text: Specifically, our information security program, which is led by our Director, establishes and maintains our corporate-wide cybersecurity program and provides guidance and direction for information security activities and controls at Diodes. Through our cybersecurity program, we monitor the environment for incidents, classify the activity, and escalate incidents according to Company procedures. Incidents classified to a level that may significantly impact the Company are escalated to management for monitoring and action if necessary. The Company also maintains an appropriate system of hygiene for internal and external systems through accepted information technology practices such as patching, security monitoring, capacity management, availability monitoring, and third-party vulnerability scanning.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.

companyName: Chemours Co

ticker: CC

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. In particular, the Company has established a cybersecurity incident response plan includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the VP of IT, Director, and President. The Company regularly conducts vulnerability assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: DIODES INC /DEL/

ticker: DIOD


text: To minimize our risk and exposure to material cybersecurity incidents, we also conduct company-wide annual and ongoing cybersecurity awareness training and education of our employees. This includes but not limited to topics such password hygiene, phishing, and other cybersecurity-related information. In addition to performing an annual risk assessment and developing a detection and mitigation plan, along with a comprehensive review and update of our cybersecurity and data privacy policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. Our comprehensive information security program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. To supplement our cybersecurity and data privacy risk assessment, identification, management, and mitigation efforts, we regularly consult with third-party experts, which include the following services: • conduct annual cybersecurity and data privacy risk assessments; • conduct external and internal penetration tests; • monitor critical infrastructure for abnormal behavior; and • provide validation of the Company's cybersecurity and operations processes against the National Institute of Standards and Technology cybersecurity framework.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-State actors, and other malicious internet-based activity, continue to increase. Cybersecurity threats may also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees, and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data.

stage1Category: None/Other

stage1Method: majority


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated, and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring, and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, to date, management has determined that none of the cybersecurity attacks the Company experienced have resulted in a material impact to its financial condition, results of operations, or business strategy. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations, or our financial conditions, like all technology companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "System security risks, data protection breaches, cyber-attacks and other related cybersecurity issues could disrupt our internal operations, and any such disruption could reduce our expected net sales, increase our expenses, damage our reputation, and adversely affect our stock price," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

stage1Category: Strategy Integration


text: Risk management and strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: NETGEAR, INC.

ticker: NTGR


text: Our cybersecurity functions include representatives from information technology, engineering, information security, legal, impacted business units or products and other departments as applicable (together, the "Cybersecurity Team") helps identify, assess and manage the Company's cybersecurity threats and risks. The Cybersecurity Team is responsible for identifying, assessing and managing cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools such as vulnerability scans, penetration tests and a public bug bounty program; subscribing to reports and services that identify cybersecurity threats; conducting risk assessments and internal and external audits; using external intelligence feeds; and conducting tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: (1) having an information security incident response plan for incident detection and response; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls intended to address certain recognized industry cyber frameworks; (5) encrypting and segregating data, having network security controls, access controls and physical security, monitoring systems, managing assets (tracking and disposal) and conducting penetration testing; and (6) maintaining cybersecurity insurance.


text: We contract with external firms to assess our cyber security controls relative to our peers using the NIST CSF. We also have a third-party risk management program that assesses risks from vendors and suppliers. In addition, we maintain a Business Continuity and Disaster Recovery Plan as well as a cybersecurity insurance policy.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) our Cybersecurity Team works with our management team in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Cybersecurity Team and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity committee chairperson of the board of directors who may then notify the cybersecurity committee and board of directors (as appropriate), to further evaluate our overall enterprise risk.


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. For example, these service providers include professional services firms, threat intelligence service providers, managed cybersecurity service providers, penetration testing firms and forensic investigators. We also have a public bug bounty program.


text: We use third-party service providers to perform a variety of functions throughout our business, such as using application providers for core applications (including finance, HR, CRM, email services, collaboration tools etc.), hosting companies for our websites, contract manufacturing organizations, distributors and supply chain resources for software, hardware, manufacturing and distribution of our products. We have a vendor management process designed to manage cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Product security vulnerabilities, system security risks, data protection breaches, cyber-attacks, improper use of artificial intelligence ("AI") tools, and other threats and risks, could disrupt or otherwise compromise our products, services, internal operations or information technology systems, or those of third parties with whom we work. Actual or perceived non-compliance with our privacy and security obligations could lead to regulatory investigations or actions, litigation, fines and penalties, business operation disruption, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse business consequences.".


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' cybersecurity committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer, our VP of Corporate Cybersecurity and our Chief Technology Officer of Software, each of whom have over 20 years of industry expertise, including past roles at other public companies and as consultants.


text: Our Chief Information Officer and Chief Technology Officer of Software are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Information Officer and Chief Technology Officer of Software are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our information security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the incident response leadership team. The incident response leadership team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's information security incident response plan includes reporting to the cybersecurity committee chairperson of the board of directors for certain cybersecurity incidents and, if appropriate, the cybersecurity committee and the board of directors.


text: The cybersecurity committee receives periodic notices (written and verbal) from the Cybersecurity Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The cybersecurity committee also receives quarterly reports, summaries or presentations related to the Company's cybersecurity program as it relates to both our corporate systems and products.

stage1Category: Board Governance


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Our cybersecurity program is aligned with notable control frameworks such as the NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) 27001.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: We maintain a global cybersecurity incident response plan and related playbooks, for execution by the SOC team and CSIRT, in coordination with internal and external stakeholders, as applicable. Significant incidents are escalated to a cross-departmental team to assess materiality based on qualitative and quantitative factors. This team consists of executives representing core business functions, including, among others, information technology, legal, finance, accounting, data protection and business divisions, in consultation with third-party advisors, as applicable. We undertake periodic leadership tabletop exercises and periodic adversarial ("red team") exercises simulating incident response under common risk scenarios. As an acquisitive organization, we have also established a program to increase our visibility into the cybersecurity environment of acquisition targets prior to closing.


text: We have established a dedicated vendor assessment team, which employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or that otherwise implicates the third-party technology and systems we use. We also require cybersecurity insurance coverage for vendors whose services or products may present a cybersecurity risk.


text: We continuously test and assess our cybersecurity posture, including through annual third-party risk assessments performed by reputable assessors, consultants and auditors. A global FAIR (Factor Analysis of Information Risk) assessment is conducted at least annually to update our cybersecurity risks and corresponding mitigations.


text: Our employees complete training on data security and our policies when they join us and annually thereafter. We review the content of our mandatory training annually, and provide access to a comprehensive set of supplemental training.


text: Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company's enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.

stage1Category: Management Role


text: Our CIO has more than 30 years of experience, including from his prior business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company. Our CISO has more than 20 years of cybersecurity experience. Prior to joining us, he was Senior Vice President, Chief Information Security Officer at Brighthouse Financial. Before then, he served as Technology Vice President & Chief Information Security Officer for GE Healthcare. He started his career at Allstate Insurance Company. He also holds security, privacy and risk certifications, including Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional.


text: We, including our third-party vendors, have experienced cybersecurity incidents and threats and may continue to experience them in the future. Based on the information available as of the date of this Annual Report on Form 10-K, we believe that during the last three fiscal years risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Due to evolving cybersecurity threats, we may not be able to protect all information systems and, as an acquisitive organization, integrating information systems as we acquire new businesses may expose us to unexpected liabilities or increase our vulnerability. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.


text: Cyber Risk Management and Strategy The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. We are also structured to CMMC which aligns with DOD/Federal contractor program compliance. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: PARSONS CORP

ticker: PSN


text: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations. As part of our cyber incident response process, we also engage third-party experts as needed, such as external legal advisors and cybersecurity forensic firms.


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization. • IT and Cybersecurity reports to the Chief Administrative and Information Officer (CAIO) who provides updates to the dedicated committee.


text: Regulatory Compliance We remain committed to complying with all relevant cybersecurity regulations and standards applicable to our industry. Our governance structure is designed to adapt to evolving regulatory requirements and industry best practices.


text: While we believe our current measures are robust, we recognize the dynamic nature of cyber threats and continually refine our approach to remain vigilant and responsive.


text: This disclosure provides stakeholders with a comprehensive overview of the organization's cyber risk management, strategy and governance practices, demonstrating a commitment towards proactive cybersecurity measures and compliance.


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under Risks Relating to Our Business in Item1(a) Risk Factors.


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting our information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting our intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Chief Information Officer. The current CISO has more than seven years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.


text: The CISO manages and is supported by a global team of risk managers, cyber defenders, architects, and engineers with the knowledge and experience to carry out day-to-day cybersecurity operations. They are also supported by third parties who provide threat intelligence, global infrastructure monitoring, and threat detection and response to cyber events. In addition, our Corporate Security team, a part of the Legal organization, has open lines of communication with various Federal, State and International law enforcement agencies to gain access to the latest cyber situational awareness.


text: We assess third-party cybersecurity controls through a cybersecurity questionnaire and include information security and privacy addendums to our contracts, where applicable. We also require that our vendors and other third parties report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: We educate our employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.


text: The CISO has an incident response plan designed to address potential cybersecurity incidents and notify appropriate leadership while determining the material impact through a cyber sub-committee of management's Disclosure Committee. The plan also includes implementing long-term strategies for recovery and prevention of future incidents.


text: The Chemours Company The board of directors is responsible for oversight of our Enterprise Risk Management process ("ERM") and is informed of the risks associated with cybersecurity through periodic ERM updates. The Board has also delegated oversight of the cybersecurity and information security programs and processes for assessing, identifying and managing material risks from cybersecurity threats to the Audit Committee. The Audit Committee regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and, ultimately, the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: Although our Risk Factors include further details about the cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: As part of our cybersecurity risk management framework, we have implemented comprehensive Corporate Incident Response Plans (IRPs) and other policies and procedures designed to ensure the assessment, identification, and management of material risks from cybersecurity threats, and to facilitate timely disclosure of material cybersecurity incidents in accordance with SEC rules. Our policies provide for cybersecurity awareness training for employees and engagement in due diligence processes in accordance with industry best practices for third-party vendors, including those handling critical services or sensitive data on our behalf. Our policies also provide for regular, senior management-led table-top exercises simulating cyberattack scenarios to ensure preparedness and response agility. We undertake an annual review of our policies to help ensure their effectiveness and relevance in light of evolving cybersecurity threats. Additionally, we maintain cyber insurance to help cover costs associated with the occurrence of certain cybersecurity events. We do not currently engage any other third parties as part of our cybersecurity risk management framework, but we do use third party services and products in the ordinary course with respect to certain common cybersecurity threats.

companyName: Strategy Inc

ticker: MSTR


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all Strategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Technology Officer (CTO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.


text: Our CTO and CISO oversee our cybersecurity preparedness. Our CTO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining Strategy in 2018. Our CISO, who joined Strategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CTO.


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the oversight of the audit committee of our board of directors and senior management. Strategy's management, including our CTO and CISO, provides the audit committee with regular updates on cybersecurity incidents and emerging threats. The audit committee actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Additionally, board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President, or SVP, Head of Finance and Investor Relations, Senior Vice President, General Counsel, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Additionally, in Item 1A. Risk Factors, under the heading of Risk Related to Information Security and Business Disruptions, forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, the Company does not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile,, suppliers, and vendors who have access to our critical systems and information.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Risk Management and Strategy. We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Andres Briseno, our SVP, Head of Finance and Investor Relations and, Douglas Snyder, our Senior Vice President, General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Mr. Briseno and Mr. Snyder have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Briseno has served in a number of significant leadership roles at our company since 2016, including oversight of investor relations, business operations and corporate developments, and was appointed as SVP, Head of Finance and Investor Relations in 2023. Mr. Snyder has served in a number of significant leadership roles in various companies in the healthcare industry, and provided an oversight to legal and compliance teams with his broad legal background. Prior to joining our company, Mr. Snyder served in senior leadership and operations roles across healthcare field, including biotechnology, pharmaceuticals and the FDA. Further, our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company recognizes the critical importance of assessing, identifying and managing material risks associated with cybersecurity threats, as well as developing, implementing and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We focus significant resources on protecting our technology infrastructure and the personal information therein regarding applicants, our students, their families, our alumni and our employees. Our principal cybersecurity risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The Board of Directors, as a whole, oversees the Company's risk management through both the Company's enterprise risk management program and the internal audit function. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.


text: The Board has delegated oversight of the Company's management of cybersecurity risk to the Compliance and Risk Committee (the "Committee"). Directors with experience in cybersecurity are appointed to this Committee to assist in developing strategies and processes for protecting against, responding to, and remediating information security breaches. Those directors are Dennis Chookaszian, Patrick Gross and Leslie Thornton. The Committee reviews information security matters quarterly. In addition, the full Board regularly receives updates on cybersecurity matters from our Chief Information Officer, David C. Czeszewski, at each board meeting. The Chief Information Officer reports on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, an assessment of the information security program, and the emerging threat landscape. Mr. Czeszewski has a Bachelor of Arts degree in business and computer studies and a Master in Business Administration. He has worked in the technology field since 1986, joined the Company in 2001, and has been its Chief Information Officer since 2013.


text: The Company has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.


text: We have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We engage third-party experts to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. These third-party experts perform periodic cyber assessments, including security assessments using the CIS Controls cybersecurity framework. Our processes address cybersecurity threat risks associated with our use of these third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risks to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss, any of which could adversely affect our reputation, operations and ability to attract and retain students," and "Our primarily remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.


text: A core aspect of the Company's business relies on technology and software; as a result, the security of those technologies and software, as well as the protection of the confidential information entrusted to the Company by its customers, are key components of the Company's business and strategy. DFIN maintains many processes for identifying, assessing and managing material risks from cybersecurity threats. These processes are applied throughout the organization and are monitored, updated and assessed. DFIN has developed cybersecurity risk management processes that are integrated into the Company's overall risk management system and designed to be comprehensive. Risk management committees such as the Enterprise Risk Management Committee and the Ethics and Compliance Committee regularly review the Company's policies and procedures governing cybersecurity. These policies and procedures inform protocols that align cybersecurity risk assessment and mitigation to evolving risks and threat vectors that impact broader enterprise risk categories, promoting a comprehensive approach. These processes include the identification, assessment and management of material risks that are derived from cybersecurity threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, the National Institute of Technology Cybersecurity Framework ("NIST CSF") and Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly prescriptive and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the NIST CSF and engages a consultant to periodically assess the Company's NIST CSF profile and maturity. DFIN also obtains System and Organization Control ("SOC") Type 2 certification demonstrating control effectiveness across multiple American Institute of Certified Public Accountants (AICPA) Trust Service Principle domains.


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats.


text: Cybersecurity Governance and Responsibilities The Board recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management, or ERM. The Company seeks to mitigate cybersecurity risks through a cross-functional approach, including its Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by assessing, identifying, preventing, and managing risks from cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: DFIN maintains a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The program also includes evaluations of existing suppliers and third parties for ongoing risk. A supplier's classification rating determines the frequency with which it is evaluated. For example, those identified as critical suppliers are monitored on a quarterly basis, or more frequently if an event occurs that could elevate the risk, and assessed at a higher frequency than other suppliers. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that are determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Mitigating cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2024, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and reporting, data handling and provided targeted cybersecurity threat awareness and training to executives during 2024. The Company reviews its Incident Response plans and conducts tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.


text: No material cybersecurity incident has been identified nor materially affected the Company's business strategy, results of operations, or financial condition during the periods covered by the Annual Report. The Company's goal is to continually assess potential incidents, enhance protocols, expand cyber risk capabilities to mitigate future risks and safeguard DFIN's intellectual property, operations and client data.


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management, the Board or the Audit Committee, as appropriate. The Company's Chief Information Security Officer ("CISO") has approximately 30 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security Engineering, Security Architecture, Identity Services and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ numerous tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.


text: The Board maintains oversight of risk from cybersecurity threats and is regularly briefed regarding emerging cyber risks, mitigation strategies and incident response protocols directly from the CISO. The Board includes at least one cybersecurity subject matter expert. The CISO periodically engages with the Board in an executive session to provide updates related to threat landscapes, security initiatives and other cybersecurity awareness within DFIN. The Board participates in tabletop exercises to better understand the Company's incident response planning and the Company maintains processes and procedures so that material risks or events are escalated and addressed appropriately.


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the company's response to computer security incidents when activated.


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. However, there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a cybersecurity incident or that such coverage will continue to be available on commercially reasonable terms or at all.


text: The company engages consultants and other third parties to identify and manage cybersecurity risks, including risks from third-party service providers that may impact the company.


text: No risks from cybersecurity threats, including as the result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, operational disruptions, be subject to litigation, civil or criminal investigations, regulatory intervention or incur costs related to remediation, payment of ransom or penalties, including as a result of unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: Governance. The company's board of directors (the "Board" or "Board of Directors") oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity, and regularly reports its activities to the Board of Directors. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with the VP of Information Security and other members of management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our CIO, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who reports directly to the company's chief financial officer. The VP of Information Security has responsibility for information security strategy and operation. The VP of Information Security is responsible for managing and assessing material risks from cybersecurity threats. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices, which are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards, are fully integrated into our overall risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, internal assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; however, there can be no assurance that a cybersecurity incident that could have an adverse material impact on us will not occur in the future. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO"), IT Risk Management team leader ("Head of IT Risk") or other members of the IT Risk Management function.


text: Management's Role Our Head of IT Risk, with the CTO's oversight, is primarily responsible for assessing, monitoring and managing material risks from cybersecurity threats and manages our IT Risk Management team. The Head of IT Risk is currently a Certified Information Systems Security Professional (CISSP), with a Master of Science in Digital Forensic Science and has 18 years of cybersecurity work experience. The members of our IT Risk Management team have an average of five years of cybersecurity work experience with degrees in information technology and computer engineering. The Head of IT Risk works closely with the CTO, including holding bi-weekly meetings, to discuss cybersecurity risks and any changes in our cybersecurity policies and practices. The CTO, Head of IT Risk and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, personal information, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").

companyName: Confluent, Inc.

ticker: CFLT


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.


text: The Chief Information Security Officer, in coordination with our Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.


text: Depending on the particular environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, forensic investigators, dark web monitoring services, and professional service firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for each vendor, security questionnaires, audits, and review of security reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust and Security department, and the members of the Cybersecurity Risk Management Team. Our Trust and Security department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. Senior management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the management disclosure committee and to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risks, and mitigation measures.


text: Our Head of Information Technology (IT) oversees overall cybersecurity management, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic, but at least annually, reports to our Board or the Audit Committee of the Board of Directors, or the Audit Committee. The IT security team has over 40 years of combined technology experience, and over 20 years of experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The Company's Cybersecurity Committee is comprised of information technology, finance, legal, human resources, and data privacy employees, including the Head of IT. It meets regularly, but at least annually, to review and provide oversight of the Company's cybersecurity risks and data security programs, policies, and strategies. Pursuant to internal policies, the Head of IT will notify the Cybersecurity Committee of significant cybersecurity incidents and breaches. The Cybersecurity Committee reviews, analyzes, and responds to cybersecurity incidents and breaches. Additional responsibilities and risk mitigation strategies relate to business continuity and business resiliency capabilities.


text: The Company's Audit Committee has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and ERM, including with respect to cybersecurity, and to report to the Board annually. The Audit Committee is also responsible for overseeing the integrity and effectiveness of the Company's disclosure controls and procedures, which are designed to ensure that information related to cybersecurity risks and incidents is recorded, processed, summarized, and reported accurately and on a timely basis, to allow for timely decisions regarding disclosure of any such incidents. Our Audit Committee receives regular presentations and reports on cybersecurity risks from the executive management leadership team, which address recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee is also made aware of any potential material cybersecurity incident as well as ongoing updates regarding any such incident until it has been addressed by the executive management leadership team. On an annual basis, the Board discusses the Company's approach to cybersecurity risk management with the Audit Committee members and management (including members of the Cybersecurity Committee). Throughout the year, the Board and its committees engage with management to discuss a wide range of enterprise risks related to the Company's businesses, including cybersecurity, and they confirm the alignment of risk assessment and mitigation with business strategy.


text: The Company regularly assesses and tests its cybersecurity policies, standards, processes, and practices, including, but not limited to, audits, tabletop exercises, threat modeling, and penetration and vulnerability testing. The Company regularly engages outside advisors and experts to anticipate future threats and trends and to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Cybersecurity Committee, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Cybersecurity Technical Safeguards The Company invests in new information and cybersecurity services and technologies. Technical safeguards designed to protect the Company's information systems from cybersecurity threats include firewalls, continuous threat detection and response system(s), data leak prevention, enhanced email protection, antimalware functionality, and access controls, which are evaluated and improved through periodic assessments and cybersecurity threat intelligence.


text: Cybersecurity Incident Response and Recovery Planning The Company has established and maintains incident response and data recovery plans that address the Company's response to a cybersecurity incident, and plans are reviewed by the Cybersecurity Committee and members of the IT department.


text: Third-Party Risk Management The Company maintains a risk-based approach to identifying and overseeing risks from cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party system s.


text: Education and Awareness The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Current Cybersecurity Risk Posture To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see "Item 1A. Risk Factors - Our business and operations would suffer in the event of system failures."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: Risk Management and Strategy In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. This comprehensive approach to protecting the Registrants' assets, employees, and data - including customer information - utilizes a defense-in-depth approach, which enables the Registrants to continually evaluate enterprise-wide cyber and physical security risks. The Registrants' defense-in-depth methodology is based on leading cybersecurity frameworks, including: • U.S. Department of Energy's Cybersecurity Capability Maturity Model standard, • National Institute of Standards and Technology Cybersecurity Framework, and, particularly for the bulk electric system, • North American Electric Reliability Corporation's Critical Infrastructure Protection Standards.


text: In addition, the Registrants' cybersecurity team regularly coordinates with industry peers, the Edison Electric Institute, and state and federal agencies to improve threat intelligence, situational awareness, and security practices.


text: The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.