text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: The Audit Committee of the Board (the "Audit Committee") has been designated as the board committee with oversight responsibility of cybersecurity as delegated in the Audit Committee charter. The below summarizes the role and the frequency in which the Audit Committee oversees and monitors cybersecurity risks: • At least annually the Vice President of Technology presents compliance activities related to cybersecurity to the Audit Committee which includes those activities related to compliance with the cybersecurity disclosure regulations; • Any material breaches would be disclosed to the Audit Committee either in regularly scheduled meetings or in calls with the Chair of the Audit Committee if the communication is urgent; • Periodically, the Vice President of Information Technology provides updates to the Audit Committee on internal controls surrounding information technology (including cybersecurity); • The Chair of the Audit Committee provides regular updates during the Audit Committee meeting activities which includes cybersecurity; and • The Vice President of Information Technology presents updates on the cybersecurity program to the Company's Board annually.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: All cybersecurity events are communicated to the Corporate Controller and Internal Audit Vice President for disclosure considerations. Material and severe occurrences are escalated to the Chief Executive Officer and Chief Financial Officer for further review, discussion and remediation.

stage1Category: Risk Management Process

stage1Method: majority


text: The Vice President of Information Technology is responsible for managing overall cybersecurity and cyber risks, including infrastructure, development, and cybersecurity. The Vice President of Information Technology has extensive and progressive experience in supporting information technology risks and objectives in manufacturing companies equivalent to the Company and is a Certified Information Systems Security Professional from ISC2, a leading association for cybersecurity professionals. The Company's Vice President of Information Technology is required to have the following qualifications: • Asset Security; • Security Architecture and Engineering; • Communication and Network Security; • Identity and Access Management; • Security Assessment and Testing; • Security Operations; and • Software Development Security.

stage1Category: Management Role


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats by the Vice President of Information Technology. The Company's information technology landscape is not large or complex and it has a limited data footprint which allows the Vice President of Information Technology to be directly responsible and stay aware of all incidents. The Company has sufficient tools and processes in place to allow the Vice President of Information Technology to be effective as the central point person of monitoring and reporting incidents.


text: The Company continuously enhances policies and procedures, and controls to mitigate against the substantial rise in the prevalence of cybersecurity risks and challenges to protect its data.


text: Risk Management Strategy The Company's cybersecurity risk management function is led by the Vice President of Information Technology, who evaluates processes and activities within the Company's information technology infrastructure and automated systems. In 2023, the Company completed a detailed assessment to identify all technology and cyber tools currently in place and assessed its information technology personnel's cybersecurity capabilities and skill sets. In 2023, the Company focused on formalizing cybersecurity procedures and defining standards for risk identification and communication activities. The Company utilizes the National Institute of Standards and Technology guidance in all cybersecurity policies and procedures. Annual training for employees is required as well as ad hoc trainings for specific topics or events as deemed appropriate throughout the year. The Company also has cyber insurance to assist the Company both financially and operationally if a cyber event were to occur. Below is the basic framework used in the Company's risk management strategy: • Identify - set of procedures to identify assets to be protected, including computation, data, and integrity; • Protect - set of procedures to effectively engage and monitor adequate safeguards of critical infrastructure services; • Detect - set of activities, tools, and procedures to timely identify anomalies through continuous monitoring; • Respond - set of activities to effectively respond to and contain detected and confirmed cybersecurity events, and • Recover - set of activities and procedures to ensure any assets impaired because of a cybersecurity event are restored to use within the stated recovery point/time objectives.


text: The Company has taken steps to gain insights into how cybersecurity risk management functions have been integrated into its overall risk management systems and process. Below are the risk management activities regularly performed: • Cybersecurity, as described above; • Financial control risk assessment which is a formal part of the annual internal control program; • Management's risk assessment associated with the budgeting and strategic planning process; • A broader fraud risk assessment (also performed as part of the internal control program).


text: The Company's information technology and risk management function is highly centralized, with the Corporate Controller and Vice President of Information Technology involved in most of the risk related activities which provides a consistent input throughout risk management activities as well as aiding in identifying dependencies and duplications. The Company engaged a third party to conduct phishing and penetration tests in 2024. The Company continues to evolve its processes, procedures, and tools as a result of the observations from these tests.


text: The Vice President of Information Technology oversees the population of third-party service providers connected to any of the Company's networks. For each third-party service provider that would directly impact the Company's financial reporting, the Company obtains a System and Organization Controls (SOC) 1, Type 2 Report ("SOC 1 Report") to evaluate that service provider's internal controls and help the Company assess the risk of obtaining services from that services provider. The SOC-1 Report is reviewed by members of the Company's management and the Internal Audit group. The Company also limits access to information granted to any third-party service provider to only the information necessary for them to perform their services to the Company.

stage1Category: Third-Party Risk


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Governance and Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Audit Committee of the Board (the "Audit Committee") has been designated as the board committee with oversight responsibility of cybersecurity as delegated in the Audit Committee charter. The following summarizes the role and frequency in which the Audit Committee oversees and monitors cybersecurity risks: • At least annually the Vice President of Information Technology presents compliance activities related to cybersecurity to the Audit Committee which includes those activities related to compliance with the cybersecurity disclosure regulations; • Material breaches, if any are, disclosed to the Audit Committee either in regularly scheduled meetings or, if urgent in calls with the Chair of the Audit Committee; • Periodically, the Vice President of Information Technology provides updates to the Audit Committee on internal controls surrounding information technology (including cybersecurity); • The Chair of the Audit Committee provides regular updates during Audit Committee meetings which includes cybersecurity; and • The Vice President of Information Technology presents updates on the cybersecurity program to the Company's Board annually.


text: The Company's Vice President of Information Technology is the central contact point to receive (i) alerts regarding potential cybersecurity incidents and (ii) reports from the Company's Information Technology personnel regarding potential cybersecurity incidents. All confirmed cybersecurity events are communicated by the Vice President of Information Technology to the Corporate Controller and Vice President of Internal Audit. Material confirmed cybersecurity events are further escalated to the Chief Executive Officer and Chief Financial Officer for further review, discussion and remediation.


text: • Management of the Company's wholly-owned subsidiary, United Security Bank (Bank), reports to the Board of Directors, or an appropriate committee of the board, at least annually. This report describes the overall status of the information security program and the Bank's compliance with these guidelines. • The report discusses material matters related to the information security program, addressing issues such as: risk assessment; risk management and control decisions; service provider arrangements; results of testing; security breaches or violations and management's responses; and recommendations for changes in the information security program. • The intent of this report is to communicate the overall status of the information security program, including any updates to the program components. • In regard to cybersecurity threats and controls, the information security program addresses the Bank's cybersecurity strategy. • Cybersecurity is an element of information security. Information security deals with information, regardless of its format – paper documents, digital and intellectual property, and verbal or visual communications. • Cybersecurity focuses on protecting digital assets from intentional attacks. These assets include networks, computer hardware/software, and information that is processed, stored, or transported by networked systems and devices. • The Information Security Program was initially designed, and is regularly updated, to comply with the following laws and regulations:

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: The Gramm-Leach-Bliley Act (GLBA) regarding protection of nonpublic personal information, The Federal Financial Institutions Examination Council's "Interagency Guidelines Establishing Information Security Standards," Supplemental federal and state banking regulations and guidelines regarding protection of nonpublic customer information, as applicable to this program.


text: • Oversight of the Bank's cybersecurity program is the responsibility of the IT Committee of the Board of Directors. This committee is also responsible for approving the program's budget and staffing. Management of the program is the responsibility of the Bank's information security officer. • To ensure appropriate segregation of duties, the information security officer is independent of IT operations staff and reports to the Bank's chief risk officer. The information security officer is responsible for responding to security events by ordering emergency actions to protect the institution and its customers from imminent loss of information; managing the negative effects on the confidentiality, integrity, availability, or value of information; and minimizing the disruption or degradation of critical services. • The IT Committee of the Board of Directors meets bi-monthly, or as needed, to review risks resulting from cybersecurity threats. • Testing is conducted annually using external third-party penetration testing and internal vulnerability assessments.


text: In order to respond to the threat of security breaches and cyber-attacks, we have developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner.


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches. Preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner.


text: Risk Management and Strategy Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of such risks.


text: Cybersecurity risk management is integrated within our risk management framework. See "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader cybersecurity community and monitor cyber threat information.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader security community and monitor cyber threat information.


text: To address risks associated with third-parties, Prudential has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.


text: On February 13, 2024, as amended on February 21, 2024, the Company disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident. As of the date of this Report, the incident has not had a material impact on the Company's operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial condition or results of operations.


text: The Company's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that our employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. For a description of the relevant expertise of the CIO, see "Item 1. Business—Information About our Executive Officers."


text: The Audit Committee of the Board of Directors, which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, the Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential's annual external integrated audit.


text: The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.


text: Cybersecurity risk management is integrated within our risk management framework. See "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Risk Management" for additional information on our risk management processes. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: The Company's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that our employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. For a description of the relevant expertise of the HGTO, see "Item 1. Business—Information About our Executive Officers."


text: The Audit Committee of the Board of Directors, which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, the Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential's annual external integrated audit.


text: Risk Management and Strategy We have implemented a cybersecurity risk management program designed to identify, assess and manage material risks from cybersecurity threats based on relevant industry standards. The cybersecurity program is reviewed at least annually by the Audit and Finance Committee (as defined below) and organizational leaders, as well as whenever there is a material change in our business practices or a change in applicable law that may reasonably affect our response procedures. In addition, we regularly assess the design and operational effectiveness of the program's key processes and controls, including our preparedness to respond to cybersecurity incidents that may adversely affect the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Seagate Technology Holdings plc

ticker: STX


text: Cybersecurity risk management is an important part of our overall risk management efforts. We conduct mandatory cybersecurity awareness training for all employees, regardless of level or title, each year and provide additional training for designated roles, such as incident response personnel and senior management, on a case-by-case basis. We perform enterprise and site tabletop exercises annually to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall risk management program.


text: We periodically engage independent security firms and other third-party experts, where appropriate, to assess, test and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls. As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks, however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches and incidents, cyberattacks and other related matters.


text: In addition, we maintain a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on our assessment of their risk profile and periodic monitoring regarding adherence to applicable cybersecurity standards. We require our third-party service providers and suppliers to implement and maintain appropriate security measures commensurate with their risk profile and the scope of work being performed. We reassess third-party risk profiles periodically, request changes as we deem necessary based on that review, and require all third parties to promptly report any suspected breach of their security measures that may affect us.


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our security measures, however, we are unable to eliminate all cybersecurity threats. Accordingly, there can be no assurance that we have not experienced undetected security breaches or incidents, or that we will not experience a security breach or incident in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Finance Committee of the Board (the "Audit and Finance Committee") oversight of cybersecurity and other information technology risks, including our plans designed to mitigate cybersecurity risks and to respond to data breaches.


text: The Audit and Finance Committee receives regular reports (at least quarterly) from our Chief Information Security Officer ("CISO") and our Senior Vice President and Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including, as applicable, our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of any ongoing cybersecurity or other enterprise security risk management initiatives, incident reports and the results of internal and external assessments of our information systems. The Audit and Finance Committee also annually reviews the adequacy and effectiveness of our information and technology security processes and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities.


text: The Audit and Finance Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives a briefing from management on our cyber risk management program at least annually. Board members receive presentations on cybersecurity matters from our CISO and CIO, information security team or external experts as part of the Board's continuing education on topics that impact public companies.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Our CISO reports to our CIO who, in turn, reports directly to our CFO. Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our risk management team works with our digital & technology organization to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to form our Information Security Management System (ISMS), which is defined through policies and standards. Policies are applicable to all employees globally. These policies are reviewed periodically to ensure they remain relevant. For additional information regarding governance of our cybersecurity program, see the sections below entitled "Board Oversight of Cybersecurity Risks" and "Management's Role in Assessing and Managing Cybersecurity Risks." • Technical Safeguards: We deploy technical and procedural measures to protect our technology and data. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and remediation processes, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We provide annual cybersecurity training for all employees, as well as enhanced role-specific information security training for certain employees. In addition to this training, security awareness articles are disseminated periodically throughout the year. We also sponsor a "Cyber Security Awareness Month" in October each year and conduct regular phishing detection and response exercises. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber-incident and routinely evaluate the effectiveness of such plans. Incident response plans focus on cyber risk issues, including detection, response and recovery; cyber threats, with a focus on external communication and legal compliance; and breach simulations and penetration testing through internal and external exercises. Each year, we engage a third-party expert to oversee a cybersecurity incident response exercise to test pre-planned response actions from our incident response plan and to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics. • Third-Party Suppliers and Service Providers: We conduct periodic vendor security reviews and risk assessments for prospective and current third-party technical suppliers and service providers. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding procurement and to assess a vendor's overall security posture relative to a defined set of security criteria. • Certifications: Our security program is audited on an annual basis by several independent groups including an accredited certification body, leading accounting firms and institutional clients. • Experts: We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. Our collaboration with these third-parties includes periodic audits, threat assessments and consultation on security enhancements.


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, we do not believe that the risks from these threats have materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection" in this Annual Report.


text: Board Oversight of Cybersecurity Risks Our Board of Directors (Board) is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board delegates its oversight of cybersecurity risks to the Audit Committee; however, the Board reviews risks and mitigation plans through direct presentations and discussions with management as well as through receipt of committee chair reports at each regularly scheduled Board meeting.


text: The Audit Committee is responsible for evaluating and overseeing the management of risks related to information technology, which includes cybersecurity and data security risks. The Audit Committee receives quarterly reports from our Chief Information Security Officer (CISO) regarding cybersecurity and data security matters and related risk exposures. The Audit Committee Chair regularly updates the Board on such matters and the Board also periodically receives reports from management directly. Our Board escalation protocols require material cybersecurity incidents or data breaches to be reported to the Board on a real-time basis.


text: Management's Role in Assessing and Managing Cybersecurity Risks Our CISO is responsible for setting the strategy and communicating cybersecurity risks. Our CISO's team is also responsible for defining policies, standards, architecture and processes for cybersecurity globally. With over 28 years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO.


text: Our CISO, in conjunction with other digital & technology leaders, implement and oversee processes for the regular monitoring of our information systems. This includes escalation protocols to identify, assess and escalate cyber incidents. We also deploy security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our CISO is equipped with a defined incident response plan. Our CISO meets quarterly with our risk management team and provides quarterly reports to the Audit Committee.


text: Risks from Cybersecurity Threats We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not been material and have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the reputational, operational, legal or financial impacts that may result. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection" in this Annual Report.


text: Our CISO, in conjunction with other digital & technology leaders, implements and oversees processes for the regular monitoring of our information systems. This includes escalation protocols to identify, assess and escalate cyber incidents. We also deploy security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our CISO is equipped with a defined incident response plan. Our CISO meets quarterly with our risk management team and provides quarterly reports to the Audit Committee.


text: Risk Management and Strategy Infinera has comprehensive and integrated enterprise risk management and cybersecurity risk management programs which use structured, proactive, and continuous processes to identify, understand, assess, mitigate, and report on enterprise and cybersecurity risks in alignment with business objectives. Our risk management program is used to guide and strengthen our cybersecurity posture to engender trust with customers, employees, and stockholders while protecting the confidentiality, integrity, and availability of our systems and data.

companyName: Infinera Corp


text: We have established a risk assessment methodology which includes requirements for treatment plans, risk acceptance thresholds, prioritization, and control analysis, as well as likelihood and impact analysis. A risk assessment is performed annually. Treatment plans are monitored and reported to management on a quarterly basis.


text: Cybersecurity and risk management is a shared responsibility that applies to the Infinera team across all levels of the organization.

stage1Category: None/Other


text: • The Board of Directors conducts informed oversight of our risk management processes. The Audit Committee of the Board of Directors has primary responsibility for oversight of enterprise risk management and cybersecurity risk management. Reports on enterprise and cybersecurity risk, risk treatment plans, and key performance indicators of our cybersecurity program are provided to the Audit Committee by management, including our Chief Information Security Officer (CISO), on a quarterly basis and are provided to the Board of Directors as requested and as part of routine Audit Committee updates to the Board of Directors. • The Executive Leadership Team (ELT), a cross-functional leadership group that includes our Senior Vice President, Information Systems, is responsible for assessing and managing enterprise risks, including cybersecurity risks. The ELT reviews enterprise and cybersecurity risks, risk treatment plans, and key performance indicators regarding the Company's enterprise risk and cybersecurity risk management programs quarterly. • The CISO is responsible for cybersecurity strategy and reporting on cybersecurity risks to the ELT, Audit Committee, and Board of Directors. The CISO collaborates with a cross-functional group of the Company's business leaders to assess cybersecurity risk, establish and monitor cybersecurity processes, and report program effectiveness. Our CISO has over 25 years of cybersecurity and Information Technology experience across multiple industries with expertise in governance, risk and compliance, cybersecurity operations and cybersecurity engineering. • The Cybersecurity Advisory Committee supports cybersecurity risk assessment, advises on program enhancements, and acts as a cybersecurity advocate across the business. The committee is comprised of employees with extensive experience across a diverse range of disciplines. • All employees are responsible for adherence to the Company's cybersecurity processes and for remaining vigilant to potential cybersecurity threats. This employee commitment to operational excellence is strengthened by ongoing cybersecurity education, training, and awareness programs.


text: Engaging Third Parties Companies, especially in the technology industry, have been subject to an increasing number of complex cybersecurity risks. Infinera has engaged with a range of external service providers, including consultants, auditors, and cybersecurity service providers, to understand, manage, and mitigate cybersecurity risks. These engagements help Infinera drive improvements in our processes, identify new and emerging threats, and respond rapidly to the ever-evolving cybersecurity risk landscape.


text: Third-Party Risk Management Infinera has implemented a robust third-party risk management program to identify and manage risks to the confidentiality, availability, and integrity of our systems and data. This includes contractual requirements related to data privacy and confidentiality, contractual commitments of third parties to maintain comprehensive security programs, and code of conduct requirements designed to ensure such third parties act ethically, responsibly, and safely. Infinera has also implemented processes to assess the effectiveness of third-party security programs and adherence to Infinera's standards both prior to engaging with a new service provider and to monitor performance on an ongoing basis.


text: Cybersecurity Incident Response Infinera has implemented a cybersecurity incident response plan in line with industry standards. The plan defines roles and responsibilities regarding potential cybersecurity incidents, establishes processes regarding identification, containment, eradication, and recovery from potential cybersecurity incidents and clarifies communication and notification policies regarding such potential cybersecurity incidents. The plan also captures lessons learned to drive continuous improvement. Additionally, the plan is evaluated, tested, and enhanced through training, table-top exercises, and by engaging with third-party service providers.


text: Infinera has not experienced a material cybersecurity incident. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to the section titled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Infinera has comprehensive and integrated enterprise risk management and cybersecurity risk management programs that use structured, proactive, and continuous processes to identify, understand, assess, mitigate, and report on enterprise and cybersecurity risks in alignment with business objectives. Our risk management program is used to guide and strengthen our cybersecurity posture to engender trust with customers, employees, and stockholders and to help protect the confidentiality, integrity, and availability of our systems and data.


text: We have established a risk assessment methodology that includes requirements for treatment plans, risk acceptance thresholds, prioritization, and control analysis, as well as likelihood and impact analysis. A risk assessment is performed annually. Treatment plans are monitored and reported to management on a quarterly basis. Cybersecurity and risk management are shared responsibilities that apply to the Infinera team across all levels of the organization.


text: • The Board of Directors conducts informed oversight of our risk management processes. The Audit Committee of the Board of Directors has primary responsibility for oversight of enterprise risk management and cybersecurity risk management. Reports on enterprise and cybersecurity risk, risk treatment plans, and key performance indicators of our cybersecurity program are provided to the Audit Committee by management, including our Chief Information Security Officer (CISO), on a quarterly basis and are provided to the Board of Directors as requested and as part of routine Audit Committee updates to the Board of Directors. • The Executive Leadership Team (ELT), a cross-functional leadership group that includes our Senior Vice President, Information Systems, is responsible for assessing and managing enterprise risks, including cybersecurity risks. The ELT reviews enterprise and cybersecurity risks, risk treatment plans, and key performance indicators regarding the Company's enterprise risk and cybersecurity risk management programs quarterly. • The CISO is responsible for cybersecurity strategy and reporting on cybersecurity risks to the ELT, Audit Committee, and Board of Directors. The CISO collaborates with a cross-functional group of the Company's business leaders to assess cybersecurity risk, establish and monitor cybersecurity processes, and report program effectiveness. Our CISO has over 25 years of cybersecurity and information technology experience across multiple industries with expertise in governance, risk and compliance, cybersecurity operations and cybersecurity engineering. • The Cybersecurity Advisory Committee supports cybersecurity risk assessment, advises on program enhancements, and acts as a cybersecurity advocate across the business. The committee is comprised of employees with extensive experience across a diverse range of disciplines. • All employees are responsible for adherence to the Company's cybersecurity processes and for remaining vigilant to potential cybersecurity threats. This responsibility is part of our employee commitment to operational excellence and is strengthened by ongoing cybersecurity education, training, and awareness programs.


text: Engaging Third Parties Companies, especially in the technology industry, have been subject to an increasing number of complex cybersecurity risks. Infinera has engaged with a range of external service providers, including consultants, auditors, and cybersecurity service providers, to help Infinera understand, manage, and mitigate cybersecurity risks. These engagements help Infinera drive improvements in its processes, identify new and emerging threats, and respond rapidly to the ever-evolving cybersecurity risk landscape.


text: Third-Party Risk Management Infinera has implemented a robust third-party risk management program to identify and manage risks to the confidentiality, availability, and integrity of its systems and data. This includes contractual requirements related to data privacy and confidentiality, contractual commitments of third parties to maintain comprehensive security programs, and code of conduct requirements designed to ensure such third parties act ethically, responsibly, and safely. Infinera has also implemented processes to assess the effectiveness of third-party security programs and adherence to Infinera's standards prior to engaging with a new service provider and to monitor performance on an ongoing basis.


text: Cybersecurity Incident Response Infinera has implemented a cybersecurity incident response plan in line with industry standards. The plan defines roles and responsibilities regarding potential cybersecurity incidents, establishes processes regarding identification, containment, and eradication of, and recovery from, potential cybersecurity incidents and clarifies communication and notification policies regarding such potential cybersecurity incidents. The plan also captures lessons learned to drive continuous improvement. The plan is evaluated, tested, and enhanced through training, table-top exercises, and by engaging with third-party service providers.


text: As of the date of this report, Infinera has not experienced any cybersecurity incidents it has determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to the section titled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: If our efforts to maintain information security, cybersecurity, and data privacy are unsuccessful or if we are unable to meet increasingly demanding regulatory requirements, our reputation, results of operations, and financial condition could be adversely affected.

companyName: GROOVY COMPANY, INC.


text: The Company regularly receives and stores information about our customers, partners, vendors, and other third parties through our GROOVY 2.0 blockchain authentication platform. We rely extensively on complex information systems throughout our business, particularly our Hyperledger Fabric blockchain infrastructure, ERC-1155 token implementation, and proprietary RAG LLM analytics systems. We have implemented programs to detect, contain, and respond to information security, cybersecurity, and data privacy incidents. However, we may be unable to anticipate security incidents or implement adequate preventive measures as cyber threats continue to evolve and cyberattacks become more sophisticated and frequent, including through the introduction of viruses and malware (such as ransomware) and the use of artificial intelligence by threat actors.


text: The specialized nature of our blockchain-based authentication system introduces unique security challenges. In addition, hardware or software that we develop or obtain from third parties may contain defects that could compromise information security, cybersecurity, or data privacy. Unauthorized parties may attempt to gain access to our information systems or facilities, or those of third parties with whom we do business, through fraud, deception, social engineering, or other bad acts. Errors or malicious actions by our team members or contractors, faulty password management, smart contract vulnerabilities, and other irregularities could also overcome our security measures or those of third parties with whom we do business and result in a compromise or breach of our or their information systems. Furthermore, the training we conduct as part of our information security, cybersecurity, and data privacy efforts may not be effective in preventing or limiting successful attacks.


text: While we have not experienced significant information security, cybersecurity, or data privacy incidents to date, we operate in an industry with high-value data related to cannabis products, strain genetics, and consumer preferences. If we, our vendors, or other third parties with whom we do business experience significant information security, cybersecurity, or data privacy incidents or fail to detect and appropriately respond to significant incidents, our business operations could be severely disrupted and we could be exposed to costly government enforcement actions and private litigation. In addition, our customers could lose confidence in our ability to protect their information, stop using our authentication services or participating in our rewards programs, or cease doing business with us altogether. Any of these outcomes could adversely affect our reputation, results of operations, and financial condition.


text: The legal and regulatory environment regarding information security, cybersecurity, and data privacy is dynamic and has strict requirements, including for the use and treatment of personal data, particularly in the cannabis industry where regulatory scrutiny is heightened. Complying with current or contemplated information security, cybersecurity, data protection, and data processing laws and regulations (including reporting and disclosure regimes), or any failure to comply, could cause us to incur substantial costs, require changes to our business practices, and expose us to litigation and regulatory risks, each of which could adversely affect our reputation, results of operations, and financial condition. Additionally, as our business model centers on data analytics derived from authentication activities, any limitations on our ability to collect, analyze, or monetize this data could significantly impact our revenue potential and growth trajectory.


text: The Company has very limited operations, consisting primarily of compliance activities as a public company and minimal real estate rental revenue. The Company has no employees, does not maintain its own bank accounts, and its activities are managed by the Chief Executive Officer with the assistance of outside legal and accounting professionals. The Company does not maintain significant information technology systems, customer data, or proprietary digital assets.

companyName: CANNABIS SUISSE CORP.

ticker: CSUI


text: Given the limited nature of its operations and reliance on third-party service providers for professional services, the Company has concluded that it is not materially exposed to cybersecurity threats. To date, the Company has not experienced, nor does it anticipate, any cybersecurity incidents that would materially affect its business, financial condition, or results of operations.


text: The Board of Directors is responsible for oversight of the Company's cybersecurity risk. In fulfilling this role, the Board receives updates from the Chief Executive Officer, who, with the assistance of external legal and accounting professionals, monitors any potential cybersecurity matters and reports to the Board as necessary.


text: Risk Management and Strategy We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated with our overall risk assessment process and has been embedded in our operating procedures, internal controls and information systems.

companyName: CHARLES & COLVARD LTD


text: Our company is exposed to a variety of evolving cybersecurity risks. We invest in our cybersecurity program to proactively manage and mitigate these risks. On an annual basis, we utilize our Enterprise Risk Management ("ERM") program to estimate our annual loss potential based on our defined control framework and its overall effectiveness. In conjunction with our ERM program, the cybersecurity program references the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF) to guide our organization's risk identification and mitigation procedures. In addition, we undergo an annual third-party external penetration test, as well as third-party attack-surface monitoring to understand our potential vulnerabilities, threat vectors, and additional impacts to critical assets and operations. In addition, our cybersecurity team performs procedures to identify risks that inform our annual security roadmap.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: We engage third-party cybersecurity experts to provide independent assessments of our cybersecurity readiness and control effectiveness. Our goal in collaborating with external cybersecurity firms is to gain insights and knowledge into emerging threats and vulnerabilities, industry trends and best practices to inform our risk remediation efforts. Additionally, we engage with our externally retained incident response team and select internal teams to perform tabletop exercises that inform our cybersecurity response capabilities and resilience.


text: We also enact a process to perform a risk assessment of new third-parties, inclusive of new third-party contracts, which provides an additional layer of oversight in identifying material risks associated with the use of particular external service providers.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition, but we cannot provide assurance that such risks or future material incidents will not materially affect us in the future. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.


text: Our management plays a pivotal role in assessing and managing material risks from cybersecurity threats. Our management has implemented a broad and continuous process for cyber event monitoring, analysis of emerging threats, and the development and implementation of risk mitigation strategies. Led by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), we implement cybersecurity policies, procedures and strategies, including employee training programs, security assessments and attack detection alerts designed to address the constantly evolving threat landscape. Our CTO has over 20 years of technology experience, including roles at Amazon Web Services, Dell EMC, and Ball Aerospace. Our CISO has over 30 years of cybersecurity and IT leadership experience.


text: At the Board of Directors level, our Audit Committee oversees our risks related to information security and privacy. To accomplish this responsibility, the Audit Committee meets quarterly with our CTO and CISO to receive and discuss updates on our cybersecurity program. Top risks, key initiatives, material cyber incidents, remediation activity and security metrics are shared to report the overall loss potential, program effectiveness, risk management conditions and current threat landscape. Our Board of Directors is committed to maintaining a well-informed and security-aware business by regularly engaging through updates on the organization's roadmap and evolving threat landscape.


text: Risk Management and Strategy The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats in order to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the information residing therein. We have implemented several cybersecurity processes to aid in our efforts to assess, identify, and manage such material risks.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Our risk management program considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. We believe that integrating our cybersecurity risk management into our broader risk management framework promotes a company-wide culture of cybersecurity risk management and ensures that cybersecurity considerations are an integral part of decision-making at every level.


text: We employ a wide range of tools, policies, and services, including but not limited to penetration testing, network and endpoint monitoring, vulnerability assessments, information segregation, and tabletop exercises to inform our risk identification and assessment. We routinely review and upgrade our information technology and cybersecurity systems in order to better manage, report, and protect the information related to our formulas and processes, research and development, trade secrets, products, customers and suppliers, employees, and other sensitive information. We also have a cybersecurity specific risk assessment process that helps us identify our cybersecurity threat risks and maturity level by comparing our processes to standards set by the International Organization for Standardization.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we:


text: Through policy and practice, classify information, restrict access, and require employees to treat sensitive data with care; and Conduct an annual employee training program, including regular phishing email simulations for all employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages third-party experts, including assessors, auditors, and consultants, in evaluating and testing our risk management systems. Such engagements include: managed security services, regular audits, penetration testing, threat assessments, and consultation on security enhancements. The Company has processes in place to oversee and manage its use of third-party vendors. We conduct security assessments of third-party vendors engaged, limit the information systems of the Company available to the third party, and maintain monitoring to ensure compliance with our cybersecurity standards.


text: From time to time, we experience cybersecurity incidents and threats to our systems and information. Through the date hereof, no risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, and we do not believe are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity threats rapidly evolve and are complex, so we must continually adapt and enhance our processes. As we do this, we must make judgments about where and how to invest resources to most effectively protect ourselves from threats. These are inherently challenging processes, and we can provide no assurance that the processes that we implement will be effective. For more information regarding cybersecurity risks that could impact the Company, see our risk factor Governance


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our entire Board is responsible for the oversight of risks from cybersecurity threats. At least twice annually, the entire Board receives an overview from management of our cybersecurity progress and effectiveness, covering topics such as current cybersecurity landscape and emerging threats, data security posture, results from third-party assessments, status of ongoing initiatives and strategies, and material cybersecurity threat risks or, if any, incidents and developments. In these sessions, the Board receives materials and discusses such matters with our Chief Information Officer. The Board also receives annual training on cybersecurity. In addition, we have formed an executive level steering committee (including the CEO, CFO, Group Presidents, General Counsel, VP, Human Resources, Controller/Chief Accounting Officer, and Chief Information Officer) that provides oversight and routinely discusses cybersecurity matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, our Director of Information Security, and our Director of Infrastructure. These individuals collectively have over 85 years of prior work experience in various roles in the information security field, including managing and implementing effective information technology and cybersecurity programs, as well as relevant degrees and certifications, including a Certified Information Systems Security Professional certification. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Information Officer reports to the entire Board about cybersecurity threat risks, among other cybersecurity matters, at least twice annually or more frequently as circumstances may require.


text: Cybersecurity Risk Management and Strategy We maintain an enterprise-wide approach to risk management through which we identify, manage and mitigate significant risks, including those related to our information systems. Our cybersecurity risk management program, which applies to our global operations, focuses on our people, processes and technology, and is designed to secure our information systems by preventing, detecting and responding to current and emerging cybersecurity threats.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: Our employees are a key element of our cybersecurity risk management program. All of our employees are required to adhere to our cybersecurity practices, and undertake routine training to raise awareness and reinforce safe practices. Our training program includes bi-annual online training courses, group tabletop exercises, phishing and malicious email simulations, and information security bulletins. We also maintain policies that govern, and provide specific guidance to employees regarding how they may use our information systems.


text: Another key element of our cybersecurity risk management program is our use of processes and technologies to create information security safeguards and controls, and target specific users or business needs. Our processes and technologies include firewalls, email security software and encryption, endpoint detection and response, access controls, backup and recovery procedures, system patches and updates, vulnerability scanning, penetration testing by third party vendors, incident response procedures, and internal and external audits of our information systems.


text: Through these internal and external assessments, we continuously identify areas for remediation and opportunities to improve the security of our information systems, including by evaluating our program against industry standards and best practices, such as the Cybersecurity Framework established by the National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls established by the Center for Internet Security. We also track key performance indicators that we believe are indicative of the effectiveness of our cybersecurity risk management program.


text: For additional information related to cybersecurity risks that could have a material and adverse effect on our business, financial condition or results of operations, see "Our operations could be adversely affected by interruptions or breaches in the security of our computer and information systems" in Item 1A of this Report.


text: Cybersecurity Governance The Audit Committee of our Board of Directors oversees the adequacy and effectiveness of our internal controls, policies and procedures regarding cybersecurity, information security and data protection, and compliance with applicable laws and regulations concerning privacy. Our Chief Information Officer ("CIO"), in turn, is responsible for managing the Company's cybersecurity risk management program and incident response procedures. On a quarterly basis, and more frequently as circumstances warrant, our CIO briefs the Audit Committee on our cybersecurity risks, our strategies for preventing, detecting, responding to and mitigating such risks, including the effectiveness of our incident response procedures, and our information security controls. Our CIO has extensive knowledge and expertise regarding our information systems and security, having served in a variety of senior information technology positions across our organization for more than thirty years, and as an executive officer of the Company since 2006.


text: Additionally, our CIO leads an incident response team ("IRT"), charged with the on-going management of our cybersecurity program. This team is responsible for the prevention, mitigation, detection and remediation of cybersecurity risks and incidents affecting our operations pursuant to our incident response procedures. The IRT is composed of information security professionals, who collectively bring decades of relevant information security and cybersecurity experience to their roles.


text: In the event that a cybersecurity incident is detected, the IRT performs a multi-factor, risk-based assessment to determine the appropriate level of response. Depending upon the results of the assessment, including the nature and magnitude of the event, our incident response procedures provide for oversight and management of an incident by the IRT, under the direction of the CIO, or, in the event of escalation, under the direction of the executive officers of the Company, with reporting to and oversight by the Audit Committee.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, which we refer to as Information Systems and Data.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Our information security function, which is led by our Chief Information Officer, or CIO, helps identify, assess and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information security policy, access management procedures, data back-up and restoration policy, cyberattack response procedure, network security controls, data segregation for certain data, encryption of certain data, access controls, physical controls, systems monitoring, penetration testing, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services.


text: A comprehensive and layered auditing approach including people, processes and technology components is executed by our internal audit program in order to evaluate the effectiveness of existing controls and ensure that cybersecurity risk has been adequately mitigated within our institution. Periodic phishing tests, network and application security reviews, third-party vulnerability assessments and penetration testing are used to gauge the overall effectiveness of our cybersecurity defenses.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations and actions litigation fines and penalties disruptions to our business operations reputational harm loss of revenue and profits loss of customers and sales and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit and compliance committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our CIO, who has over 15 years of experience in IT management. Our CIO reports directly to our leadership team and provides regular reports.


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer. Our Chief Executive Officer and other leadership personnel work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and compliance committee of the board of directors, as appropriate.


text: The board of directors' audit and compliance committee receives periodic reports from our CIO concerning significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and compliance committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As referenced in the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K, our organization may be materially affected by cybersecurity threats and incidents that target its internally managed information technology systems or our critical vendor systems.


text: Our institution utilizes industry standard and regulatory approved assessment tools to identify cybersecurity risks and measure preparedness. The tools provide a repeatable and measurable framework for our organization to measure its cybersecurity preparedness over time.


text: The assessment process spans over five domains of interest: (1) cyber risk management and oversight, (2) threat intelligence and collaboration, (3) cybersecurity controls, (4) external dependencies, and (5) cyber incident management and resilience. All domains are currently assessed at an evolving maturity level which is in line with our organizations inherent risk assessment score.


text: Our institution has purchased and is using best of breed tools in the areas of endpoint security, Security Information Event Management ("SIEM"), Privileged Access Management ("PAM"), email and web browsing filtering and management, and user analytics. We also use a comprehensive third party 24-by-7 Security Operations Center ("SOC") that monitors, detects, and remediates cybersecurity threats adhering to strict service response levels.


text: The internal assessment process and internal tools and SOC related key indicators are reported on a quarterly basis to the Security and Information Security Committee and the Enterprise-wide Risk Management Committee and annually to the Board of Directors.


text: The assessment process, internal tools, and corresponding SOC related services are also reviewed when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management shall determine whether additional risk management practices or controls are needed to maintain or augment the institution's cybersecurity maturity.


text: In an effort to continually share threat intelligence and increase awareness of cybersecurity threats, routine communication to employees is conducted to highlight internal control requirements, common cybersecurity threats and schemes. Our incident response team members also participate in the annual Financial Services Information Sharing and Analysis Center tabletop cybersecurity tabletop exercises.


text: Our comprehensive vendor management program and processes assess all new vendors and segments them into criticality tiers. Our most critical vendors (tiers 1 and 2) are evaluated annually based on requested vendor documents, such as Statements on Standards Attestation Engagements No. 18 (SSAE 18), financial statements, insurance, and due diligence questionnaires. The vendor management team also monitors all news alerts related to all critical vendors.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect CTBI. However, future incidents could have a material impact on CTBI's business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K.


text: Management receives information on cyber activities, incidents, and risk assessments quarterly from the VP/Corporate Information Security, Resilience and Data Officer (CISRDO), the SVP/Manager Application Systems, and the EVP/Operations during the Security and Information Security Committee and the Information Technology Steering Committee meetings. This information is also shared and discussed quarterly with the Enterprise-wide Risk Management Committee. Various key risk measures related to cyber risk are tracked and reported quarterly to the Enterprise-wide Risk Management Committee. Our VP/CISRDO has been with CTBI for five years and has extensive 30+ years of experience in information technology management roles in various industries. Our SVP/Manager Application Systems has been with CTBI for 32 years and has held various information technology leadership roles. Our EVP/Operations has been with the company for 30 years, leading and guiding our technology teams.


text: The Board of Directors monitors cyber risk through quarterly reports from the Board's Risk and Compliance Committee. This Board committee meets quarterly and receives information concerning cyber risk activities, including cyber risk assessments and incident reporting. The Board also receives an annual report covering cyber risk from the Chief Information Technology Officer. Controls over cyber risk are reviewed throughout the year by internal audit activities and third-party assessments whose reports are reviewed by the Board's Audit Committee.


text: We rely on our technology infrastructure and information systems for our internal communications, controls, reporting and relations with customers and suppliers, to utilize our data, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. In response to the increasing threats presented by cyber incidents, in 2023 we established a Cybersecurity Steering Committee, which meets bimonthly. This committee is comprised of our Chief Information Officer, Head of IT and Security Leader, along with our Deputy General Counsel who reports to our General Counsel. The Cybersecurity Steering Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Steering Committee develops and implements cybersecurity risk mitigation strategies and activities, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, ensures policies and procedures are current and followed, and receives regular updates on cybersecurity-related matters.


text: Our Board of Directors oversees our enterprise risk management process and our Audit Committee of the Board has direct oversight of our management of cybersecurity risks. Under the direction and supervision of our Chief Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks. Our Cybersecurity Steering Committee reviews the results of any enterprise risk assessment with management on a bimonthly basis and with the Board of Directors quarterly or when risks are identified. Management provides a comprehensive update to the Audit Committee of the Board on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.


text: Our Chief Information Officer, reporting to our Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the activities and systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our Chief Information Security Officer reports to our Security Leader and has over 25 years of IT, cybersecurity, data security and regulatory compliance experience. Our Security Leader reports to our Chief Information Officer, and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Security Leader has 20 years of IT experience.


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Critical Security Controls to continually evaluate and enhance our cybersecurity. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout our organization. These cybersecurity drills are performed both in-house and by a third-party service provider. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. Our Cybersecurity Steering Committee also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Steering Committee escalates events, including to the Chief Financial Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: If we were to experience a cybersecurity incident, our Security Leader would inform the Cybersecurity Steering Committee, which would then evaluate and assess the materiality of the incident to the Company and the impact of the incident on the Company's information technology infrastructure and data integrity, and determine whether the incident should be reported to the Audit Committee of the Board in advance of the next regular cybersecurity update. The Cybersecurity Steering Committee, with the assistance and input of the Audit Committee of the Board, has established a set of predefined criteria that it uses to make such determinations. Once a cybersecurity incident has been reported to the Audit Committee of the Board, the Audit Committee of the Board, with the input of the Cybersecurity Steering Committee, will determine how to address it.


text: We engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Steering Committee oversees and establishes the parameters of our engagement with these experts to ensure we obtain supplement assistance needed in this area, if any.


text: If we were to experience a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems which allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information, belonging to us or to our employees, providers, suppliers, customers or insurance companies could result in our suffering significant financial and reputational damage. Though we take steps to ensure our products and software are secure, a cyber-attack could result in the loss or compromise of our or our employees', suppliers' and customers' critical data. If a supplier or customer alleges that a cyber-attack causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and incur regulatory repercussions. See Item 1A "Risk Factors – Security and privacy breaches may expose us to liability and cause us to lose customers". A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs when responding to such events.


text: Creating and maintaining a secure information infrastructure is of paramount importance to Quantum-Si, and we have invested, and will continue to invest significant resources to ensure we maintain the most secure environment reasonably possible to protect our assets, customers and employees. Our Board of Directors, through our Audit Committee, is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, ("NIST") and other applicable industry standards. We address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we maintain by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quantum-Si Inc

ticker: QSI


text: We plan for our Chief Financial Officer to provide our Audit Committee with quarterly general risk assessment updates, which shall cover cyber risk topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee is also involved in the reporting function of our incident response plan which includes communication of any cybersecurity incident that meets our reporting thresholds, as well as ongoing updates regarding any such incident, until such incident has been resolved.


text: Risk Management and Strategy We face a variety of risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We employ a range of tools and services, including regular network and endpoint monitoring utilizing leading market monitoring tools, audits and vulnerability assessments including penetration testing to inform our risk identification and assessment. Our Audit Committee of the Board of Directors provides oversight of our cybersecurity risk management and strategy processes, which is led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST as well as by engaging experts to attempt to penetrate our information systems. To provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;


text: leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties in assisting in review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If we experience a significant disruption in our information technology systems, including our Platinum Analysis Software services, or cybersecurity incidents, our business could be adversely affected", which disclosures are incorporated by reference herein.


text: Despite our efforts to create security barriers to such threats, it is virtually impossible for us to completely mitigate these risks. In August 2020, we discovered ransomware on a server and engaged third-party forensics experts and outside counsel for incident response. We did not pay ransom to the attacker because the documents that were encrypted by the attacker were sufficiently backed up and the investigation further confirmed that no employee data or other personal information was accessed. We implemented a number of security enhancements as the incident unfolded and continue to implement short- and long-term security enhancements to further secure our network.

stage1Category: Incident Disclosure


text: Cybersecurity Governance; Management Cybersecurity is an important part of our broader risk management processes and an area of focus for our Board of Directors and management. In general, o ur Board of Directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and o ur Board of Directors has authorized our Audit Committee to oversee risks from cybersecurity threats.


text: We continually strengthen our cybersecurity defenses through significant investments in resources and maintaining comprehensive cybersecurity insurance coverage. We maintain an insider threat detection program to proactively identify and mitigate both external and internal threats in a timely manner.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in conjunction with our General Counsel and our Head of Information Technology and report to our Audit Committee. In addition, we maintain an Information Technology Steering Committee, which is comprised of several senior members of the Company. Our Chief Financial Officer has over 10 years of experience in leading Information Technology departments at various companies. Our General Counsel has over 10 years of experience related to general legal matters, including in the capacity of understanding and guiding companies on Information Technology matters and the related risks. Our Head of Information Technology has over 30 years of relevant experience, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.


text: These management team members are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: RISK MANAGEMENT AND STRATEGY The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our patients' health information and all our data.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH