text: We use a cross-departmental approach to addressing cybersecurity risk, with our cybersecurity, product security and legal teams presenting quarterly on key topics to a committee of leaders in finance, regulatory, and corporate affairs functions. This leadership committee meets quarterly to ensure that we have input and oversight from critical stakeholders into our cybersecurity program and evolving issues.

companyName: STRYKER CORP

ticker: SYK


text: Information security risks for large institutions like us have continued to significantly increase and we and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other information security threats. These risks are an unavoidable result of conducting our business, and managing these risks is an inherent part of our business activities. We describe the cybersecurity risks we face in " Risk Factors — Operational and Model Risk."

stage1Category: None/Other


text: Cybersecurity Risk Management Program We have developed and continue to enhance our cybersecurity risk management program as we seek to protect the security of our computer systems, software, networks and other technology assets against unauthorized attempts to access confidential information and data or to disrupt or degrade business operations. Our cybersecurity risk management program has evolved based on the changing needs of our business, the evolving threat environment and FHFA regulatory guidance.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Cybersecurity Framework"). While we generally consult the NIST Cybersecurity Framework when designing and assessing our cybersecurity risk management program, we have not implemented and do not plan to implement all categories and subcategories included in the framework. We use the framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business based on our current understanding of the cybersecurity threat environment.


text: In 2023, we conducted our most recent maturity assessment of our use of the NIST Cybersecurity Framework to manage our cybersecurity risk. These assessments measure the extent to which we have implemented the framework's categories and subcategories, but do not specifically assess the effectiveness of our cybersecurity program. Based on these assessments, we develop select improvements to our cybersecurity risk management program to help ensure we maintain a program designed to align to industry benchmarks and financial services peers.


text: Integration into Enterprise Risk Management Framework Our cybersecurity risk management program is integrated into our overall Enterprise Risk Management framework. Our Enterprise Response Framework establishes the reporting structure and escalation process for managing all enterprise incidents, including cybersecurity-related incidents. The framework defines the relationship and notification steps among the various crisis management stakeholders, including the Board of Directors, the Management Committee, the CEO, other members of the executive leadership team, the crisis manager and crisis management coordinators. See "Cybersecurity Governance—Management Role" for a description of the oversight role of the Enterprise Risk Management division, Internal Audit and the management-level Technology Risk Committee and Enterprise Risk Committee relating to cybersecurity risk management.


text: Cybersecurity Risk Management Strategy Overview and Goal. Fannie Mae has a multilayered cybersecurity defense strategy. We take a risk-based approach that prioritizes and attempts to plan for the highest impact events first. Our cybersecurity threat operations operate with the goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with incident response and recovery plans.


text: Tools and Safeguards. As part of our cybersecurity defense strategy, we employ tools and systems safeguards intended to help secure our networks, applications, data and infrastructure, and to manage cybersecurity vulnerabilities. These safeguards include network and perimeter defense, infrastructure security, endpoint protection, data protection, identity management and network segmentation. We work to evaluate and improve on these tools and safeguards through periodic cybersecurity assessments and the integration of cybersecurity threat intelligence.


text: Backup Data Storage. We have both internal and external third-party backup data storage to help protect our data from cybersecurity incidents. We test our backup restoration process on a regular basis.


text: Response Plans and Procedures. We maintain cybersecurity incident response procedures that identify the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we routinely practice these activities and processes. We also have business and technology continuity plans and a crisis management plan, which we test on a regular basis.


text: Role of External Consultants, Vendors and Other Third Parties We regularly use external consultants and vendors to assist in our management of cybersecurity risks: • We regularly employ third parties to evaluate the security of our networks, including engaging an external vendor to conduct penetration testing against our network. • We engage an external vendor to review and test our cybersecurity incident response plan on at least an annual basis, including to assist with incident response exercises. • We engage a third party to assess the design of our cybersecurity controls and control environment, including assisting with our 2023 NIST Cybersecurity Framework maturity assessment. • We have external vendors on retainer to assist with cybersecurity incident response activities.


text: External assessments have identified gaps and suggested enhancements that we consider when making changes to our cybersecurity risk management program.


text: We are also focused on building strong relationships with the appropriate government and law enforcement agencies and with other businesses, industry groups and cybersecurity services to better understand the cybersecurity risks in our environment, enhance our defenses and improve our resiliency against cybersecurity threats.


text: Third-Party Cybersecurity Risk Oversight Our cybersecurity risk management program extends to oversight of third parties that pose a cybersecurity risk to us, including lenders that use our systems and third-party service providers. In alignment with the NIST Cybersecurity Framework and FHFA regulatory guidance, we have established a risk-based framework for managing third-party risk that defines specified triggers for assessing and reporting cyber-related third-party risks and events. Pursuant to this framework, we have implemented both preventive and detective controls to mitigate cybersecurity risks posed by third parties.


text: We have identified certain third parties that pose a higher cybersecurity risk to us because they have significant access to our systems or data. For these higher-risk third parties, we have implemented additional requirements, including: • We assess these higher-risk third parties' cybersecurity controls through a cybersecurity questionnaire and a review of their cybersecurity controls, either through independent audits or by direct review of their cybersecurity policies and practices. • We use third-party cybersecurity monitoring and alert services to monitor these higher-risk third parties. • We conduct periodic monitoring reviews of these higher-risk third parties' cybersecurity policies and practices.


text: We follow a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, enterprise risk management, internal audit and other key business Cybersecurity | Cybersecurity Risk Management and Strategy functions in an ongoing dialogue regarding cybersecurity threats and incidents. As described in "Board Oversight"


text: below, we also regularly report to the Board and the Risk Policy and Capital Committee of the Board on cybersecurity risk matters. We have implemented controls and procedures for the escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such incidents can be made in a timely manner.


text: Cybersecurity risk management is overseen by the full Board of Directors and by the Risk Policy and Capital Committee of the Board. While the Board maintains oversight of cybersecurity risk, the Board has delegated oversight authority at the management level for risk-related matters, including cybersecurity risk matters, to the Enterprise Risk Committee, as described under "Management Role" below.


text: The Board and the Risk Policy and Capital Committee generally engage in discussions throughout the year with management on cybersecurity risk matters. The Chief Information Security Officer and other members of the management team provide reports to the Board and the Risk Policy and Capital Committee on cybersecurity risk matters on a regular basis, including updates on our cybersecurity risk management program, recent developments in cybersecurity and privacy regulation, evolving standards, third-party reviews, general technological trends, information security considerations with respect to the company's peers and third parties, the external threat environment, and the steps the company is taking to address and mitigate the risks associated with the evolving cybersecurity threat environment. Management also discusses cybersecurity developments with the Chair of the Risk Policy and Capital Committee and other Board members between Board and committee meetings, as appropriate. The company has procedures to escalate information regarding certain cybersecurity incidents to the Board Chair. At least annually, the Board reviews and approves the company's Cybersecurity Risk Policy and Operational Risk Policy.


text: Our Information Security organization, which is headed by our Chief Information Security Officer, has primary responsibility for assessing and managing our cybersecurity risks. Our Chief Information Security Officer is the member of our management team who is principally responsible for overseeing the company's cybersecurity risk management program.


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: iWallet Corp

ticker: IWAL


text: The Information Security organization works collaboratively across the company to protect the company's information systems from cybersecurity threats and to respond to cybersecurity threats and incidents. The Information Security organization monitors information systems to detect anomalies, including attempted cyber attacks, as well as user activity for access controls and risks of insider threat. The Information Security organization also monitors and investigates cybersecurity incidents through detection tools, reports from end-users, and other cybersecurity threat and vulnerability intelligence. The Information Security organization also shares and obtains information on cybersecurity threats through participation in the Financial Services Information Sharing and Analysis Center, referred to as FS-ISAC, a member-driven organization that advances cybersecurity and resilience in the global financial system.


text: As appropriate, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the company's incident response processes. The Information Security organization and Enterprise Risk Management are informed about and monitor the prevention, detection and mitigation of cybersecurity incidents through risk and control assessments, targeted reviews, scenario analysis, and monitoring of risk metrics. The company's performance in managing cybersecurity risk is reported to the Technology Risk Committee, the Enterprise Risk Committee and the Board of Directors.


text: As noted above, the Board has delegated oversight responsibility at the management level for risk-related matters to the Enterprise Risk Committee. The Enterprise Risk Committee has delegated primary responsibility for management-level oversight of cybersecurity risk management to the Technology Risk Committee. The Technology Risk Committee receives reports on cybersecurity risk matters on a regular basis from the company's Chief Information Security Officer.


text: The Technology Risk Committee reviews and approves the company's management-level cybersecurity risk policies and standards. The Technology Risk Committee also reviews and monitors metrics relating to cybersecurity risk. The Technology Risk Committee escalates matters to the Enterprise Risk Committee as appropriate.


text: The company's Enterprise Risk Management division provides risk-based independent oversight of cybersecurity risk management performed by the Information Security organization. The Technology Risk Committee and Enterprise Risk Committee are each chaired by a member of the Enterprise Risk Management division.


text: The company's Internal Audit organization audits the Enterprise Risk Management division's oversight of cybersecurity risk management and also independently tests the effectiveness of the company's cybersecurity risk management and governance. Members of the Internal Audit organization participate as non-voting members of both the Technology Risk Committee and the Enterprise Risk Committee.


text: Management Expertise Our Chief Information Security Officer has nearly 20 years of professional experience in information security, including over 7 years as Fannie Mae's Chief Information Security Officer and 1 year as Fannie Mae's Deputy Chief Information Security Officer. Our Chief Information Security Officer holds a graduate degree in information technology management.


text: Technology Risk Committee Members of the Technology Risk Committee include officers with expertise in cybersecurity risk oversight, such as the Chief Information Security Officer described above, the head of our Technology Risk Oversight department, and the Chief Technology Officer. As of December 2023, a pproximately three-quarters of the members of the Technology Risk Committee had prior work experience in cybersecurity, a relevant degree or certification, or other knowledge, skills or background in cybersecurity.


text: Enterprise Risk Committee Members of the Enterprise Risk Committee include senior leaders throughout the company, i ncluding our Chief Risk Officer (who chairs the Committee and is the head of our Enterprise Risk Management division), Chief Executive Officer, Chief Financial Officer, General Counsel, Head of Multifamily Business, Head of Single-Family Business, and Chief Information Office r. In addition, our Chief Audit Executive is a non-voting member of the Enterprise Risk Committee. As of December 2023, more than half of the members of the Enterprise Risk Committee had prior work experience in cybersecurity or other knowledge, skills or background in cybersecurity.


text: Impact of Risks from Cybersecurity Threats As noted above, we and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other information security threats. To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business, including our business strategy, results of operations or financial condition. However, large-scale cyber attacks perpetrated against other companies in recent years suggest that the risk of damaging cyber attacks is increasing. As a result, we continue to invest in our cybersecurity infrastructure, including investment in prevention capabilities and response readiness.


text: Notwithstanding our efforts to manage cybersecurity risks as described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, including our business strategy, results of operations and financial condition. Cybersecurity threats are constantly evolving and we may not be able to anticipate, detect or recognize cybersecurity threats to our systems and assets, or to implement effective preventive measures against all cybersecurity threats, especially because the techniques used in cyber attacks are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. We routinely identify cybersecurity threats as well as vulnerabilities in our systems and work to address or mitigate those we have identified; however, some cybersecurity vulnerabilities take a substantial amount of time to resolve or mitigate and therefore we continue to have cybersecurity vulnerabilities that we have identified but not resolved or mitigated. As a result, we could experience a cybersecurity incident that materially affects our business in a quarterly or annual fiscal period. See " Risk Factors — Operational and Model Risk " for additional discussion of cybersecurity risks to our business.


text: Cybersecurity risk is a key operational risk that we face; therefore, managing cybersecurity risk is an inherent part of our business activities. We describe the material cybersecurity risks we face in " Risk Factors — Operational and Model Risk."


text: Cybersecurity Risk Management Program We have developed and continue to enhance our cybersecurity risk management program as we seek to protect the security of our information systems, software, networks and other technology assets against unauthorized attempts to access confidential information and data or to disrupt or degrade business operations. Our cybersecurity risk management program has evolved, and continues to evolve, based on the changing needs of our business, the evolving threat environment and FHFA regulatory guidance.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Cybersecurity Framework"). While we generally consult the NIST Cybersecurity Framework when designing and assessing our cybersecurity risk management program, we have not implemented and do not plan to implement all categories and subcategories included in the framework. We use the framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business based on our current understanding of the cybersecurity threat environment.


text: Integration into Enterprise Risk Management Framework Our cybersecurity risk management program is integrated into our overall Enterprise Risk Management framework, which is described in "MD&A—Risk Management—Overview." Our Enterprise Response Framework establishes the reporting structure and escalation process for managing all enterprise incidents, including cybersecurity-related incidents. The framework defines the relationship and notification steps among the various crisis management Cybersecurity | Cybersecurity Risk Management and Strategy stakeholders, including the Board of Directors, the Management Committee, the President and CEO, other members of the executive leadership team, the crisis manager and crisis management coordinators. See "Cybersecurity Governance—Management Role" for a description of the oversight role of the Corporate Risk & Compliance division, Internal Audit and the management-level Technology Risk Committee and Enterprise Risk Committee relating to cybersecurity risk management.


text: Cybersecurity Risk Management Strategy Overview and Goal. Fannie Mae has a multilayered cybersecurity defense strategy. We take a risk-based approach that prioritizes the highest impact events. Our cybersecurity threat operations operate with the goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with incident response and recovery plans.


text: Tools and Safeguards. As part of our cybersecurity defense strategy, we employ tools and systems safeguards intended to help secure our networks, applications, data and infrastructure, and to manage cybersecurity vulnerabilities. These safeguards include network and perimeter defense, infrastructure security, cloud security, endpoint protection, data protection, identity management and network segmentation. We work to evaluate and improve on these tools and safeguards through periodic cybersecurity assessments and the integration of cybersecurity threat intelligence.


text: Backup Data Storage. We have both internal and external third-party backup data storage to help protect our data from cybersecurity incidents. We test our backup restoration process on a regular basis.


text: Response Plans and Procedures. We maintain cybersecurity incident response procedures that identify the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we routinely practice these activities and processes. We also have business and technology continuity plans and a crisis management plan, which we test on a regular basis.


text: Training. We provide mandatory cybersecurity training to employees and contractors on an annual basis. We test our employees' response to simulated phishing scenarios on a regular basis. We also conduct enhanced training for certain groups of employees that may pose higher risk.


text: Role of External Consultants, Vendors and Other Third Parties We regularly use external consultants and vendors to assist in our assessment and management of cybersecurity risks, including employing third parties to evaluate the security of our networks and our approach to cybersecurity risk management, such as external vendors that conduct penetration testing against our network on at least an annual basis and an external vendor that reviews and tests our cybersecurity incident response plan on at least an annual basis. We also have external vendors on retainer to assist with cybersecurity incident response activities if requested.


text: We are also focused on building and maintaining relationships with the appropriate government and law enforcement agencies and with other businesses, industry groups and cybersecurity services to better understand the cybersecurity risks in our environment, enhance our defenses and improve our resiliency against cybersecurity threats.


text: Third-Party Cybersecurity Risk Oversight Our cybersecurity risk management program extends to oversight of third parties that pose a cybersecurity risk to us, including lenders that use our systems and third-party service providers. In alignment with the NIST Cybersecurity Framework and FHFA regulatory guidance, we have established a risk-based framework for managing third-party risk that defines specified triggers for assessing and reporting cyber-related third-party risks and events. Pursuant to this framework, we have implemented both preventive and detective controls to mitigate cybersecurity risks posed by third parties.


text: We have identified certain third parties that we believe pose a higher cybersecurity risk to us because they have significant access to our systems or data. For these higher-risk third parties, we have implemented additional requirements, including: • We assess these higher-risk third parties' cybersecurity controls through a cybersecurity questionnaire and a review of their cybersecurity controls, either through independent audits or by direct review of their cybersecurity policies and practices. • We use third-party cybersecurity monitoring and alert services to monitor these higher-risk third parties.


text: Cybersecurity | Cybersecurity Risk Management and Strategy • We conduct periodic monitoring reviews of these higher-risk third parties' cybersecurity policies and practices.


text: We address the risk from cybersecurity threats using a cross-functional approach, involving management personnel from our technology, operations, legal, corporate risk & compliance, internal audit and other key business functions in an ongoing dialogue regarding cybersecurity threats and incidents. As described in "Board Oversight" below, we also regularly report to the Board and the Risk Policy and Capital Committee of the Board on cybersecurity risk matters. We have implemented controls and procedures for the escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such incidents can be made in a timely manner.


text: The full Board of Directors oversees the company's cybersecurity risk management, assisted by the Risk Policy and Capital Committee of the Board. The Board has delegated management-level risk oversight, including for cybersecurity risk matters, to the Enterprise Risk Committee, as described under "Management Role" below.


text: The Board and the Risk Policy and Capital Committee generally engage in discussions throughout the year with management on cybersecurity risk matters. The Chief Security Officer and other members of the management team provide reports to the Board and the Risk Policy and Capital Committee on cybersecurity risk matters on a regular basis, including updates on our cybersecurity risk management program, as well as external cybersecurity developments, threats and risks. Management also discusses cybersecurity developments with the Chair of the Risk Policy and Capital Committee and other Board members between Board and committee meetings, as appropriate. The company has procedures to escalate information regarding certain cybersecurity incidents to the Board Chair. At least annually, the Board reviews and approves the company's Cybersecurity Risk Policy and Operational Risk Policy.


text: Our Chief Security Officer leads our Information Security organization, which has primary responsibility for assessing and managing our cybersecurity risks. Our Chief Security Officer has principal management responsibility for overseeing the company's cybersecurity risk management program. Our Chief Security Officer reports to o ur Chief Operating Officer.


text: The Information Security o rganization works collaboratively across the company to help protect the company's information systems from cybersecurity threats and to respond to cybersecurity threats and incidents. The Information Security organization monitors information systems to detect anomalies, including attempted cyber attacks, as well as user activity for access controls and risks of insider threat. The Information Security organization also monitors and investigates cybersecurity incidents through detection tools, reports from end users, and other cybersecurity threat and vulnerability intelligence. The Information Security organization also shares and obtains information on cybersecurity threats through participation in the Financial Services Information Sharing and Analysis Center, referred to as FS-ISAC, a member-driven organization that advances cybersecurity and resilience in the global financial system.


text: As appropriate, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the company's incident response processes. The Information Security organization and Corporate Risk & Compliance division are informed about and monitor the prevention, detection and mitigation of cybersecurity incidents through risk and control assessments, targeted reviews, scenario analysis, and monitoring of risk metrics. The company's performance in managing cybersecurity risk is reported to the Technology Risk Committee, the Enterprise Risk Committee and the Board of Directors.


text: As noted above, the Board has delegated oversight responsibility at the management level for risk-related matters to the Enterprise Risk Committee, members of which include senior leaders throughout the company. The Enterprise Risk Committee has delegated primary responsibility for management-level oversight of cybersecurity risk management to the Technology Risk Committee. The Technology Risk Committee receives reports on cybersecurity risk matters on a regular basis from the company's Chief Security Officer. The Technology Risk Committee reviews and approves the company's management-level cybersecurity risk policies and standards. The Technology Risk Committee also reviews and monitors metrics relating to cybersecurity risk. The Technology Risk Committee escalates matters to the Enterprise Risk Committee as appropriate.


text: The company's Corporate Risk & Compliance division provides risk-based independent oversight of cybersecurity risk management performed by the Information Security organization. Members of the Corporate Risk & Compliance division chair the Technology Risk Committee and the Enterprise Risk Committee.


text: The company's Internal Audit organization audits the Corporate Risk & Compliance division's oversight of cybersecurity risk management and also independently tests the effectiveness of the company's cybersecurity risk management and


text: Cybersecurity | Cybersecurity Governance governance. Members of the Internal Audit organization participate as non-voting members of both the Technology Risk Committee and the Enterprise Risk Committee.


text: Chief Security Officer Our Chief Security Officer has over 20 years of professional experience in information security, including over 8 years as Fannie Mae's Chief Information Security Officer (2016-2024) and over 1 year as Fannie Mae's Deputy Chief Information Security Officer. Our Chief Security Officer holds a graduate degree in information technology management.


text: Technology Risk Committee Members of the Technology Risk Committee include officers with expertise in cybersecurity risk oversight, such as the Chief Security Officer described above and the head of our Technology Risk Oversight department. As of December 2024, several members of the Technology Risk Committee had prior work experience in cybersecurity and several had a relevant degree or certification, or other knowledge, skills or background in cybersecurity.


text: Impact of Risks from Cybersecurity Threats We and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other cybersecurity threats. To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business, including our business strategy, results of operations or financial condition. However, large-scale cyber attacks perpetrated against other companies in recent years suggest that the risk of damaging cyber attacks is increasing. Notwithstanding our efforts to manage cybersecurity risks as described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, including our business strategy, results of operations and financial condition. See " Risk Factors — Operational and Model Risk " for additional discussion of cybersecurity risks to our business.


text: RISK MANAGEMENT AND STRATEGY We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.


text: MANAGEMENT'S ROLE IN MANAGING RISK Primary management responsibility for assessing, monitoring and managing our cybersecurity risks rests with our chief information security officer ("CISO"). Our current CISO has over 30 years of experience in information technology including over 20 years in cybersecurity and oversees a team of cybersecurity professionals with over 140 security, risk, and compliance certifications. The CISO is regularly informed about recent developments in cybersecurity, including potential threats and innovative risk management techniques.


text: The CISO implements and oversees processes for the regular monitoring of our information systems. We use various tools and methodologies to manage cybersecurity risk that are tested regularly. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. In addition, we engage third-party consultants to conduct annual cybersecurity assessments and to conduct audits for compliance with regulatory, Sarbanes-Oxley Act, Service Organization Control Type 2 and International Organization for Standardization standards. We also engage third parties to assess our cybersecurity maturity and risk management programs.


text: The CISO oversees a training and awareness program for employees to take part in protecting the Company against cybersecurity risks. We have implemented annual mandatory security education to help employees understand cybersecurity risks and comply with our cybersecurity policies. Additionally, we provide frequent communications around pertinent cybersecurity topics and policies to all employees. We also provide additional cybersecurity and data protection training to employees in certain roles.


text: As part of our cybersecurity risk management program, we also conduct cybersecurity and privacy assessments on all third parties who integrate with Stryker's data, network, systems and products. We use a combination of internal and external tools to confirm that these third parties meet our security requirements. We leverage standard industry threat model and privacy impact assessment concepts to confirm that data minimization and adequate data protections are in place. We perform supplemental reviews as necessary, commensurate with the risk associated with each vendor. Dollar amounts in millions except per share amounts or as otherwise specified.


text: In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. The cybersecurity and product security teams routinely practice this plan with functions across the organization. We conduct tabletop exercises with senior management, during which we practice the procedures in place to ensure that potentially material cybersecurity risks and incidents are escalated to management and the Board of Directors where applicable.


text: Cybersecurity risks are overseen by the full Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our CISO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings include a range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: RISKS FROM CYBERSECURITY THREATS Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We, our business partners or our third-party vendors could experience a material failure or breach of a key information technology system, network, process or site" in Item 1A. Risk Factors.


text: We use a cross-departmental approach to addressing cybersecurity risk, with our cybersecurity, product security and legal teams presenting quarterly on key topics to a committee of leaders in finance, regulatory, and corporate affairs functions. This leadership committee meets quarterly to ensure that we have input and oversight from critical stakeholders into our cybersecurity program and evolving issues.


text: As part of our cybersecurity risk management program, we also conduct cybersecurity and privacy assessments on all third parties who integrate with Stryker's data, network, systems and products. We use a combination of internal and external tools to confirm that these third parties meet our security requirements. We leverage standard industry threat model and privacy impact assessment concepts to confirm that data minimization and adequate data protections are in place. We perform supplemental reviews as necessary, commensurate with the risk associated with each vendor.


text: Our CISO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors periodically. These briefings include a range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: We assess, identify and manage risks from cybersecurity threats through our global cybersecurity program. The program is managed by a full-time Chief Information Security Officer ("CISO") whose organization manages our cybersecurity strategy, architecture, policies, standards and processes for the security of Haemonetics' enterprise network and information assets. The CISO reports to our Chief Information Officer ("CIO") and is supported by a dedicated security operations team. Our current CISO has over 20 years of information technology experience, including positions of increasing responsibility with respect to security architecture, software engineering, security operations and incident response.

companyName: HAEMONETICS CORP

ticker: HAE


text: The CISO's organization monitors, manages and works to identify and assess, cybersecurity risks through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. Our global cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is certified to the ISO 27001 global standard on Information Security Management. Our cybersecurity program is closely integrated with our QMS under the ISO 13485 standard. Our program utilizes layered defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. Among other things, this includes ongoing systems monitoring with support from a managed detection and response service provider and other third-party vendors to augment our monitoring and response capabilities, as well as a standardized incident response program with incident response team members participating in regularly scheduled management reviews and tabletop exercises. Our CISO and CIO conduct regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems have a written business continuity plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.


text: Cybersecurity is also included in our product development life cycle and part of our vendor and business partner evaluation process. Our product development approach considers cybersecurity best practices and builds security controls into our product design. Haemonetics is a member of MedISAO, an industry organization dedicated to improving the security of medical devices, where security issues can be reported securely. We monitor our products for vulnerabilities and follow bulletins, patches and alerts posted to our download center or communicated directly to customers. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to personal information that we collect, maintain or use.


text: We evaluate cybersecurity risk as part of our broader enterprise risk framework. Our Board oversees Haemonetics' enterprise-wide approach to risk management while our management team is responsible for managing risk on a day-to-day basis and for bringing to the Board's attention material risks facing the Company, including with respect to cybersecurity threats. The Board focuses on the quality and scope of the Company's risk management strategies and considers the most significant areas of risk inherent in the Company's business strategies and operations as well as the steps that management is taking to mitigate those risks. We conduct an annual enterprise risk assessment – including consideration of cybersecurity risks – that is reviewed with the Board and Audit Committee and informs strategic priorities throughout the Company. Additionally, certain Board committees consider discrete categories of cybersecurity risk relating to their respective areas of responsibility. Our CISO reports at least annually on Haemonetics' threat landscape and security programs to our Governance and Compliance Committee, which oversees Haemonetics' compliance programs and policies regarding data privacy and cybersecurity risks associated with our information technology systems. Management also reports on these programs to the Audit Committee as needed and periodically reviews with our Technology Committee certain aspects of new and existing products as they relate to quality, safety and cybersecurity.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity-related risks.


text: The CISO's organization monitors, manages and works to identify and assess, cybersecurity risks through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. Our global cybersecurity program is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is certified to the ISO 27001 global standard on Information Security Management. Our cybersecurity program is closely integrated with our QMS under the ISO 13485 standard. Our program utilizes layered defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. Among other things, this includes ongoing systems monitoring with support from a managed detection and response service provider and other third-party vendors to augment our monitoring and response capabilities, as well as a standardized incident response program with incident response team members participating in regularly scheduled management reviews and tabletop exercises. Our CISO and CIO conduct regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems have a written business continuity plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.


text: We periodically engage external consultants to assess our cybersecurity program. In addition, management's annual assessment of the effectiveness of the Company's internal control over financial reporting assesses the effectiveness of certain controls relating to cybersecurity, and the Company's independent registered public accounting firm audits the effectiveness of the Company's internal control over financial reporting.

companyName: DANAHER CORP /DE/

ticker: DHR


text: We evaluate cybersecurity risk as part of our broader enterprise risk framework. Our Board of Directors oversees Haemonetics' enterprise-wide approach to risk management while our management team is responsible for managing risk on a day-to-day basis and for bringing to the Board's attention material risks facing the Company, including with respect to cybersecurity threats. The Board focuses on the quality and scope of the Company's risk management strategies and considers the most significant areas of risk inherent in the Company's business strategies and operations as well as the steps that management is taking to mitigate those risks. We conduct an annual enterprise risk assessment – including consideration of cybersecurity risks – that is reviewed with the Board and Audit Committee and informs strategic priorities throughout the Company. Additionally, certain Board committees consider discrete categories of cybersecurity risk relating to their respective areas of responsibility. O ur CISO reports at least annually on Haemonetics' threat landscape and security programs to our Governance and Compliance Committee, which oversees Haemonetics' compliance programs and policies regarding data privacy and cybersecurity risks associated with our information technology systems. Management also reports on these programs to the Audit Committee as needed and periodically reviews with our Technology Committee certain aspects of new and existing products as they relate to quality, safety and cybersecurity.


text: Cybersecurity Strategy and Risk Management Danaher's cybersecurity strategy and risk management program focuses on maintaining a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program for assessing, identifying and managing material risks from cybersecurity threats are described below.


text: We maintain cybersecurity policies that articulate Danaher's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Danaher associate, we regularly educate and share best practices with our associates to raise awareness of cybersecurity threats. Every year, associates in applicable job categories are required to take information security and protection training as part of the Danaher Annual Training Program. We also conduct regular education and training for our associates through cyber-event simulations.


text: We strive to implement and maintain layered controls designed to prevent and, where necessary, detect and respond to cybersecurity threats. Our physical controls are designed to restrict access to locations that house significant physical information technology assets. Our technical preventive controls include access restrictions and network security technologies. Our notification policies and processes are designed so that notifications and alerts are escalated to the appropriate personnel on a timely basis to support effective review, response and compliance with legal requirements. In addition to event-specific notifications, data is aggregated and compiled on a regular basis to support the identification of trends and effective program review and oversight. We also recognize that Danaher is exposed to cybersecurity risks that affect third parties whom we rely on to process, store or transmit our electronic information. To manage these risks, we maintain technical security controls as well as processes designed to facilitate Danaher's identification of third-party cybersecurity risks.


text: Key elements of Danaher's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Information technology/cybersecurity is one of five topical areas required to be addressed as part of the annual ERM program. IT and cybersecurity risks are required to be scored using the same methodology applied to all other risk categories, which facilitates an evaluation of the significance and prioritization of cyber-related risks relative to wider business risks. In addition, Danaher policy requires the reporting of certain cybersecurity incident data to Danaher's Risk Committee (comprising senior members of the legal, finance, internal audit and compliance functions) for consideration as part of the ERM process. Members of the Danaher Risk Committee present annually to the Danaher Board of Directors a report on the results of the ERM process, including with respect to information technology and cybersecurity risks. As part of our cybersecurity risk management program, we also maintain cyber insurance in amounts and subject to coverage terms that are typical for companies of our type and size, however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.

companyName: PACCAR INC

ticker: PCAR


text: Cybersecurity Governance and Oversight At the management level, Danaher's cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"), who reports to Danaher's Chief Information Officer ("CIO"), who in turn reports to Danaher's Chief Financial Officer. Danaher's CIO has served as a technology leader for over 25 years, leading cybersecurity, engineering, and operational functions as the CIO for two multi-billion dollar businesses prior to assuming the Danaher CIO role. Danaher's CISO has served for more than 20 years in various information security roles, including serving as the Chief Information Security Officer of two large, publicly-traded companies prior to joining Danaher. The CISO is supported by the Information Risk Steering Committee ("IRSC"), a management committee comprising senior members of the information technology, legal, privacy, finance, internal audit and communications functions. The IRSC supports the CISO and CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation and remediation.


text: At the Board level, Danaher's Board of Directors has delegated to the Audit Committee of the Board responsibility for oversight of risks relating to cybersecurity, as set forth in the Committee's charter. Multiple members of Danaher's Audit Committee have prior work experience overseeing or assessing a cybersecurity function. Danaher's CISO and CIO update the Audit Committee multiple times per year regarding Danaher's cybersecurity program, including key program metrics, initiatives and developments. The Audit Committee regularly briefs the full Board on these matters. In addition, in the event of a significant cybersecurity incident, Danaher policy and process requires timely engagement of and consultation with the Audit Committee.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Danaher, including our business strategy, results of operations or financial condition.


text: Cybersecurity Strategy and Risk Management Danaher's cybersecurity strategy and risk management program focuses on seeking to maintain a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program for identifying, assessing and managing material risks from cybersecurity threats are described below.


text: We strive to implement and maintain layered controls designed to prevent and, where necessary, detect and respond to cybersecurity threats. Our physical controls are designed to restrict access to locations that house significant physical information technology assets. Our technical preventive controls include access restrictions and network security technologies. Our notification policies and processes are designed to have notifications and alerts escalated to the appropriate personnel on a timely basis to support effective review, response and compliance with legal requirements. In addition to event-specific notifications, data is aggregated and compiled on a regular basis to support the identification of trends and effective program review and oversight. We also recognize that Danaher is exposed to cybersecurity risks that affect third parties whom we rely on to process, store or transmit our electronic information. To manage these risks, we maintain technical security controls as well as processes designed to facilitate Danaher's identification of third-party cybersecurity risks.


text: Key elements of Danaher's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Information technology/cybersecurity is one of five topical areas required to be addressed as part of the annual ERM program. IT and cybersecurity risks are required to be scored using the same methodology applied to all other risk categories, which facilitates an evaluation of the significance and prioritization of cyber-related risks relative to wider business risks. In addition, Danaher policy requires the reporting of certain cybersecurity incident data to Danaher's Risk Committee (comprising senior members of the legal, finance, internal audit and compliance functions) for consideration as part of the ERM process. Members of the Danaher Risk Committee present annually to the Danaher Board of Directors a report on the results of the ERM process, including with respect to information technology and cybersecurity risks. As part of our cybersecurity risk management program, we also maintain cyber insurance in amounts and subject to coverage terms that are typical for companies of our type and size. However, such insurance may not be sufficient in type or amount to cover us against damages incurred or claims related to security breaches, cyber-attacks and other related breaches.


text: Busey relies extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see " Item 1A. Risk Factors—Operational Risks."

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • an internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • periodic cybersecurity training for our workforce.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: We face a number of cybersecurity risks in connection with our business. From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations, and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Security Officer ("CISO"). Our CISO has been in the role since September 2020, and has 15 years of experience across external and internal audit, technology risk management, and cybersecurity spanning various industries primarily within the financial services sector, but also including healthcare, technology, consumer products, and manufacturing for both regional and multinational corporations.


text: In addition, our board of directors, as a whole and through its Enterprise Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from Busey's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and Busey's efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.


text: Busey maintains a cyber security risk management program designed to prevent, detect, and respond to information security threats. The program is designed to align with the Cyber Risk Institute's Profile framework, which is based on the National Institute of Standards and Technology's Cybersecurity Framework. The program is led by Busey's Chief Information Security Officer ("CISO"). Busey's CISO has been in the role since September 2020 and has over 15 years of experience across external and internal audit, technology risk management, and cybersecurity matters, spanning various industries primarily within the financial services sector, but also including healthcare, technology, consumer products, and manufacturing for both regional and multinational corporations. Busey's cyber security risk management program is a key part of the Company's overall risk management system, which is administered by the Chief Risk Officer.


text: Busey's cyber security risk management program includes administrative, technical, and physical safeguards to help ensure the security and confidentiality of customer records and information. Busey has long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: • Establishing an internal cybersecurity team that is responsible for conducting regular assessments of Busey's information systems, existing controls, vulnerabilities, and potential improvements; • Employing continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • Performing due diligence with respect to third-party service providers, including their cybersecurity practices, and requiring contractual commitments from Busey's service providers to take certain cybersecurity measures; • Ongoing monitoring and assessment of third-party vendors' cybersecurity practices, including regular audits, compliance checks, and incident reporting requirements; • Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in Busey's systems and processes; • Mandating periodic cybersecurity training for Busey's workforce, which includes awareness programs on phishing, social engineering, and other common cyber threats; • Implementing access control measures such as multi-factor authentication, role-based access controls, and regular access reviews to ensure that only authorized personnel have access to critical systems and data; • Using data encryption for both data at rest and data in transit to protect sensitive information; and • Creating an incident response plan that outlines the steps to contain, mitigate, and remediate the impact of cybersecurity incidents, including communication protocols and post-incident analysis.


text: Busey's security and privacy policies and procedures are in effect across all of its businesses and geographic locations. Busey adheres to various regulatory requirements and standards, including the Gramm-Leach-Bliley Act to ensure compliance with data protection laws. Additionally, Busey maintains cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents.


text: Busey's board of directors, as a whole and through its Enterprise Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, Busey's board of directors and Risk Committee, with support from Busey's cybersecurity advisors, are responsible for ensuring that the risk management processes developed and implemented by management are adequate and functioning as designed. To carry out those duties, both the board of directors and the Risk Committee receive quarterly reports from Busey's management team regarding cybersecurity risks, and Busey's efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.


text: Busey's historical data indicates that while Busey has encountered cybersecurity threats and incidents, none have materially affected the Company. Still, Busey faces a number of cybersecurity risks in connection with its business, and it is possible that threats and incidents identified in the future could have a material adverse effect on Busey's business strategy, results of operations, and financial condition. For additional information on the risks that cybersecurity threats pose to Busey see " Item 1A. Risk Factors—Operational Risks."


text: We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. The Company's cybersecurity program includes administrative, technical, and physical safeguards that address our information systems, including our IT and operational technology environments. The program is designed to ensure the confidentiality, security, integrity, and availability of those systems and the information residing therein.

companyName: Valaris Ltd

ticker: VAL


text: Our cybersecurity strategy leverages administrative safeguards that include policies, procedures, and processes to assess, identify, and manage risks from cybersecurity threats. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides a framework and guidance for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Additionally, all of the Company's employees undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year. Periodically during the year, the Company's IT department leads simulations of cybersecurity incidents with employees to test the organization's ability to respond to a variety of cybersecurity-related scenarios.


text: Our policies, procedures, and processes are aligned with our technical tools, which include continuous security monitoring and alerting, an AI-based tool to facilitate cybersecurity incident identification and remediation, and other technologies, to ensure the security of our systems and information. We also have implemented certain physical safeguards, such as restricted access to areas containing critical IT and operational technology equipment, to mitigate risks to our physical environment.


text: alerting the applicable support functions of the potential cybersecurity threat and any defensive action that would be required; and alerting management, as applicable and necessary, of the potential cybersecurity threat. • Members of our Information Security function have broad ranges of qualifications and experience in information technology and security.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Cybersecurity is integrated into our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our ERM risk register, which are reviewed by internal stakeholders who designate the relative level of severity of identified risks. The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the identified risks, mitigation plans and monitoring reports and provides oversight as appropriate.


text: The Audit Committee is responsible for, and actively engaged in, the oversight of our IT and cybersecurity program, including the oversight of risks from cybersecurity threats. All members of the Audit Committee have prior work experience relating to cybersecurity or have obtained a certification or degree in cybersecurity. The Audit Committee, at least quarterly, receives reports from the Company's Senior Director – Information Technology ("SDIT") on, among other things, the Company's cybersecurity incidents, risks and measures, training and organizational readiness. The board of directors is kept apprised of cybersecurity risk matters, including through participation in the quarterly cybersecurity briefings to the Audit Committee that are described above. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the board of directors and Audit Committee.


text: At the management level, the SDIT and his team are responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes, including the assessment and management of material risks from cybersecurity threats. The Company's SDIT reports to the Chief Financial Officer. The SDIT has extensive cybersecurity knowledge and skills, gained from over 25 years of relevant work experience. The SDIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with the CIRP and policies and procedures, which may include reports from the IT team. The SDIT also regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.


text: We engage third-party service providers in various capacities to enhance our internal cybersecurity capabilities. The Company engages consultants to assist with cybersecurity assessments, including with respect to cloud security and network vulnerability testing. Internal Audit, along with other internal stakeholders, including IT, determine the Company's need for cybersecurity assessments in conjunction with an annual cybersecurity risk assessment process.


text: Further, pursuant to our CIRP, we have engaged third-party support under a retainer agreement to enable an effective and timely response to a significant cybersecurity incident. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We obtain Systems and Organization Controls ("SOC") 1 and SOC 2 reports, as applicable, from our third-party service providers which assess those entities' controls to cover security, availability, integrity, confidentiality and privacy. Any applicable findings of this third-party assessment are analyzed by the appropriate employees and further action is taken as needed.


text: While we have not experienced any material cybersecurity threats or incidents as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.


text: We have a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats. The Company's cybersecurity program includes administrative, technical and physical safeguards that address our information systems, including our IT and operational technology environments. The program is designed to ensure the confidentiality, security, integrity and availability of those systems and the information residing therein.


text: Our cybersecurity strategy leverages administrative safeguards that include policies, procedures and processes to assess, identify and manage risks from cybersecurity threats. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides a framework and procedures for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Additionally, all of the Company's employees are required to undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats and ways to report such threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year. Periodically during the year, the Company's IT department leads simulations of cybersecurity incidents with employees, including annual tabletop exercises for offshore employees, to test the organization's ability to respond to a variety of cybersecurity-related scenarios.


text: Our policies, procedures and processes are aligned with our technical tools, which include security monitoring and alerting, cybersecurity incident identification and remediation, and other technologies to ensure the security of our systems and information. We also have implemented certain physical safeguards, such as restricted access to areas containing critical IT and operational technology equipment, to mitigate risks to our physical environment.


text: Cybersecurity is integrated into our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our ERM risk register, which are reviewed by internal stakeholders who designate the relative level of severity of identified risks. The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the risk register, including any changes in key risks, and provides oversight as appropriate.


text: The Audit Committee is responsible for, and actively engaged in, the oversight of our IT and cybersecurity program, including the oversight of risks from cybersecurity threats. Two of the members of the Audit Committee have obtained a certification or completed coursework in cybersecurity. The Audit Committee, at least quarterly, receives reports from the Company's Senior Director – Information Technology ("SDIT") on, among other things, the Company's cybersecurity incidents, risks, threats and measures, training and organizational readiness. The board of directors is kept apprised of cybersecurity risk matters, including through participation in the quarterly cybersecurity briefings to the Audit Committee that are described above. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the board of directors and Audit Committee.


text: At the management level, the SDIT and his team are responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes, including the assessment and management of material risks from cybersecurity threats. The Company's SDIT reports to the Chief Financial Officer. The SDIT has extensive cybersecurity knowledge and skills, gained from over 25 years of relevant work experience. The SDIT is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the CIRP, which may include reports from the IT team. The SDIT also regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.


text: We engage third-party service providers in various capacities to strengthen our cybersecurity posture. The Company works with external consultants to conduct cybersecurity assessments, which may include evaluations of cloud security, network vulnerabilities and other areas of cyber risk. Our IT department, along with other key stakeholders, including Internal Audit, determines the need, scope and frequency of these assessments based on the Company's cybersecurity risk evaluation process.


text: Further, pursuant to our CIRP, we may engage third-party support to enable an effective and timely response to a significant cybersecurity incident. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We obtain Systems and Organization Controls ("SOC") 1 and SOC 2 reports, as applicable, from our third-party service providers which assess those entities' controls to cover security, availability, integrity, confidentiality and privacy. Any applicable findings of this third-party assessment are analyzed by the appropriate employees and further action is taken as needed.


text: As part of the Company's broader information security program, the cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. The Company's cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats and effective management of cyber risks and resilience against cybersecurity incidents. The Company's program leverages portions of several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST 800-53, International Organization for Standardization Information Security Management Systems ("ISO 27001"), the CIS Critical Security Controls, the System and Organization Controls 2 Type 2 ("SOC2 Type 2"), the Payment Card Industry Standards ("PCI") and the Health Insurance Portability and Accountability Act ("HIPAA").

companyName: ROBERT HALF INC.

ticker: RHI


text: Cybersecurity Governance The Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") and the Audit Committee and implemented and managed by the Company's Enterprise Information Security Steering Committee, a cross-functional team of senior executives representing business functions across Robert Half and chaired by the Chief Information Security Officer ("CISO"). The CISO oversees the Enterprise Information Security team ("EIS").


text: Board Governance The Board views cybersecurity as part of the Company's overall enterprise risk management function, which the Board oversees. The Board takes cybersecurity into account as part of the Company's business strategy, financial planning and capital allocation.


text: During 2023, there were no identified cybersecurity risks or threats, including as a result of previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents or disruptions may not be fully insured. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: The Board oversees the Company's information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Board receives annual updates from the Company's CISO, and/or members of the executive leadership team. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape and a detailed threat assessment relating to information technology risks. Notice of potential material cybersecurity incidents to the Audit Committee Chair and the Board is provided for in the Cybersecurity Incident Response Plan (the "CIRP") and the Cybersecurity Incident Disclosure Control Procedure (the "Cyber Disclosure Procedure").