text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions including contract research organizations, or CROs, for managing clinical trials, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions. We generally engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we may also require that such providers possess at least one of the following certificates, reports, or procedures: SOC 2 Type 2; ISO 27001; annual penetration tests; and/or red/blue team tests.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC

secItem: Item 1C


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks, failures in or interruptions of, or other compromise of our information technology systems, or those of third parties with whom we work, or our data could result in adverse consequences that materially affect our business, including without limitation, regulatory investigations or actions, litigation, fines and penalties, information theft, data corruption, harm to our reputation and brand, significant disruption of our business operations and other adverse consequences.

stage1Category: None/Other

stage1Method: unanimous


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Head of Computational & Structural Science, who reports directly to our Chief Technology Officer, and has over 10 years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and Chief Legal Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.

stage1Category: Management Role

stage1Method: majority


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Head of Computational & Structural Science, Chief Legal Officer and General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

stage1Category: Risk Management Process


text: Management, including the IRAC, is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Head of Computational & Structural Science, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.

stage1Category: Board Governance


text: The global data protection landscape is rapidly evolving, and we may be impacted by or subject to new, amended, or existing laws and regulations in the future, including as our operations continue to expand or if we begin to operate in foreign jurisdictions. The risk of a security breach or disruption or data loss, particularly through social engineering attacks, cyber-attacks, or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: We collect and maintain data and information necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business, including systems infrastructure operated and maintained by third-party service providers. In the ordinary course of business, we collect, store, and transmit confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the privacy, security, confidentiality, and integrity of such confidential information.


text: In addition, a breach may require notification to governmental agencies, the media, or individuals pursuant to applicable data privacy and security laws. We would also be exposed to a risk of loss, negative publicity, harm to our reputation, governmental investigation and/or enforcement actions, claims or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.


text: Our management team, including the CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO reports the progress of cyber risk reduction initiatives to the Audit Committee on a periodic basis. The CIO has extensive information technology experience in the corporate environment.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee reports the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.


text: Cyber Risk Management Strategy We have a cyber risk management policy and asset-based cyber risk management methodology for the continuous identification, assessment, and management of our cyber risk exposure. Our cyber risk managers have been trained in our cyber risk management policy and methodology. The methodology is as follows: Maintaining an up-to-date and accurate inventory of all assets (e.g., data, systems, hardware, software, and vendors).


text: Categorization of all assets based on the criticality of the data processed and the assets criticality to the continuity of business operations.


text: A profile is maintained of the most likely threats, their intent, and the impact the threat may have on the confidentiality, integrity, and availability of Company assets. Evaluation of relevant risk-based scenarios or vulnerability of an asset and how a threat may exploit the asset. Implemented security controls or "mitigating factors" are considered for each scenario.


text: Considering the asset, threat, risk-based scenario or vulnerability, and the mitigating factors, a likelihood and impact determination is made to calculate the final risk level. Risk reduction plans are determined and used to prioritize security program initiatives. Risk mitigations are tracked and monitored in a risk register.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2024, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We depend on our information technology systems, and any failure of these systems could harm our business. Any real or perceived security breach, loss of data, and other disruptions or incidents could compromise the privacy, security, integrity or confidentiality of sensitive information related to our business or prevent us from accessing critical information and expose us to liability and reputational harm, which could adversely affect our business, results of operations and financial condition."


text: Third Party Risk Management We leverage multiple third parties to support our business operations. Throughout the lifecycle of the vendor relationship, security is integrated as part of each process. We maintain a vendor inventory, categorized based in risk tiers, and perform due diligence of the vendor's security practices commensurate with the risk tier. Vendor contracts and security practices are monitored to ensure an accurate assessment of risk is maintained.


text: Third Party Support of the Cyber Risk Management Program We employ third parties to support our cyber risk management program in the following ways: Use of internal and external auditors to maintain compliance with regulatory requirements.


text: Incident Management We make continuous efforts to maintain the ability to respond quickly and effectively to security incidents to minimize their impact. We implement an incident response policy, incident response plan, and deploy comprehensive continuous security monitoring solutions to monitor events occurring across its assets. Additionally, a material risk determination model enables our cyber incident response team and senior leadership to determine materiality.


text: Cybersecurity Risk Management Program We recognize the importance of maintaining the integrity of our information technology systems and safeguarding the confidential business and personal information we receive and store about our employees, customers and suppliers. We have a cybersecurity risk management program in place to identify, assess, and manage risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Among the key features of our program are:

companyName: TopBuild Corp

ticker: BLD


text: Periodic independent, third-party reviews of our program and its maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework;


text: Strategic engagements of consulting firms and legal advisors to advise the Board and our executive officers regarding the structure and oversight of our cybersecurity risk management program, cyber strategy framework evolution, risk-based assessments, incident response services, and cyber technology;


text: Consulting with external advisors and specialists on specific projects regarding opportunities and enhancements to strengthen our cyber practices and policies on an as needed basis;


text: Periodic review of SOC1 and SOC2 audit reports submitted by our strategic third-party technology suppliers, as prepared by their external auditors;


text: Ongoing cybersecurity training for employees; and Periodic testing of incident response procedures. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help test, develop and manage our cybersecurity risk management program.


text: Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We have not experienced a material cyber breach in the last three years. We do not believe that any risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "In the event of a cybersecurity incident, we could experience operational interruptions, incur substantial additional costs, become subject to legal or regulatory proceedings or suffer damage to our reputation," included in Part I, Item 1A (Risk Factors) of this Annual Report.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts the Company and our technology systems. In this regard, we conduct due diligence of significant third-party service providers who will have access to our information technology systems and incorporate cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Further, our external auditor reviews our processes designed to control access to our information technology systems as part of its assessment of our internal controls.


text: Incident Response Procedures We have in place a cyber incident response plan outlining procedures to follow in the event of a cybersecurity incident. Under the plan, we established a cross-functional critical response team (CRT) with expertise in various subject matter areas responsible for initiating and leading our incident response procedures. The CRT is under the direction of our Chief Information Officer and is comprised of our Director of Information Technology, Chief Accounting Officer, Assistant General Counsel and Chief Compliance Officer, Senior Manager of Risk and Insurance, and certain other members of management. The plan provides that our CRT will conduct an impact assessment in the event of a cybersecurity incident meeting pre-established criteria, or which may otherwise impact the operations or finances of the Company. If any such cybersecurity incident is determined by the CRT to have the potential to materially impact the Company, such event would be elevated for further review and assessment by a senior leadership team consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel and other members of our executive leadership team. Under certain circumstances, such review and assessment would include reporting to and oversight of the Board.


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures;

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our full Board is responsible for oversight of risks from cybersecurity threats, including our cybersecurity risk management program. In carrying out its oversight responsibilities, the Board receives regular cybersecurity program updates and quarterly scorecard assessments from our Chief Information Officer, which cover topics related to information security, privacy and cyber risks, and our risk management processes, including the status of any recent cybersecurity events meeting specified criteria, the emerging threat landscape, and the status of capital investments in our information security infrastructure.


text: At a management level, our cybersecurity risk management program is led by our Chief Information Officer, who reports to our Chief Executive Officer. Under our Chief Information Officer's leadership, the cybersecurity team implements and provides governance and functional oversight for cybersecurity controls and services. The team's credentials include Certified Chief Information Security Officer, Certified Information Security Manager and Certified Information Systems Security Professional.


text: To help identify, assess, and manage risks from cybersecurity threats, we have integrated cybersecurity risk management into our broader, Company-wide enterprise risk management (ERM) evaluation and strategy process, which is led by our executive officers, overseen by the Audit Committee of the Board, and reviewed annually by the full Board. Our ERM process takes a top-down, enterprise view of material risks impacting our Company, including credit, liquidity, strategy, cybersecurity, and operational risks, and is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Employees responsible for assessing identified risks deliver an update quarterly to our senior leadership team, which consists of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, Chief Human Resources Officer, Chief Growth Officer, and Vice President of Supply Chain. Status updates with respect to these risk areas are delivered quarterly by management to the Audit Committee of the Board, and full risk assessment results are presented by management annually to the full Board.


text: Risk Management and Strategy. We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. Our general risk management strategy is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.


text: We work with third parties from time to time that assist us from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.


text: Layered security controls monitoring traffic to and within the Company that identify and block suspicious activity, with system configurations that align with industry best practices. Preventative and detective controls to identify adverse internal and external trends and analyze the Company's response mechanisms.

companyName: National Bank Holdings Corp

ticker: NBHC


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks. Governance.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the Vice President of Finance, who reports to the CEO. The Vice President of Finance has over 15 years of experience as a Certified Public Accountant specializing in internal controls and U.S. GAAP. The CEO has nearly 25 years of experience in management including serving as a CFO and CEO of publicly traded life science companies as well as holding an MBA for New York University's Stern School of Business. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit committee of the board of directors for certain cybersecurity incidents.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Our risk management program is designed to identify, assess, manage, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats.


text: The Company's cybersecurity risk management program consists of a layered cybersecurity approach and is organized pursuant to prevailing guidance such as the Federal Financial Institutions Examination Council, including its underlying handbooks and assessment tools, and incorporates guidance issued by the National Institute of Standards and Technology and the Cybersecurity Infrastructure and Security Agency. The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly assessed by consultants, regulatory authorities, and external auditors. The Company's Enterprise Risk Management department also plays a crucial role in monitoring the program by internally conducting regular cyber maturity assessments. Cybersecurity processes are adjusted as needed based on the information gathered from these internal and external assessments to ensure that the program is aligned with the Company's business objectives, is designed to address evolving cybersecurity threats, satisfies regulatory requirements, and conforms with industry standards.


text: Annual network and penetration testing by reputable third parties to evaluate the Company's suite of security controls and tools and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests. Conducting regular cyber maturity assessments to ensure the Company is prepared to manage and respond to cybersecurity threats.


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: Recurring audit and oversight of all critical third parties within the Company's digital ecosystem to identify risks and adverse trends and monitor their compliance with our cybersecurity requirements. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.

stage1Category: Third-Party Risk


text: Annual risk and self-assessments against established industry frameworks to ensure best practices are in place and the Company's risk assessment continues to evolve.


text: Carrying out regular trainings and tests, including phishing simulation tests, to ensure the Company's associates remain vigilant with regards to cybersecurity threats.


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third parties, and established back-up, replication, and restoration to help ensure continuity of operations.


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, if necessary, remediate any potential damage. While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

stage1Category: Strategy Integration


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's risk management program, including oversight of cybersecurity risk management, to the Audit & Risk Committee of the Board.


text: The Company's Chief Risk Management Officer reports directly to the CEO and chairs the Company's management-level Enterprise Risk Management Committee, through which the Company's executive team manages and oversees the Company's entire risk management program, including cybersecurity risk management. In addition, the Company's Chief Information Security Officer ("CISO") reports directly to the Chief Risk Management Officer and works in tandem with the Company's Enterprise Technology Department. The Enterprise Technology department is responsible for the Company's information systems and for building and maintaining cybersecurity defenses within the Company's technology systems. The Company's Chief Technology Officer ("CTO") reports directly to the CEO and leads the Enterprise Technology Department. Collectively, the Enterprise Technology and Enterprise Risk Management Departments work together to oversee the day-to-day management and implementation of the Company's cybersecurity risk management program.


text: The Company's Internal Audit Department, including third parties engaged by Internal Audit, evaluate the overall effectiveness of the Bank's cybersecurity risk management strategy which is reported to the Audit & Risk Committee of the Board. In addition, the Enterprise Technology and Enterprise Risk Management Departments provide reports to the Audit & Risk Committee of the Board discussing items such as the Departments' efforts to prevent, detect, mitigate, and potentially remediate cybersecurity risks, cybersecurity status updates, and current cybersecurity trends in the banking industry. Finally, the Company's Board participates in training at least annually on the Directors' role in managing cybersecurity risks.


text: The Company's CISO has over 15 years of prior work experience, which includes managing information security and operational risk, developing cybersecurity strategy and incident responses, implementing effective information and cybersecurity programs, preventing fraud and social engineering, and ensuring business continuity and proper third party management. The Company's CTO has over 25 years of prior work experience in cybersecurity and data center management and design, 16 years of which has been devoted to the financial and banking sectors. The Enterprise Technology Department is comprised of a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity/network operations.


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: risk metrics and self-assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our cybersecurity controls and processes, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls and processes; periodic required cybersecurity awareness training of our employees;


text: a Cybersecurity & Technology Risk Committee, comprised of technology and business leaders, that provides risk advisory and general guidance regarding new and modified information security controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "If we fail to comply with laws, regulations and market standards regarding the privacy, use, and security of customer information, or if we are the target of a successful cyberattack, we may be subject to legal and regulatory actions and our reputation would be harmed."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee oversight of cybersecurity risks and the steps that management has taken to monitor and control exposure to such risks.


text: The Audit and Risk Committee receives quarterly reports from our Chief Information Security Officer ("CISO") and our Chief Information Officer on our cybersecurity risks and meets in executive session with our CISO following such reports. In addition, management updates the Audit and Risk Committee, as necessary, regarding significant cybersecurity incidents. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: In 2024, we created a new position for a full time Chief Risk Officer. Our Chief Risk Officer has primary responsibility for our enterprise risk management program and works with our CISO in the oversight of our cybersecurity risk management program.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. Our information technology risk committee is comprised of senior managers in our information technology, loan origination, loan servicing, accounting, and legal groups that meet monthly to review information security risks and the development and implementation of policies and procedures and other controls to mitigate cybersecurity and other information security risks. Our CISO provides a report to our management risk committee on the activities of the information technology risk committee, which committee, in turn, reports regularly to the full Board on its activities.


text: The CISO manages a team of employees, which has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained managed service providers. The CISO brings over 30 years of technology, cybersecurity, and risk management experience from the finance and healthcare industries. His work experience includes the design, implementation, and oversight of control and governance frameworks in complex, hybrid-cloud, and data intensive environments operating in highly regulated entities in the financial services and healthcare insurance industries.


text: Our information security management team is informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including managed service providers engaged by us, and alerts and reports produced by security tools deployed in our information technology environment.


text: We have implemented processes to identify and assess the cybersecurity threats that could affect our business and information systems and we use various tools and methodologies to test our cybersecurity defenses on a regular basis. As part of this process, we perform regular vulnerability scans and penetration tests and engage third party experts to perform evaluations of our strengths and vulnerabilities. In addition, we perform an annual enterprise risk assessment procedure that evaluates business continuity risks, including an evaluation of cybersecurity risks. The results of these evaluations, along with recommendations for improvements and remediations to our cybersecurity program, if deemed necessary, are periodically reported to senior management and the audit committee of our board of directors, which is tasked with oversight of our cybersecurity program. Reports provided to our senior management and audit committee include updates on our cyber risks and threats, the status of projects to strengthen our information technology systems and assessments of our cybersecurity program. Our senior management and audit committee use the results from these evaluations and reports as part of their risk assessment and decision-making functions.

companyName: Kiniksa Pharmaceuticals International, plc

ticker: KNSA


text: We require that all employees, consultants and third party contractors adhere to our cybersecurity policies. Key third party contractors undergo a qualification process under our quality management programs (including cGMP and GCP) wherein we assess, among other things, their cybersecurity risk profile. Third party contractors, such as CROs and information technology service providers, that handle sensitive data, including patient data, are subjected to increased scrutiny. Based on identified risks, we may periodically review and reassess our third party contractors on an ongoing basis.


text: Our cybersecurity program is overseen by our head of information technology, who has significant experience in the information technology space. Our information technology team is responsible for leading our cybersecurity strategy, policy, standards, architecture and processes. Such team is responsible for the identification and reporting of risks to our management and board, as described above. Our information technology team maintains a security operations center intended to identify anomalous activity. Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.


text: We have not experienced a material data breach or failure of our cybersecurity program. Our business depends on the availability, reliability and security of our and our third party contractors' information systems, networks and data. Various risks arising out of a cyberattack, security breach or a failure on our or our third party contractors' part to maintain an adequate cybersecurity program could adversely affect our business, financial condition, and results of operations. See " Risk Factors – General Risk Factors – Our information technology systems, or those of our third party CDMOs, CROs, specialty pharmacies, third party logistics providers and other contractors, consultants and service providers, may fail or suffer cyberattacks or security breaches, which could result in a material disruption of our or such third party's business or operations, impede our development programs for our product candidates or materially impact our ability to commercialize our products."


text: Cybersecurity Risk Management and Strategy. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: B&G Foods, Inc.

ticker: BGS


text: Our cybersecurity program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes that are designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis.


text: We have an information security policy, which is supported by a security awareness program. We also have an information security training and compliance program in place. Our information technology (IT) department has engaged a third party to provide regular cybersecurity awareness training to our employees. We also have business continuity plans and incident response plans in place to prepare us to act quickly in the event of cyber incidents. We test our business continuity plans and incident response procedures at least annually.


text: Cybersecurity Governance. Our chief information officer, who leads our IT department, oversees our cybersecurity program. Our chief information officer has twenty-nine years of IT experience. Our chief information officer reports to our chief financial officer. As part of our company's risk management function, our chief information officer provides periodic updates about our cybersecurity risk profile to our executive leadership team. We have an incident response program that provides for the prompt escalation of certain cybersecurity incidents to certain members of management, including our chief financial officer and our general counsel, so that decisions regarding disclosure and reporting of such incidents can be made in a timely manner.


text: Establishing a risk-appetite profile, which we review at least annually to regularly assess our cybersecurity infrastructure and software systems in a manner that ensures we capture their current state and identify emerging risks that would require changes in our cyber environment;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our chief information officer meets at least annually with the risk committee of our board of directors and/or the full board of directors to provide them with updates on IT matters, including cybersecurity. At least two members of our Board of Directors have IT and cybersecurity experience or expertise, including the chairs of our audit committee and risk committee. While our board of directors is ultimately responsible for risk oversight at our company, the risk committee of our board of directors assists the board in fulfilling its oversight responsibilities by reviewing risks in certain areas, including cybersecurity.


text: Cybersecurity Threats and Incidents. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our company, including our business strategy, results of operations or financial condition. However, we and third-parties with which we have shared personal information have been subject to attempts to breach the security of networks, IT infrastructure, and controls through cyberattack, malware, computer viruses, social engineering attacks, ransomware attacks, and other means of unauthorized access. For example, in February 2023, we experienced a cyberbreach resulting from a global ransomware attack that impacted thousands of network servers around the world and which encrypted certain of our network servers. In this case, our internal IT department together with third-party cybersecurity incidence response teams that we keep on retainer were able to unencrypt and restore most of the affected servers and restore others from backups within a few days and with minimal disruption to our manufacturing operations, sales, order processing, distribution and other business operations, and without paying any ransom. We incurred costs relating to the cyberattack, including costs to unencrypt and restore our servers, scan our network to ensure there was no remaining malware or other problematic remnants of the attack and to enhance our cybersecurity defenses.


text: The February 2023 ransomware attack also resulted in the unauthorized release of sensitive personal information of certain of our current and former employees that has required remediation expenditures by our company, including, without limitation, expenditures to scan the leaked files to identify the specific individuals impacted and the scope of the sensitive personal information, and expenditures to notify and provide free credit monitoring to our employees and certain former employees and other individuals.


text: Despite our ongoing efforts to continuously improve our ability to prevent and minimize the impact of future cyber incidents, we cannot assure you that we or any third party with whom we do business will not be the subject of future threats or incidents. While the February 2023 cyberattack and our remediation efforts did not have, and other cyberattacks experienced by third parties with whom we do business have not had, a material adverse impact on our consolidated financial position, results of operations or liquidity, we cannot assure you that in response to a future cyberattack we or any third party with whom we do business will be able to restore our respective systems so quickly and with minimal disruption to our or their business operations and without our incurring material costs or loss of net sales. In addition, the mishandling or inappropriate disclosure of non public sensitive or protected information could also lead to the loss of intellectual property, negatively impact planned corporate transactions or damage our reputation and brand image. Misuse, leakage or falsification of legally protected information could also result in a violation of data privacy laws and regulations and have a negative impact on our reputation, business, financial condition and results of operations.


text: Please refer to the risk factor captioned " We are increasingly dependent on information technology; Disruptions, failures or security breaches of our information technology infrastructure could have a material adverse effect on our operations " included in Part I, Item 1A, "Risk Factors," of this report, for further information about cybersecurity risks and potential related impacts on our company.


text: At UFP Industries, we recognize the importance of managing cybersecurity risks to protect our operations, data, and stakeholders. Our program is aligned with industry-recognized frameworks, including the NIST Cybersecurity Framework and CIS Top 18 Security Controls. We employ a structured approach to identify, assess, and manage potential threats, ensuring our defenses are proactive and multi-layered. Regular reviews and third-party assessments help us adapt to evolving risks, while our incident response plan and business continuity strategies are designed to minimize any operational impact from cybersecurity incidents. Risk Management and Strategy.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Risks from Cybersecurity Threats. Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or other failures in our information technology systems could disrupt our business." Our cybersecurity risk management program is designed to evaluate material threats and vulnerabilities throughout the organization and their potential impact on our operations, data, and stakeholders. Our program is reviewed and updated regularly to address emerging risks, following the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.


text: Identify We assess our critical operational assets and those that may attract threat actors, identifying any cyber activities that could diminish asset value, hinder operational capabilities, or covertly grant access to threat actors.


text: Assess We evaluate the exposure of our assets to identified cyber risks and determine the potential operational or reputational impact if access or utilization is compromised. This assessment includes determining the materiality of these risks based on their potential impact.


text: To improve our cybersecurity posture, we regularly engage third-party consultants for penetration testing, risk assessments, and control audits. We also monitor third-party service providers, particularly those with access to sensitive data, through contractual and oversight mechanisms designed to mitigate and monitor risks continuously.


text: We work proactively to prevent, detect, and minimize the impact of cybersecurity incidents through a structured incident response plan. This plan is tested and reviewed regularly with simulated incidents. We maintain business continuity, contingency, and recovery plans designed to maintain resilience during incidents. Lessons learned from past incidents are integrated into our governance, policies, and technology to strengthen our defenses.


text: As of this filing, we have not experienced any cybersecurity breach that has materially impacted our business or financial condition, nor have we identified any risks from cybersecurity threats that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition. However, we recognize that our operations involve the collection, transmission, and storage of sensitive data, which may expose us to cybersecurity threats, including unauthorized access and cyberattacks. We remain committed to identifying and managing these risks as part of our business strategy and operations. Board of Directors and Management Governance.


text: Management's Role. Primary responsibility for risk management, including cybersecurity risks, lies with management. Our management team actively assesses and manages material cybersecurity risks through a structured framework. The CIO and Director of Cybersecurity lead our efforts in managing these risks:


text: CIO. With over 20 years of experience in the information technology space, the CIO brings expertise and strategic insight to cybersecurity, compliance, enterprise architecture, systems resilience, and digital transformation to UFP Industries.


text: Director of Cybersecurity. With over 30 years of experience in the information technology space, including systems architecture, management, and cybersecurity risk management, the Director reports directly to the CIO and is responsible for day-to-day cybersecurity operations.


text: Our cross-functional cybersecurity team, composed of experts with decades of combined experience, supports the CIO and Director in implementing our cybersecurity program. This team consults with legal, HR, and IT specialists to assess the materiality of cybersecurity risks and incidents, using a well-established Incident Response Plan that includes clear escalation measures.


text: Board of Directors Oversight. The role of the Board of Directors with respect to our cybersecurity program is one of oversight of management, and the Board has delegated primary oversight authority over the program to the Audit Committee. The Audit Committee oversees these risks as outlined in its Charter, which mandates reviewing the company's information technology framework, practices, and implemented controls to monitor and mitigate IT risks.


text: The Audit Committee meets quarterly and receives reports and briefings from the CIO, Director of Cybersecurity, and the cybersecurity team on emerging threats, risk status, and mitigation strategies. The Committee engages with the cybersecurity team to increase their understanding of the specific issues facing the Company and to challenge the team as appropriate. The Committee also may consult external cybersecurity experts as needed to fulfill its oversight role. The Audit Committee regularly reports to the Board on matters addressed during the Committee's quarterly meetings, including any material cybersecurity risks or developments. Processes for Monitoring and Mitigating Cybersecurity Risks and Incidents. Regular network and system monitoring for potential threats. Regular vulnerability assessments and penetration testing. Implementation of technical controls such as firewalls, intrusion detection systems, and encryption. Employee training and awareness programs. Incident response plans designed for swift and effective mitigation. Software and vendor risk assessments. Vulnerability management solutions prioritizing patching based on risk. Privileged account management solutions for administrative access.


text: These measures aim to prevent, detect, and respond to cybersecurity incidents effectively. They are regularly reviewed and updated to adapt to evolving threats.


text: In the event of an incident, our Incident Response Plan, which takes into account the perceived materiality of the incident with an appropriate escalation matrix, guides our response. Incident reports are compiled, reviewed by management, and shared with the CIO, CFO, the Audit Committee, and other key leaders, as appropriate, for resource allocation and risk mitigation planning.


text: Risks relating to cybersecurity are overseen by the Audit Committee. Certain members of our management, including the Executive Vice President and Chief Financial Officer (the "CFO"), the Chief Accounting Officer and Corporate Controller (the "CAO") and the Vice President of Internal Audit, report to the Audit Committee regarding cybersecurity risks. IT management presents an annual update of cybersecurity related activities to the Audit Committee. Interim updates are provided to the Audit Committee by the CFO on an as needed basis should an incident warrant immediate notification or escalation.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Risk Management and Strategy We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. We and our subsidiaries depend on the accuracy, capacity, and security of our information technology systems and those used by our third-party service providers. To protect the confidentiality, integrity, and availability of our critical systems and information, we have developed and implemented a cybersecurity risk management program that includes a cybersecurity incident response plan. Our operating subsidiaries operate and manage on a decentralized basis, and their software is not integrated with each other or with us. Our cybersecurity risk management program covers our businesses and is crafted following frameworks established by the National Institute of Standards and Technology (NIST). While using these frameworks guides our approach to identifying, assessing, and managing cybersecurity risks relevant to our business, it does not imply compliance with any specific technical standards, specifications or requirements. The program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. In addition, our program emphasizes the maintenance of controls and procedures for the prompt escalation of certain cybersecurity incidents, conducting cybersecurity risk assessments, regularly assessing and deploying technical safeguards, establishing incident response and recovery plans, and mandating annual privacy and cybersecurity training for employees to enhance awareness and response to cybersecurity threats.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: We maintain that no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition.


text: The Board of Directors of the General Partner, along with the Board's Audit Committee, oversees the management of cybersecurity risks, receiving regular reports from management on the prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as on material security risks and vulnerabilities. The Audit Committee is updated on cybersecurity risks, risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant cybersecurity incidents within our industry. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our cybersecurity governance committee led by our management team and our CIO with 16 years of experience in cybersecurity and a CISSP certification, bears the primary responsibility for assessing and managing material cybersecurity risks. Regular meetings are held to review security performance metrics, identify security risks, assess the status of security enhancements, and make recommendations on security policies, procedures, service requirements, and risk mitigation strategies.


text: RISK MANAGEMENT AND STRATEGY Our cybersecurity program is designed to monitor, detect, prevent and respond to cyber threats. We take a multi-faceted approach to identifying and mitigating information security risks. This includes but is not limited to penetration tests of our external network, the utilization of third-party scanning tools to monitor our network, maintenance of software and implementing applicable updates timely, training employees to recognize security risks and encouraging employees to report suspicious activity. Annual cybersecurity awareness training is provided to onshore and offshore users. The training seeks to demonstrate to users the risks in using technology and how to effectively defend against cyber threats.


text: We assess, identify and manage material risks from cybersecurity threats and vulnerabilities according to our Cybersecurity Incident Response Plan (the "IRP"). The IRP uses the six-stage model of the National Institute of Standards and Technology Cybersecurity Framework (Preparation, Detection, Containment, Investigation, Remediation, and Recovery) to outline steps for reporting, responding, and mitigating various aspects of a cybersecurity incident. Execution of the IRP's incident response activities are coordinated by the Cybersecurity Incident Response Team, and communications planning via the Helix Crisis Assistance Team and the Cybersecurity Incident Communication Group. There are also separate processes in place for the effective management of cyber incidents involving our offshore assets and certain regional business units.


text: We engage external parties to aid in processing and managing cybersecurity incidents as needed, including utilization of the services and expertise of local law enforcement and government entities, partnering financial institutions, a third-party security operations center ("SOC"), and managed service providers. In addition, we collaborate with our internal auditors to ensure our processes are documented and followed appropriately.


text: In connection with our external SOC and managed service providers, we have implemented change control measures that allow for the continual oversight and assessment of the services provided and threats identified. Notifications and remediation of cyber threats are tracked, reviewed, and archived. Processes implemented and lessons learned involving these third parties are evaluated after each incident to ensure efficiency and replication.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – General Risks – Cybersecurity breaches or business system disruptions may adversely affect our business."


text: We anticipate that we will continue to evaluate and address as needed our cybersecurity risk management, policies, structure, strategies and governance to meet our needs.

companyName: EchoStar CORP

ticker: SATS


text: Within Helix's IT department, several IT management positions are responsible for assessing and managing cybersecurity risk, including the Chief Information Officer, Director of Information Technology and Manager of Information Technology. Each of the IT department's management personnel has over 20 years of IT experience. The Director of Information Technology and the Manager of Information Technology positions are tasked with the daily and per incident assessment and management of cybersecurity risks, while the Chief Information Officer is tasked with oversight.


text: Helix's IT department keeps management involved and informed throughout the entire process of any cybersecurity incident from initial monitoring and discovery through the remediation and restoration, all in accordance with the processes outlined in our IRP. Initial notification regarding a cybersecurity incident may come through our third-party SOC or managed service providers, or from employees reporting internally to our IT helpdesk. Investigations are then performed to determine the appropriate actions per the IRP guidelines. Incidents that warrant further escalation are promptly shared with the CFO and continually updated, as appropriate, until remediation and restoration is achieved.


text: Helix's IT department holds regular quarterly meetings with the CFO, CAO, and Vice President of Internal Audit to recap cybersecurity risks and incidents and to determine any actions required as a result.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future.


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Chief Information Security Officer (" CISO ") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and built into our overall enterprise risk management f unction and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: We maintain a team of internal and external information technology specialists who are responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We engage with certain external parties, including consultants, computer security firms and risk management advisors, peer companies, and industry groups in an effort to enhance our cybersecurity oversight and risk management strategy. We also use security technologies, including third-party solutions and monitoring tools that are designed to identify and mitigate cybersecurity risks. Further, we regularly engage third parties to conduct penetration testing, security assessments and tabletop exercises. We also engage a virtual chief information security officer ("vCISO") to support and advise on our cybersecurity program. We have a process to consider the internal risk oversight programs of critical third-party service providers, including through security questionnaires and contractual requirements, as appropriate. In addition, in an effort to deter and detect cyber threats, we have implemented an annual training program to provide employees with data protection, cybersecurity and incident response and prevention training.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents. For more information, please see the section entitled "Risk Factors."


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management, including from our Vice President, Information Technology (the "VP of IT"), regarding cybersecurity matters, such as relevant cybersecurity risk assessments, as applicable. We have established a process for the Audit Committee to be notified in the event of significant cybersecurity threats or incidents.


text: The VP of IT leads the operational oversight of company-wide cybersecurity strategy, policies, processes, and support staff. Additionally, the VP of IT works across all relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The VP of IT reports and provides regular updates to the Chief Operations Officer and Chief Financial Officer on the cybersecurity program as well as periodic updates to executive management, as needed. Our VP of IT has worked in the information technology field for over 20 years at biotechnology companies including publicly-traded organizations.


text: Cybersecurity Threats In today's digitally interconnected workspace, we are increasingly vulnerable to cybersecurity threats that can disrupt operations, and compromise sensitive information. Cybersecurity threats are continuously evolving and can vary widely, but some common types of material cyber threats include:

companyName: International Seaways, Inc.

ticker: INSW


text: Malware: Malicious software such as viruses, worms, trojans, and ransomware can infiltrate systems and disrupt operations, steal sensitive information, or extort money from the organization.


text: Phishing: Phishing attacks involve tricking individuals into revealing sensitive information such as login credentials or financial data by posing as a trustworthy entity via email, phone calls, or text messages.


text: Denial of Service ("DoS") Attacks: These attacks aim to overwhelm a network, server, or website with an excessive amount of traffic, rendering it inaccessible to legitimate users.


text: Insider Threats: Employees, contractors, or other trusted individuals may intentionally or unintentionally compromise security by stealing data, sharing sensitive information, or performing unauthorized actions.


text: Social Engineering: Social engineering tactics involve manipulating individuals into divulging confidential information or performing actions that compromise security, often through psychological manipulation or deception. International Seaways, Inc.


text: Supply Chain Attacks: Attackers may target third-party vendors, suppliers, or service providers to international seaways to gain unauthorized access to their systems or data.


text: IoT Vulnerabilities: Internet of Things ("IoT") devices used in maritime operations can pose security vulnerabilities if not properly secured, potentially allowing attackers to gain access to critical systems or data.


text: Data Breaches: Unauthorized access to sensitive data, such as business strategy, financial records, or operational data, can lead to financial loss, legal repercussions, and damage to the organization's reputation.


text: We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats as part of our overall risk management system and processes, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputation risk.


text: Cybersecurity is a critical component of the Company's Enterprise Risk Management program. The Company has established an information security framework to help safeguard the confidentiality and integrity of, and access to its information assets and to ensure regulatory, contractual, and operational compliance.


text: Our program is based on the National Institute of Standard and Technology("NIST") Cybersecurity Framework and the Center for Internet Security Critical Security Controls ("CIS").


text: We have adopted a "defense in depth" cybersecurity strategy and deployed multiple layers of security measures to protect the Company's information assets and detect any potential breach quickly. Our multi-layered protection mechanisms are designed to address the security vulnerabilities inherent not only with hardware and software but also due to human error. In an extreme situation, if all the security layers fail and a breach happens, our multiple detection layers are designed to detect the breach.


text: Human Layer: We realize that the users of the information assets are the first line of defense and cyber risk prevention is every INSW employee's responsibility. We organize mandatory cybersecurity awareness training for all staff yearly and conduct simulation tests monthly to check employee preparedness in the detection of phishing attacks. We also maintain an IT Security Policy and Procedures document, that describes Company security policy and practices in detail.


text: Network Security: We deploy firewalls to shield the Company's network from malicious or untoward network traffic that violates security policies. Our firewalls are equipped with intrusion detection and intrusion prevention systems to detect and prevent potential attacks.


text: Logical Security: Access to the Company's information assets is governed by the IT Security Policy and Procedures document, which stipulates the procedure for granting new access, change in access, and access termination. All access changes are audited. All new system access is approved by designated data owners ensuring segregation of duties. We have a documented strong password policy for all users and all privileged access is restricted. All remote access is controlled using geofencing restrictions and requires multi-factor authentication.


text: Operating System and Application Security: We have a vulnerability scanning tool in place that scans all information assets monthly to report any vulnerabilities. Those reports are analyzed by system administrators for appropriate mitigating actions. We have implemented an email security tool that sanitizes all incoming emails for malicious content, attachments, or links.


text: Log Monitoring: We employ a reputable third-party managed security service provider ("MSSP"), who manages logs from all critical information assets of the Company. The MSSP's Security Operations Center ("SOC") assists the Company in detecting and preventing any potential cyberattack at an early stage by analyzing the log data and correlating that with the latest threat intelligence.


text: End Point Security: We allow access to all information assets only from authorized and standard devices ("endpoints"). All endpoints have a next-generation anti-virus tool installed that uses a combination of artificial intelligence, behavioral detection, and machine learning algorithms to anticipate and prevent known and unknown threats. All endpoints also have an extended detection and response ("XDR") tool installed that provides a proactive approach to threat detection and response by collecting and correlating data across multiple security layers. Alerts from all these tools are actively monitored and appropriate alerts/escalations are issued.


text: Data Security: The core objective of our cybersecurity program is securing the Company's sensitive data across all information assets while maintaining appropriate access for authorized personnel. To prevent any accidental data loss, we strictly follow the principle of "least privilege," and limit users' access rights to only what is required to do their jobs. Further, all the disks are encrypted, and daily backups of all computers are maintained outside the Company's network.


text: We maintain a detailed incident response plan to identify, manage, investigate, and remediate various types of cybersecurity incidents. This plan provides organizational and operational structures, processes, and procedures to allow responsible personnel to initiate and execute a proper response to cybersecurity incidents that may affect the function and security of IT assets, information resources, and business operations. The plan describes the processes for cybersecurity incident severity assessment, materiality determination, roles and responsibilities for the incident response team members, and necessary alerts and notifications.


text: The plan is regularly updated, reviewed by management, and tested yearly involving relevant stakeholders so that all are familiar with their roles and responsibilities in case of a cyber incident.


text: We have a retainer agreement with a reputable cyber incident response team, who assists the Company in reviewing the cyber incident response plan and conducting yearly tabletop drills. The experts on the cyber incident response team are available on a priority basis to assist the Company with forensics and other sophisticated analyses and investigations in case of a cyber incident for quick response and efficient recovery.


text: We have insurance coverage for losses and expenses related to liability, privacy and regulatory actions, incident response, business interruption, data recovery, hardware replacement, extortion, and reputational harm arising from potential cybersecurity incidents.


text: Cybersecurity Incidents Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three fiscal years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks. International Seaways, Inc.


text: Our cybersecurity risk management program is managed by the Chief Information Security Officer (the "CISO") and overseen by the Chief Executive Officer and the Chief Administrative Officer. Our CISO has over 25 years of experience in maritime IT. He holds an MBA and a Master of Science degree in Information Management and is a Certified Information Security Manager from the Information Systems Audit and Control Association, certified in Cybersecurity Risk Management by Harvard University, Cybersecurity Oversight by Carnegie Mellon, and Maritime Cybersecurity by Lloyds Maritime.


text: The CISO and other members of the IT security team actively participate in maritime-specific as well as other broader cybersecurity groups for collaboration on cyber resilience, threat intelligence sharing, and best practices exchange. All the members of the IT security team regularly undergo new training/certifications on cybersecurity and attend seminars/conferences related to cybersecurity to keep their knowledge and expertise current. The CISO meets with the Chief Executive Officer of the Company monthly, and more frequently if warranted, to provide updates on cybersecurity programs, threats, and incidents.


text: Board of Directors The Corporate Governance and Risk Assessment Committee (the " Governance Committee ") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the Governance Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISO. The Chairman of the Governance Committee provides quarterly reports of such updates to the full Board of Directors. The CISO's quarterly report to the Governance Committee contains updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: uniQure N.V.

ticker: QURE


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct regular employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Consistent with our cybersecurity risk management policies and controls, we have prepared and implemented an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.


text: Risk Management and Strategy Our Board of Directors and management team recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity risks are considered individually as part of our enterprise risk management program alongside other risks, and prioritized and discussed with our Board of Directors.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response plan and related policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Our team of cybersecurity professionals then collaborate with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies. As part of the above processes, we regularly engage external consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and status on key information security initiatives.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For a discussion of cybersecurity risks applicable to us, see Part I, Item 1A, Risk Factors, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs" in this Annual Report on Form 10-K.


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: As part of our program management activities, we actively engage internal and prominent external experts, as well as industry participants, as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. The Company has adopted a cybersecurity incident response plan (the "Incident Response Plan") which defines our approach for prompt detection, analysis and determination of materiality, prioritization and mitigation of cybersecurity incidents. The Incident Response Plan also includes criteria for escalation to cross-functional committees, including executive management, and notification to our Board, as appropriate. Management also periodically performs tabletop exercises to simulate actual cyber threats to strengthen our policies, standards and related governance processes in response to cyber events. In addition, our internal audit function performs periodic audits or other evaluations to assess our cybersecurity program and compliance with policies and procedures.


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"). Our CISO has formal education in information technology and extensive cybersecurity program management experience with over three decades of diverse experience in the chemicals and manufacturing industries and maintains various information security certifications. Our CISO is accountable for the enterprise-wide cybersecurity strategy for both information technology (IT) and operations technology (OT), including significant third-party risks. The cybersecurity team, led by our CISO, is responsible for policies, standards, architecture, tools, training and processes to keep Trinseo secure. Our CISO provides regular updates to our Digital Steering or Cybersecurity Steering management committees.


text: Our Board of Directors has ultimate oversight of cybersecurity risk and our CISO provides periodic reports and updates concerning our cybersecurity program to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Cybersecurity reports to the Board generally occur at least annually, with updates as deemed necessary by our CISO or, senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information network and data security, assessments of the information security program, and the emerging threat landscape.


text: The Audit Committee is responsible for oversight of the Company's Incident Response Plan, including evaluation of material incidents, response and other related actions, and SEC reporting obligations, which is reviewed at least annually, or as circumstances warrant.


text: Trinseo faces risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, financial condition, cash flows or reputation. Trinseo has experienced, and will continue to experience, cyber incidents in the normal course of our business. Trinseo has not experienced any material cybersecurity incidents or incurred material expenses related to cybersecurity incidents. As of the date of this report, we are not aware of any material risks from cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, financial condition or reputation. See Item 1A Risk Factors for a discussion of cybersecurity risks.


text: Our internal Security Operations Center ("SOC") has primary responsibility for assessing, identifying, and managing material risks associated with cybersecurity threats, and provides information security monitoring for both shoreside and shipboard information systems and applications. The SOC is a team comprised of cybersecurity professionals who are responsible for real-time incident response management for our IT infrastructure, which includes our websites, applications, databases, servers, network devices and components and workstations. They are trained and equipped to identify, contain, analyze and investigate any perceived security threats as well as assist internal users with any information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.


text: As part of our cybersecurity program, team members are offered cybersecurity training and participate in awareness programs including phishing simulation exercises, regular cybersecurity newsletters and reminders and programming and events during cybersecurity awareness month.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our customer, prospect, supplier or employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We generally require that third-party service providers that access, host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology and/or International Organization for Standardization, as appropriate.