text: We are currently working with outside counsel to further develop a formal cybersecurity incident response plan as a part of our review of and improvements to the Company's cybersecurity policies.

companyName: CorMedix Inc.

ticker: CRMD


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. That said, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Riley Exploration Permian, Inc.

ticker: REPX

secItem: Item 1C


text: Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthen our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Executive Vice President – Business Intelligence and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.

stage1Category: Board Governance

stage1Method: majority


text: As a matter of process, the Nominating and Corporate Governance Committee annually reviews, and recommends to the Board of Directors its approval of, our information security policy and cybersecurity program and our incident response plans. Furthermore, on an annual basis, the Board of Directors and its Committees review and discuss our technology strategy with our Executive Vice President – Business Intelligence and approve our technology strategic plan.


text: Role of our Management Team Our Executive Vice President - Business Intelligence is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and its internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.

stage1Category: Management Role

stage1Method: unanimous


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Information Security Officers, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.

stage1Category: Risk Management Process


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Executive Vice President of Business Intelligence has over 10 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 10 years of professional experience in the information security area.


text: Additionally, our management team's internal cybersecurity risk management and strategy processes are supported with third party consultants with extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board of Directors, Nominating and Corporate Governance Committee and Audit Committee, as the case may be, on any appropriate items.


text: We also have an incident response plan that provides procedures for how we can detect, respond to, and recover from potential cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate any incident, as well as to comply with any applicable legal obligations and mitigate potential brand and reputational damage.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Cybersecurity Risk Management and Strategy Riley Permian recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, harm to our employees, suppliers or industry partners, intellectual property theft, fraud, extortion, and violation of data privacy or security laws. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices for identifying and managing cybersecurity risks within our operations, infrastructure and corporate resources.


text: Our cybersecurity program is built upon internationally recognized frameworks and maps to standards published by The National Institute of Standards and Technology ("NIST CSF"), which develops cybersecurity standards, guidelines, best practices and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Utilizing monitoring technologies in conjunction with a well-established framework of policies, procedures and controls, our processes provide us with the structure to detect and respond to cyber threats, thereby mitigating the risk of potential cybersecurity issues. In addition, we conduct reoccurring security awareness training, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.


text: We have developed a robust cyber incident response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across a cross-disciplinary team of employees, legal counsel and third party service providers. Our information security team, which is part of our IT department, constantly monitors threat intelligence feeds, handles vulnerability management, responds to incidents and reports to the Information Security Coordinator. Upon detection of an event that meets certain assessment thresholds, the Information Security Coordinator reports such matters to the Incident Response Team, who then review the event and report to senior management, the cyber committee or our Board as appropriate. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: Internally, we have developed a cybersecurity awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For example, we have engaged a multifaceted cybersecurity advisory firm specializing in risk management and compliance, to perform annual cybersecurity risk assessments utilizing industry standard cybersecurity frameworks.


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of our cybersecurity incident response readiness and reporting through tabletop exercises.


text: Cybersecurity Governance - Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthens our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Chief Information and Compliance Officer and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.


text: Cybersecurity Governance - Role of our Management Team Our Chief Information and Compliance Officer is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and our internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Chief Information and Compliance Officer has over 11 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 11 years of professional experience in the information security area.


text: Risk Management and Strategy As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.

companyName: OPEN TEXT CORP

ticker: OTEX


text: OpenText has a cross-functional incident response team, led by our cybersecurity team and comprised of representatives from our information technology, cybersecurity, finance, and legal teams. The cybersecurity team primarily is responsible for the monitoring and assessment of potential cybersecurity occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of the Company and our customers information assets.


text: To manage against existing conduct and new cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The procedures are also designed to escalate incidents to appropriate members of management to guide the detection, response, and recovery from a material cybersecurity incident. To address cybersecurity threats, cybersecurity intelligence, as well as responding to cyber-related incidents, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.

companyName: AMEREN CORP

ticker: AEE


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan. We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of the Company and its customers data and information management infrastructure. We have also implemented a review process to assess the security profile and data protection practices of third-party service providers that have exposure to our systems. We review and update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our internal audit department has a team responsible for IT and information security (including cybersecurity) audits. We also engage third-party cybersecurity consultants to conduct additional audits of our cybersecurity processes, provide assessments of our risk management programs and identify potential cybersecurity vulnerabilities. Our cybersecurity efforts also include mandatory training for all employees and contractors on OpenText's security and privacy policies as well as other ancillary trainings on topics such as phishing emails and other social engineering tactics.


text: In Fiscal 2024, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Our Board of Directors is responsible for monitoring and assessing the Company's cybersecurity risk management as part of its overall responsibility of risk oversight. The Board's Audit Committee is responsible for overseeing risks related to our accounting, financial statements and financial reporting process, including the Company's cybersecurity incident materiality assessment and relevant disclosures. For more information, see Part III, Item 11, "Board's Role in Risk Oversight."


text: Our Chief Information Security Officer (CISO) is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.


text: Risk Management and Strategy As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.


text: Ameren employs a third-party cybersecurity risk management program, which extends the governance elements of Ameren's cybersecurity program, in addition to other diligence measures, to our critical third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.

stage1Category: Third-Party Risk


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: Rising Dragon Acquisition Corp.

ticker: RDAC

stage1Category: None/Other


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan. We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of the Company and its customers data and Information Management infrastructure. We have also implemented a review process to assess the security profile and data protection practices of third-party service providers that have exposure to our systems. We review and update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our internal audit department has a team responsible for IT and information security (including cybersecurity) audits. We also engage third-party cybersecurity consultants to conduct additional audits of our cybersecurity processes, provide assessments of our risk management programs and identify potential cybersecurity vulnerabilities. Our cybersecurity efforts also include mandatory training for all employees and contractors on OpenText's security and privacy policies as well as other ancillary trainings on topics such as phishing emails and other social engineering tactics.


text: In Fiscal 2025, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.


text: Our current Chief Information Security Officer (CISO) has over 20 years of experience architecting and directing global information security functions and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. Our CISO is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO receives ongoing communication from relevant teams related to cybersecurity and is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.


text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact in order to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of senior-level Ameren officers, with Ameren board of directors' oversight, oversees Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, that is dedicated to the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, practices, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents and information or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Customer and Technology Officer, the Chief Information Officer, the Chief Information Security Officer, and other members of senior management regarding Ameren's cybersecurity program and key initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. Ameren's board of directors is also regularly updated on its cybersecurity program. In addition, the board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.


text: We measure our cybersecurity effectiveness through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures around the effectiveness of our cybersecurity controls, our ability to manage cybersecurity events and incidents, cybersecurity incident response exercises, and results of our recurring internal assessments, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control performance, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers and the Cybersecurity and Digital Technology Committee.


text: Ameren also deploys a third-party cybersecurity risk management program, which extends the governance elements described above to our third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.


text: We are not aware of any cybersecurity events that have materially affected or are reasonably likely to materially affect Ameren, including our business strategy, results of operations, financial position, or liquidity.


text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported, and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of executive management and senior-level Ameren officers, with Ameren board of directors' oversight, oversees and governs Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, which is focused on the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, procedures, processes, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Information Security Officer, the Chief Information Officer, executive management, and other members of senior management who collectively maintain the responsibility for both the execution and ongoing management of Ameren's cybersecurity program and respective initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses over 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. In addition, Ameren's board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.


text: To manage against existing and emerging cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are continuously tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The plans and procedures are also designed to escalate incidents to appropriate members of management to guide the prevention, detection, response, recovery, and remediation from a material cybersecurity incident. These cybersecurity plans and procedures are positioned to promote the expedient identification, escalation, handling and reporting of a potentially material cybersecurity event or incident. To address cybersecurity threats, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.


text: We leverage common and widely accepted external cybersecurity risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity framework, to assess, guide, and enhance our cybersecurity posture. Our program effectiveness is measured through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures on the effectiveness of our cybersecurity controls across core National Institute of Standards and Technology Cybersecurity framework functions (Govern, Identify, Protect, Detect, Respond, and Recover), our ability to manage first- and third-party cybersecurity events and incidents, cybersecurity incident response exercises, results of our recurring internal assessments, vulnerability assessments, penetration tests, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control design and implementation, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee.


text: We have established controls for identifying, assessing and managing material risks from cybersecurity threats that could adversely affect our information systems or the information residing on those systems. These include a combination of policies, procedures, technologies and safe-guards (based on frameworks such as Cybersecurity Maturity Model Certification ("CMMC") and Payment Card Industry ("PCI") that are designed to prevent, detect, and mitigate data loss, theft, misuse, unauthorized access, and other security incidents or vulnerabilities affecting our systems and data, and to assess and evaluate the risk of such incidents and vulnerabilities. Additionally, we have processes in place designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including our cloud computing platforms.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: As part of our risk management process, we conduct application security assessments, security audits, third-party penetration testing, vulnerability assessments and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. Associates of the Company complete an annual cybersecurity training program in which specific threats and scenarios are highlighted based on the cyber risk management team's analysis of current cyber risks to the Company or as required by regulatory frameworks. Simulated phishing tests are conducted with associates on a regular basis to provide training and awareness against scams and fraudulent communications. Associates also receive ongoing communications regarding the importance of guarding against phishing, social engineering and other cyberattack vectors. In addition to our in-house cybersecurity capabilities, at times, we also engage consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risks. We maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks.


text: Our cyber management team, led by our Vice President of Information Security, is tasked with implementing and maintaining centralized cybersecurity and data protection practices in close coordination with MSC's leadership team and other teams across the Company. Our Vice President of Information Security has extensive cybersecurity knowledge and skills gained from over 25 years of work experience across multiple verticals. Reporting to our Vice President of Information Security are a number of experienced information security professionals responsible for various parts of our business, including Architecture and Engineering, Identity and Access Management, Security Operations, and Governance, Risk and Compliance programs, each of which is supported by a team of trained cybersecurity professionals.


text: The Audit Committee of our Board of Directors (the "Audit Committee") oversees our financial and risk management policies, including risk management policies and programs related to cybersecurity designed to monitor, mitigate and respond to cyber risks, threats, and reports. The Audit Committee receives regular reports from the Vice President of Information Security on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging cyber threat landscape. Additionally, the Audit Committee has engaged a consulting firm to serve in the role of a cybersecurity advisor to the Audit Committee. In fulfilling this role, the consultant will engage with the Vice President of Information Security and other associates of the Company to evaluate the Company's cybersecurity maturity and advise the Audit Committee on cybersecurity gaps, best practices and industry trends on an ongoing basis.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy. We maintain a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. This program is to ensure that cybersecurity considerations are included in decision-making processes throughout the Company.

companyName: Tenon Medical, Inc.

ticker: TNON


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Report.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information regarding our Affiliates and their clients, and have adopted policies, management oversight, accountability structures, and technology processes designed to safeguard this information. All of our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the AMG data and systems to which they have access. These trainings also instruct employees on how to report any potential privacy or data security issues.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive AMG data. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer ongoing cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.


text: We work with third-party service providers to proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee"). Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.


text: We take a risk-based approach to cybersecurity and have implemented policies throughout our operations that are designed to address cybersecurity threats and our response to actual or suspected incidents. In particular, the Information Security Governance Committee is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If a cybersecurity incident occurs, the Information Security Governance Committee will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate, and assess the materiality of the nature, scope, and timing of a given incident and whether public disclosure is required.


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.


text: Risk Management and Strategy Our cybersecurity risk management program is integrated into our overall risk management framework. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: We contract with external firms to assess our cyber security controls relative to our peers using the NIST CSF. We also have a third-party risk management program that assesses risks from vendors and suppliers. In addition, we maintain a Business Continuity and Disaster Recovery Plan as well as a cybersecurity insurance policy.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security and have increased scrutiny of third-party service providers with access to sensitive AMG data, including through security risk assessments at the time of initial contract, periodically as part of our third-party risk management process, and upon detection of an increase in the vendor's risk profile. In addition, we require key providers to meet appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party providers, as appropriate. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place designed to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition.


text: Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee").


text: Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security, including serving as our CIO since 2016, and holds a B.A. in Business with a focus in Computer Science. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: Management Committee Oversight The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, and Cybersecurity. These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions. All Information Security activity is led by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board. The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications. Management provides cybersecurity statistics and details to the board monthly.


text: Board Committee Oversight The Company's Risk and IT Board Committees provide oversight of the cyber program. Each committee consists of Board members, chaired by an independent director. Committee members have extensive expertise in various disciplines, including risk management, communications, information technology, litigation, banking and transactional matters, regulatory compliance, and cybersecurity. Board Committees receive regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to both committees and Key Risk Indicators are reported to the Risk Committee.


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company's and client's information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Management Committee Oversight The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, IT Governance, and Cybersecurity. These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions. All Information Security activity is led by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board. The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications. Management provides cybersecurity statistics and details to the board monthly.


text: Board Committee Oversight The Company's Risk and IT Board Committees provide oversight of the cyber program. Each committee consists of Board members, chaired by an independent director. Committee members have extensive expertise in various disciplines, including risk management, communications, information technology, litigation, banking and transactional matters, regulatory compliance, and cybersecurity. Board Committees receive regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to both committees and key risk indicators are reported to the Risk Committee.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: Risk Management and Strategy In connection with our enterprise risk management process, we identify, prioritize, monitor and seek to ameliorate key risks that may affect the Company, including risks from or relating to cyber threats. We have enterprise-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures with respect to our information technology systems, including with respect to the protection of our customer data, vendor data and employee information. We have also implemented specialized training and education programs to seek to guard against cybersecurity events, such as enterprise-wide communications, presentations, phishing simulations and focused training for specific roles, as well as a general cybersecurity training program required for all employees. We also engage third parties to perform regular reviews of our security framework controls to promote objectivity. Our processes to identify, assess and manage material risks relating to cyber threats include risks associated with third party service providers, including cloud-based platforms. We believe that these policies and controls provide us with an appropriate comprehensive assessment of potential cyber threats.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: To date, risks from cybersecurity threats have not materially affected the Company, and we do not believe these threats are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operations. However, the risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect our systems against all such threats and incidents. Refer to Item 1A – Risk Factors under the heading "Our business operations may be adversely affected by information technology systems interruptions or intrusion" for additional information.


text: Our cybersecurity program is overseen by a cross-functional committee of senior business leaders and is led by our Senior Vice President of Information Services and Chief Digital Officer (CDO). This management committee meets regularly and is charged with overseeing our cybersecurity strategy, seeking to ensure that cyber risks relating to the Company and its operations are managed, and that the program is aligned with the Company's business goals and objectives. The CDO has a formal education in information technology as well as extensive experience working in the Company's information and technology function; and receives periodic training and education on cybersecurity-related topics.


text: The Board of Directors has delegated to the Audit Committee to assist the Board of Directors in fulfilling its oversight responsibilities on cybersecurity matters. The Audit Committee oversees a number of the Company's risk management practices, including those relating to cybersecurity risks. Our CDO provides updates on cybersecurity risks, threats, key developments in Company policies and practices, and related risk exposures to the Audit Committee regularly. A member of the Audit Committee will then brief the full Board of Directors on items discussed within the Audit Committee, including cybersecurity risks and related matters. Additionally, management provides an update to the full Board of Directors on cybersecurity matters at least once a year, and more often as needed. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and while additional measures are continually deployed to mitigate risks and protect our systems, the risk of a breach continues to increase. To address this increased risk we are continually enhancing our Disaster Recovery and Business Continuity capabilities enabling system and data recovery and reducing the overall length our systems would be unavailable for normal operations.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • development of a multi-year cybersecurity roadmap and prioritization rubric based on risk; • a contracted third-party security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents and (4) actively monitoring for threats; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Senior Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes 25+ years of information management, governance and security controls for Fortune 500 organizations.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • development of a multi-year cybersecurity roadmap and prioritization rubric based on risk; • a contracted third-party security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents and (4) actively monitoring for threats; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks, including reports of external service providers relating to testing. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Technology, leveraging information and analysis from external experts as part of the Board's continuing education on topics that impact public companies.


text: The Senior Vice President of Information Technology leads an internal team that is responsible for assessing and managing our material risks from cybersecurity threats. The Information Technology team has primary responsibility for our overall cybersecurity risk management program and engages our retained external cybersecurity consultants as needed. The Information Technology team has also developed incident response playbooks that would be put into effect in the event of a Cyber Security incident and have exercised these playbooks in tabletop exercises with our external Cyber Security experts. The Senior Vice President of Information Technology has 25+ years of information management, governance, architecture and security controls management at Lifecore and other Fortune 500 organizations.


text: Our Information Technology team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy The Company takes very seriously the responsibilities to protect sensitive information, technology resources, and shareholder value from the risk of cyber threats and incidents.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: The Company maintains an enterprise-wide and Board-approved Information and Cyber Security Program (the "Program"), which includes strategy, written policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards and in compliance with applicable federal and New York state laws, regulations and guidelines.


text: The Company has adopted the Factor Analysis for Information Risk (FAIR) assessment approach, an industry standard risk assessment methodology. Under the FAIR approach, the Company identifies, catalogs, assesses and manages material cyber risks by: (a) documenting threat actors and organizations (i.e., cybercriminals, nation state actors, hackers, company insiders), (b) analyzing their likelihood of attack, their motives, capabilities and tactics; (c) assessing the potential impacts of such threat actor attacks against company assets, and documented vulnerabilities (or cyber exposures), both internally and externally of the organization; and (d) evaluating the implemented security controls and effectiveness of those controls against defined risk scenarios. The Company rates vulnerabilities based on the criticality of a vulnerability and/or the value of the asset associated with the vulnerability (people, systems, customer data, money). When a residual risk exceeds the desired threshold set by the Board-defined risk appetite of the organization, additional controls are recommended and implemented to reduce the potential risk to an acceptable level and provide appropriate management of the cyber risk exposure.


text: Additionally, the Company leverages insights from independently-conducted penetration testing provided by external third-party assessors, as required by NY Department of Financial Services (DFS) cybersecurity regulations, to discover and evaluate potential vulnerabilities across the enterprise that should be contemplated within the overall cyber risk program. The Company also engages independent third-party auditors to provide additional subject matter expertise, as well as to perform comprehensive independent audits of the Program. Audits are conducted no less than annually to evaluate the effectiveness and maturity of the Program. Audits include a review of the cyber risk assessment process, security control effectiveness, and compliance with regulatory requirements.


text: To manage the risks identified, the company implements controls and tests those controls for effectiveness. The Company uses the Federal Financial Institutions Examination Council Cyber Assessment Tool (CAT), the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), the NYS DFS cybersecurity requirements and the Center for Internet Security (CIS) Critical Controls to help inform the Company of best practices for control implementation and potential risk mitigation opportunities that align with defined risk scenarios, and generally as a baseline for best practice control implementation.


text: As part of the Program, the Company has established policies and procedures to oversee, identify and mitigate material cybersecurity risks associated with the use of any third-party service providers. The Company evaluates and risk rates third-party relationships against a defined set of minimum-security requirements under its enterprise-wide Third-Party Risk Management program. Higher risk third party service providers are reviewed in more detail and as part of the continual due diligence process to ensure changes to the relationship and/or risk posture are identified and managed appropriately.


text: The Company is not aware of any cybersecurity incidents that have materially affected the Company, including its business strategy, results of operations or financial condition. For a discussion of cybersecurity threats that could materially affect the Company's business strategy, results of operations or financial condition, please see Item 1A. Risk Factors.


text: The Program is governed by the Board of Directors and specifically, the Audit and Risk Committee, as well as two management committees, the Enterprise Risk Management Committee ("ERMC") and the Technology and Information Security Committee ("TISC").


text: Annually, the Audit and Risk Committee reviews and recommends for approval to the Board the Information Security Policy, which outlines the roles, responsibilities, and objectives for the Program. On a quarterly basis, the Company's Information Security Officer presents the Company's cybersecurity report and related material for review by the Audit and Risk Committee and the Board. This report includes emerging risks, overall program effectiveness/status, cybersecurity incidents, staffing, risk exceptions, and recommended enhancements to the program, as applicable. Annually, the Information Security Officer provides security related education to the Board and Audit and Risk Committee.


text: The Company's Technology and Information Security Committee ("TISC") oversees the governance of the Company's enterprise technology and information security programs, including strategy, management principals, risk and compliance. The TISC reviews the policies, strategy, emerging topics, risks and general compliance of the programs to ensure they are adequate and sufficient to govern and manage the associated risk of the Company. The TISC coordinates and communicates with the Audit and Risk Committee on risk-related items through Company's Enterprise Risk Management Committee. The TISC provides a forum for advising and sharing information among members of the Company's senior leadership team and is compromised of Company risk owners with expertise across a wide range of financial, technical, operational, strategic, and cybersecurity skill sets. The TISC is co-chaired by the Chief Technology Officer, who is responsible for the enterprise-wide information technology program and the Information Security Officer, who is responsible for the enterprise-wide information security program. The Information Security Officer is a Certified Information Systems Security Professional (CISSP), with over 20 years of experience in a combination of information technology and information security roles. The Information Security Officer has over eight years of leadership experience in the field of information security, and holds a Bachelor's degree in Information Technology, with an Associate's degree in Computer Network Management.


text: The Program includes a Security Response Team ("SRT") assigned the responsibility to ensure the Company responds to, communicates and effectively remediates, isolates and restores business operations during any security incident. The SRT procedures are derived from the National Institute of Standards and Technology (NIST) Computer Security and incident Handling framework.


text: The Enterprise Risk Management Committee ("ERMC") is responsible for overall risk governance and management across Tompkins. As such, the committee reviews cyber risk exceptions, emerging risks, minutes from the TISC meetings, and reports on the health and risk associated with the Program. The ERMC is comprised of senior leadership team members as well as critical subject matter experts with risk management experience. The ERMC reports information about risk to the Audit and Risk Committee on a quarterly basis. The ERMC is chaired by the Director of Enterprise Risk Management and the Chief Risk Officer, who oversees the governance of enterprise-wide Risk Management program(s).


text: The Company maintains an enterprise-wide and Board-approved Information and Cyber Security Program (the "Program"), which includes strategy, written policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards and in compliance with applicable federal and New York state laws, regulations and guidelines. As discussed in further detail under the subheading "Governance" below, the Program is fully integrated with the Company's overall enterprise risk management systems and processes.


text: The Company has adopted the Factor Analysis for Information Risk (FAIR) assessment approach, an industry standard risk assessment methodology. Under the FAIR approach, the Company identifies, catalogs, assesses and manages material cyber risks by: (a) documenting threat actors and organizations (i.e., cybercriminals, nation state actors, hackers, company insiders), (b) analyzing their likelihood of attack, their motives, capabilities and tactics; (c) assessing the potential impacts of such threat actor attacks against company assets, and documented vulnerabilities (or cyber exposures), both internally and externally of the organization; and (d) evaluating the implemented security controls and effectiveness of those controls against defined risk scenarios. The Company rates vulnerabilities based on the criticality of a vulnerability and/or the value of the asset associated with the vulnerability (for example, people, systems, customer data, or money). When a residual risk exceeds the desired threshold set by the Board-defined risk appetite of the organization, additional controls are recommended and implemented to reduce the potential risk to an acceptable level and provide appropriate management of the cyber risk exposure.


text: In conjunction with the FAIR assessment, the Company uses the MITRE Attack framework to identify the various exploitation techniques and tactics used by the most likely threat actors. This framework informs the risk management process with valuable insight into some of the most common, or likely, cyber-attacks the Company should address.


text: Additionally, the Company leverages insights from independently-conducted penetration testing provided by external third-party assessors, as required by the NYSDFS cybersecurity regulations, to discover and evaluate potential vulnerabilities across the enterprise that should be contemplated within the overall cyber risk program. The Company also engages independent third-party auditors to provide additional subject matter expertise, as well as to perform comprehensive independent audits of the Program. Audits are conducted no less than annually to evaluate the effectiveness and maturity of the Program. Audits include a review of the cyber risk assessment process, security control effectiveness, and compliance with regulatory requirements.


text: To manage the risks identified, the Company implements controls and tests those controls for effectiveness. The Company uses the Federal Financial Institutions Examination Council Cyber Assessment Tool (CAT), the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), the NYSDFS cybersecurity requirements and the Center for Internet Security (CIS) Critical Controls to help inform the Company of best practices for control implementation and potential risk mitigation opportunities that align with defined risk scenarios, and generally as a baseline for best practice control implementation.


text: As part of the Program, the Company has established policies and procedures to oversee, identify and mitigate material cybersecurity risks associated with the use of any third-party service providers. The Company evaluates and risk rates third-party relationships against a defined set of minimum-security requirements under its enterprise-wide Third-Party Risk Management program. Higher-risk third party service providers are reviewed in more detail and as part of the continual due diligence process to ensure changes to the relationship and/or risk posture are identified and managed appropriately.


text: Annually, the Audit and Risk Committee reviews and recommends for approval to the Board the Company's Information Security Policy, which outlines the roles, responsibilities, and objectives for the Program. On a quarterly basis, the Company's Chief Information Security Officer ("CISO") presents the Company's cybersecurity report and related material for review by the Audit and Risk Committee and then by the Board. This report includes emerging risks, overall program effectiveness/status, cybersecurity incidents, staffing, risk exceptions, and recommended enhancements to the program, as applicable. Annually, the CISO provides security related education to the Board and to the Audit and Risk Committee.


text: Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the ELT and the FactSet Board of Directors (the "Board"). We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: The TISC oversees the governance of the Company's enterprise technology and information security programs, including strategy, management principles, risk and compliance. The TISC reviews the policies, strategy, emerging topics, risks and general compliance of the programs to ensure they are adequate and sufficient to govern and manage the associated risk of the Company. The TISC coordinates and communicates with the Audit and Risk Committee on risk-related items through the Company's Enterprise Risk Management Committee. The TISC provides a forum for advising and sharing information among members of the Company's senior leadership team and is comprised of Company risk owners with expertise across a wide range of financial, technical, operational, strategic, and cybersecurity skill sets. The TISC is co-chaired by the Chief Technology Officer, who is responsible for the enterprise-wide information technology program and the CISO, who is responsible for the enterprise-wide information security program. The CISO is a Certified Information Systems Security Professional (CISSP), with over 20 years of experience in a combination of information technology and information security roles. The CISO has over nine years of direct leadership experience in the field of information security, and holds a Bachelor's degree in Information Technology, with an Associate's degree in Computer Network Managemen t.


text: The ERMC is responsible for overall risk governance and management across Tompkins. As such, the ERMC reviews cyber risk exceptions, emerging risks, minutes from the TISC meetings, and reports on the health and risk associated with the Program. The ERMC is comprised of senior leadership team members as well as critical subject matter experts with risk management experience. The ERMC reports information about risk to the Audit and Risk Committee on a quarterly basis. The ERMC is chaired by the Director of Enterprise Risk Management and the Chief Risk Officer, who oversees the governance of enterprise-wide Risk Management program(s).


text: Cybersecurity Risk Management, Strategy, and Governance Cybersecurity is a critical component of our operational integrity and strategic planning. Recognizing the evolving nature of cyber threats, we are committed to implementing robust cybersecurity measures to safeguard our digital assets, protect stakeholder interests, and ensure continuity of our operations.

companyName: INNOVATE Corp.

ticker: VATE


text: Cybersecurity Risk Management Processes Our approach to managing cybersecurity risks is proactive and comprehensive. We employ a range of methods to assess, identify and manage the risk of potential cybersecurity threats, including regular security audits, utilization of a third party service provider for security measures over our virtual environment, threat intelligence monitoring, and vulnerability assessments. Our risk management framework is designed to mitigate potential cyber risks through a blend of technological safeguards, employee training programs, and incident response protocols.


text: Cybersecurity Strategy and Investment Our cybersecurity strategy is integral to our broader risk management policy. We invest in state-of-the-art cybersecurity technologies and infrastructure to enhance our defensive capabilities and have a dedicated system of internal controls in place to prevent, monitor and remediate cyber risks including any risks from utilization of third party service providers. Additionally, we allocate resources for ongoing staff training and awareness programs to foster a culture of cybersecurity mindfulness across the organization and maintain dedicated channels of communication with our third party service provider monitoring our virtual environment to facilitate timely cyber incident identification and remediation. Our strategic investments in cybersecurity are tailored to address the unique challenges and risks pertinent to our industry and operational scope.


text: Governance and Oversight The governance of our cybersecurity efforts is overseen by the Audit Committee, which includes individuals with experience in technology and cybersecurity. The board regularly reviews and guides our cybersecurity policies and practices. Management plays a critical role in implementing these policies and in the day-to-day management of cybersecurity risks. They are empowered with the maintenance, communication and enforcement of cybersecurity policies and employ proactive measures to improve cyber security through review of various third party cyber tools for potential implementation. Our Head of IT and CFO are responsible for overseeing the implementation of cybersecurity strategies and ensuring compliance with regulatory standards. In addition to our in-house expertise, the Company employs independent external auditors and an outsourced internal audit team, who regularly test and asses our cybersecurity controls. Any cyber incidents that occur are escalated to the CFO to facilitate resolution. Any incident determined to be material is discussed with the Audit Committee and communicated to the company's internal and external auditors as well as the company's third party virtual environment service provider, when relevant).


text: Material Effects of Cybersecurity Risks Our business strategy, results of operation and financial condition have been not been materially affected by risks from cybersecurity threats, nor did we experience any significant cybersecurity incidents in 2023. However, we cannot provide assurances that they will not be materially affected by such risks or material incidents in the future. We continually assess the material effects of potential cybersecurity risks on our financial and operational performance and maintain comprehensive insurance coverage to mitigate financial losses from potential cybersecurity incidents.


text: Compliance and Regulatory Considerations Our cybersecurity practices are in alignment with industry standards and regulatory requirements. We conduct regular reviews to ensure compliance with evolving cybersecurity laws and regulations. There have been no legal or regulatory proceedings related to cybersecurity against the company in the reported period. We intend to further enhance our cybersecurity measures in response to the dynamic cyber threat landscape. This includes investing in advanced security technologies, refining our risk assessment methodologies, and continuing our commitment to staff training and development in cybersecurity awareness and best practices.


text: Cybersecurity Risk Management Processes Our approach to managing cybersecurity risks is proactive and comprehensive. We employ a range of methods to assess, identify and manage the risk of potential cybersecurity threats, including regular security audits, utilization of a third party service provider for security measures over our virtual environment, threat intelligence monitoring, and vulnerability assessments. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data. Our risk management framework is designed to mitigate potential cybersecurity risks through a blend of technological safeguards, employee training programs, and incident response protocols. We devote resources to maintain and regularly update our systems and processes that are designed to protect the security of our computer systems, software, networks and other technology assets against attempts by unauthorized parties to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and we have implemented certain review and approval procedures internally and with our banks; and have implemented system-wide changes.


text: Governance and Oversight The governance of our cybersecurity efforts is overseen by the Audit Committee, which includes individuals with experience in technology and cybersecurity. The board regularly reviews and guides our cybersecurity policies and practices. Management plays a critical role in implementing these policies and in the day-to-day management of cybersecurity risks. They are empowered with the maintenance, communication and enforcement of cybersecurity policies and employ proactive measures to improve cybersecurity through review of various third party cyber tools for potential implementation. Our Head of IT and Chief Financial Officer ("CFO") are responsible for overseeing the implementation of cybersecurity strategies and ensuring compliance with regulatory standards. In addition to our in-house expertise, our independent external auditors and our outsourced internal audit team, regularly test and asses our cybersecurity controls. Any cyber incidents that occur are escalated to the CFO to facilitate resolution. Any incident determined to be material is discussed with the Audit Committee and communicated to our internal and external auditors as well as our third party virtual environment service provider, when relevant.


text: Material Effects of Cybersecurity Risks Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats or incidents. However, we cannot provide assurances that they will not be materially affected by such risks or material incidents in the future. We continually assess the material effects of potential cybersecurity risks on our financial and operational performance and maintain comprehensive insurance coverage to mitigate financial losses from potential cybersecurity incidents.