text: We have experienced cybersecurity incidents in the past and, while none of these cybersecurity incidents resulted in a material disruption to our business, we may experience additional cybersecurity incidents in the future. As of the filing of this Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, refer to "Risks Relating to Our Business – A major failure of our information systems could harm our business; increased cybersecurity threats and more sophisticated and targeted cybersecurity attacks could pose a risk to our systems, networks and products." in "Item 1A. Risk Factors" within this Form 10-K.


text: The Board of Directors of the Company (the "Board") is presented with a cybersecurity update quarterly which is integrated within our TriMas Incident Response Plan. The Board reviews the Company's ERM process, including the design of the program, the key risks identified and the actions identified to manage and reduce those risks. Consistent with this undertaking, the Board regularly reviews the Company's cybersecurity strategy and activities in support of the strategy. As part of its compliance oversight responsibilities, the Audit Committee of the Board (the "Audit Committee") is responsible for the review of compliance with laws, regulations and internal policies and procedures of our information and cybersecurity programs. The Board and the Audit Committee receive updates from management quarterly on information and cybersecurity status and enhancements. Additionally, prompt notification of the Board is integrated into the Incident Response Plan.

companyName: TRIMAS CORP

ticker: TRS

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Cybersecurity Risk Management and Strategy We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and containment. The Company has other policies and procedures which directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption standards, antivirus protection, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices.

companyName: ACCESS Newswire Inc.

ticker: ACCS

stage1Category: Risk Management Process


text: Our information technology security professionals who work closely with our Chief Technology Officer ("CTO") who is responsible for the detection and initial assessment of cybersecurity threats and incidents (collectively, "cyber incidents"), whether internal or experienced by significant third-party service providers, using, among other means, third-party software. The team classifies detected cyber incidents based on potential impact to the functionality of the affected systems, possible or known information involved, and recoverability effort. The classification of a cyber incident is designed to allow rapid prioritization, response, and escalation. The CTO and Chief Executive Officer ("CEO") are alerted as to any detected cyber incident that is potentially significant. Incidents are documented for regular internal reporting processes including notations and considerations of related attacks.

stage1Method: majority


text: The CTO and CEO are required to engage the cybersecurity incident review if a cyber incident has materially affected, or is reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. The CTO and CEO are responsible for performing a materiality assessment, and overseeing the public disclosure of material cybersecurity matters, as appropriate.

stage1Category: Management Role


text: We deploy quarterly cybersecurity training for employees and consider this a critical step in safeguarding the Company's data and assets. The training provides employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training techniques to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and includes interactive modules covering various areas, including insider attacks, phishing and email attacks, preventing malware attacks, data protection, data handling, passwords, cloud and internet security, and cybersecurity fundamentals for mobile devices.


text: Like other major corporations, we are the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "If we fail to keep our customers' information confidential or if we handle their information improperly, our business and reputation could be significantly and adversely affected" in Item 1A. Risk Factors of this Annual Report.

stage1Category: Strategy Integration


text: Cybersecurity Governance Cybersecurity is a significant part of our risk management processes and an area of focus of our Board of Directors and management. Our CTO is primarily responsible for assessing and managing material risks from cybersecurity threats. Our CTO has six years of cybersecurity experience.


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CTO or CEO. Our CTO also presents his assessment of material risks from cybersecurity threats to the Board at least annually. If a cyber incident is reported to the Board of Directors, our Incident Response Plan is triggered which involves a number of immediate actions be initiated. The impact, if any, of cyber incidents on internal control over financial reporting is discussed with the full Board.


text: The independent members of the Board, through the Board's nominating procedures and requirements, considers cyber expertise in vetting nominees for the Board and recommending Board committee appointments.


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats which could result in information security breaches and significant disruption to our business. We have a multi-layer security approach including specialized hardware/software, access protocols, third-party assessments, and regular training. Our servers are hosted by a third-party that provides Service Organization Control (SOC) Type 1 and 2 reports annually with monthly bridge letters and hosts a separate disaster recovery site. Our Firewall, Virtual Private Network, Multifactor Authentication, Email Gateway, Antivirus software, file storage protection software, and other software applications help mitigate cybersecurity risks. Our IT Steering committee reviews our access protocols and systems biannually. Our third-party internal auditing firm provided an assessment of our system design and performed testing. Our IT consultant participates in our weekly operations meetings, requires cybersecurity training, and monitors the results of test phishing and credential harvesting emails.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of our board of directors.


text: Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining our business continuity plans, IT security policies and procedures, and providing regular reports to our board of directors, including through the Audit Committee. Our IT consultant monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of software tools, and regularly reports to management.


text: In 2023, we did not identify any cybersecurity events that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition.


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of our board of directors. Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: In 2024, we did not identify any cybersecurity events that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We are reliant on the continuous and uninterrupted operation of our various technology systems. User access to our sites and information technology systems are important elements of our operations, as are cloud security and protection against cyber incidents. In the ordinary course of our business, we collect and store sensitive data in our data centers and on our networks, including intellectual property, proprietary business information, critical operating information, information regarding suppliers, customers and business partners, including certain personally identifiable information. In addition, the information technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. Industrial control systems now control large-scale processes that can include multiple sites across long distances.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI

stage1Category: None/Other


text: To assess, identify and manage material cybersecurity risks, we have endeavored to implement procedures, standards, and technical controls with the aim of protecting our networks and applications. We use internal and third-party tools and technologies to aid us in seeking to protect our network and internal systems from unauthorized access, intrusion, or disruption, including those described below.


text: Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities. These assessments may include one or a combination of penetration testing, security audits, incident response planning, vendor risk assessments, and regulatory compliance assessments. Feedback from our maturity and technical assessments is incorporated into our systems and procedures through upgrades intended to further improve our security posture.


text: Availability: To preserve the availability of data and systems, we perform daily backups with some occurring multiple times a day. Additionally, to mitigate ransomware, data is stored in version-controlled file systems. When implementing systems, architectural patterns for redundancy and failover are used.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Incident Identification and Response A monitoring and detection system has been implemented to help identify cybersecurity incidents. Our network activity, logs, and system behavior are monitored for anomalous or unauthorized activity using threat detection technologies. In addition, we have a cross-functional incident response plan, which includes an executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of material cybersecurity risks. We assess and update our security procedures and controls in an effort to address evolving threats and comply with applicable laws and regulations. We perform cybersecurity tabletop exercises to test the effectiveness of our incident response plan and implement post-incident "lessons learned" to enhance our response.


text: Cybersecurity Training and Awareness Our cybersecurity program also focuses on providing training and awareness to our employees on cybersecurity best practices. Our training program includes computer-based training sessions assigned to employees and information sharing to educate employees on current cybersecurity-related topics. We also conduct phishing exercises to test and improve our employees' awareness and response to potential cyber threats.


text: User access controls are used to limit unauthorized access to sensitive information and critical systems. In addition, we require multi-factor authentication for some, but not all, accounts. Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions.


text: We engage assessors, consultants, auditors, and other third parties in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to specific security standards and protocols.

stage1Category: Third-Party Risk


text: Impact of Risks from Cybersecurity Threats We have experienced and expect to continue to experience cyber threats and incidents, though as of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, cybersecurity threats are continually evolving, and the possibility of future cyber incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company focuses on current and emerging cybersecurity matters. The Company's cybersecurity processes are led by the Vice President of Information Technology, who reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, our Vice President of Information Technology holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. Our Vice President of Information Technology has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by us.


text: Our Board of Directors and its Audit Committee oversee risks from cybersecurity threats. The Company's Vice President of Information Technology or Chief Financial Officer update the Audit Committee on our cybersecurity risk profile typically on a quarterly basis, and review with our Board of Directors at least annually.


text: Risk Management and Strategy Farmer Mac recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include the potential for: • unauthorized access to or acquisition, destruction, alteration, release, theft, or loss of confidential, proprietary, or personal data; • fraud or extortion; • financial and economic loss or costs; • errors in Farmer Mac's financial statements; • impairment of Farmer Mac's liquidity; • harm to employees, customers, or vendors; • liability or service interruptions to customers; • loss of customers or vendors; • violation of data protection laws and other litigation and legal risk; • increased regulatory or legislative scrutiny; and • reputational damage.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Farmer Mac's process to identify and assess material risks from cybersecurity threats operates alongside Farmer Mac's broader overall risk assessment process that contemplates all company risks. As part of this process, appropriate personnel collaborate with subject matter specialists, as necessary, to gather information to identify and assess material cybersecurity threat risks, their severity, and potential mitigations.


text: Farmer Mac has implemented a variety of processes, technologies, and controls to aid in its efforts to identify, assess, and manage cybersecurity risks. Farmer Mac's approach includes: • an enterprise risk management program that includes cybersecurity risk assessment and management and is periodically refreshed; • security reviews designed to identify risks from many new features, software, and vendors, including a security operations center to monitor our systems; • a team of trained and experienced security professionals to investigate and remediate cybersecurity incidents; • regular cybersecurity training for all employees and network users to raise and maintain awareness of cybersecurity risks and best practices; • a vulnerability management program designed to identify vulnerabilities in the systems and software Farmer Mac uses; • regular cybersecurity testing, including penetration testing on a periodic basis to allow security researchers to help identify vulnerabilities in Farmer Mac's systems before they mature into real-world cybersecurity threats; • a third-party service provider risk management program designed to identify and mitigate risks associated with third-party vendors and business partners, which includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate; • a threat intelligence program designed to model and research potential cybersecurity threat actors to identify vulnerabilities and anticipate attack vectors before they are exploited; • cybersecurity controls designed to segment access to systems and to limit access to sensitive data; and • patch management controls aimed at reducing system vulnerabilities. These processes vary in maturity across the business, and Farmer Mac works continually to improve them.


text: Farmer Mac also maintains a privacy and security incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents. That program includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any cybersecurity incident, as well as to comply with any applicable legal obligations and to mitigate brand and reputational damage. Farmer Mac also conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program. Farmer Mac's security operations center and incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to Farmer Mac's management team. If a cybersecurity incident is determined to be a material cybersecurity incident, Farmer Mac's incident response plan defines the process for any required regulatory disclosures.


text: Farmer Mac's risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of Farmer Mac's security controls. Prior cybersecurity incidents have not materially affected Farmer Mac's business strategy, results of operations, or financial condition. Farmer Mac does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect its business strategy, results of operations, or financial condition, although the occurrence of both intentional and unintentional incidents could cause a variety of adverse business impacts in the future. For more information on Farmer's Mac's cybersecurity risks see "Operational Risks" in "Risk Factors" in Part I, Item 1A of this report. Those disclosures are incorporated by reference in this section.


text: Farmer Mac's board of directors is actively involved in overseeing the company's cybersecurity risk management. At least once a year, the full board of directors meets with Farmer Mac's Chief Information Security Officer ("CISO") to discuss Farmer Mac's programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Farmer Mac's business strategy.


text: The board has created a dedicated cybersecurity subcommittee of the enterprise risk committee to oversee Farmer Mac's cybersecurity programs and practices, including the identification and mitigation of security and privacy risks. The cybersecurity subcommittee consists of three members of the enterprise risk committee. Two members of that subcommittee have successfully completed the National Association of Corporate Directors ("NACD") certificate in cyber-risk oversight program. The other member of the subcommittee is the CEO of an energy company and has direct experience managing cyber risk and cybersecurity incidents in that capacity. The chair of the board audit committee has also successfully completed the NACD certificate in cyber-risk oversight program (but is not a member of the cybersecurity subcommittee). The cybersecurity subcommittee typically meets on a monthly basis with the CISO and other members of Farmer Mac's management team to discuss the performance and effectiveness of Farmer Mac's cyber program and to receive updates on cybersecurity risks, any cybersecurity incidents, and major cybersecurity initiatives.


text: The materials provided to Farmer Mac's cybersecurity subcommittee and discussed in the meetings include: • updates on Farmer Mac's data security posture; • results from third-party assessments and testing; • progress towards predetermined risk-mitigation-related goals; • Farmer Mac's incident response plan; and • information about cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to those risks or incidents.


text: At each regular quarterly meeting of the board enterprise risk committee, the cybersecurity subcommittee reviews a summary of the information discussed in the most recent cybersecurity subcommittee meetings. The board of directors has determined that cybersecurity is a priority area of focus and regularly engages with the CISO and other members of senior management in substantial discussions in board and committee meetings to address cybersecurity topics relating to risk management, compliance, strategy, innovation, and governance. Material cybersecurity threat risks are also considered during separate board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, business transactions and acquisitions, and brand management.


text: Farmer Mac's CISO manages Farmer Mac's cybersecurity program, including the identification, evaluation, and prioritization of security risks, as well as the company's response to security incidents. The CISO has more than 19 years of experience in cybersecurity and information technology and holds a Master's degree in Business Administration with a focus on Information Technology. The CISO also holds a Certified Information Security Manager (CISM) certification, which is an advanced certification indicating that an individual possesses the knowledge and experience required to develop and manage an enterprise information security program. The CISO reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer, who in turn reports to the Chief Executive Officer.


text: Members of senior management have regular meetings with the CISO and other members of Farmer Mac's information technology team to discuss and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. The participants in these meetings also discuss their management of, and participation in, the cybersecurity risk management and strategy processes described in this report, including the operation of Farmer Mac's incident response plan. Farmer Mac provides quarterly cybersecurity training to all employees, board members, and users of Farmer Mac's technology assets. Employees with elevated privileges within the computing environment also receive specialized training tailored to their job responsibilities. Farmer Mac tracks the metrics from the cybersecurity training program and includes the results in dashboard reports shared and discussed with senior management, the board enterprise risk committee, and the board cybersecurity subcommittee.


text: Risk Management and Strategy Farmer Mac recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Farmer Mac's process to identify and assess material risks from cybersecurity threats operates alongside Farmer Mac's broader overall risk assessment process that contemplates all company risks. As part of this process, appropriate personnel collaborate with subject matter specialists, as necessary, to gather information to identify and assess material cybersecurity threat risks, their severity, and potential mitigations.


text: Farmer Mac has implemented a variety of processes, technologies, and controls to aid in its efforts to identify, assess, and manage cybersecurity risks. Farmer Mac's approach includes: • an enterprise risk management program that includes an annual cybersecurity risk assessment and management and is periodically refreshed; • security reviews designed to identify risks from many new features, software, and vendors, including a security operations center to monitor our systems; • a team of trained and experienced security professionals to investigate and remediate cybersecurity incidents; • regular cybersecurity training for all employees and network users to raise and maintain awareness of cybersecurity risks and best practices; • a vulnerability management program designed to identify vulnerabilities in the systems and software Farmer Mac uses; • regular cybersecurity testing, including third-party penetration testing on a periodic basis to allow security researchers to help identify vulnerabilities in Farmer Mac's systems before they mature into real-world cybersecurity threats; • a third-party service provider risk management program designed to identify and mitigate risks associated with third-party vendors and business partners, which includes pre-engagement diligence, risk assessments, contractual security and notification provisions, and ongoing monitoring, as appropriate; • a threat intelligence program designed to model and research potential cybersecurity threat actors to identify vulnerabilities and anticipate attack vectors before they are exploited; • cybersecurity controls designed to segment access to systems and to limit access to sensitive data, which controls are tested and updated regularly; • patch management controls aimed at reducing system vulnerabilities; and • a generative artificial intelligence policy that describes how users may utilize generative artificial intelligence tools in alignment with Farmer Mac's values, ethical standards, and legal requirements, while also safeguarding sensitive information. These processes vary in maturity across the business, and Farmer Mac works continually to improve them.


text: Farmer Mac also maintains a privacy and security incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents. That program includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any cybersecurity incident, as well as to comply with any applicable legal obligations (including to preserve evidence) and to mitigate brand and reputational damage. Farmer Mac also conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program. Farmer Mac's security operations center and incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to Farmer Mac's management team and board as appropriate. If a cybersecurity incident is determined to be a material cybersecurity incident, Farmer Mac's incident response plan defines the process for any required regulatory disclosures.


text: Farmer Mac's board of directors is actively involved in overseeing the company's cybersecurity risk management. At least once a year, the full board of directors meets with Farmer Mac's Chief Information Security Officer ("CISO") to discuss and approve Farmer Mac's programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Farmer Mac's business strategy.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: HARMONIC INC.

ticker: HLIT


text: The board has created a dedicated cybersecurity subcommittee of the enterprise risk committee to oversee Farmer Mac's cybersecurity programs and practices, including the identification and mitigation of security and privacy risks. The cybersecurity subcommittee consists of three members of the enterprise risk committee. The cybersecurity subcommittee typically meets on a monthly basis with the CISO and other members of Farmer Mac's management team to discuss the performance and effectiveness of Farmer Mac's cyber program and to receive updates on cybersecurity risks, any cybersecurity incidents, and major cybersecurity initiatives. The materials provided to Farmer Mac's cybersecurity subcommittee and discussed in the meetings may include updates about cybersecurity risks, controls, and assessments, including those from third parties. At each regular quarterly meeting of the board enterprise risk committee, the cybersecurity subcommittee reviews a summary of the information discussed in the most recent cybersecurity subcommittee meetings.


text: Farmer Mac's CISO manages Farmer Mac's cybersecurity program, which aligns to industry standards and is reviewed by the cybersecurity subcommittee and approved by the board enterprise risk committee annually, and which includes the identification, evaluation, and prioritization of security risks, as well as the company's response to security incidents. The CISO has more than 20 years of experience in cybersecurity and information technology and holds a Master's degree in Business Administration with a focus on Information Technology. The CISO also holds a Certified Information Security Manager (CISM) certification, which is an advanced certification indicating that an individual possesses the knowledge and experience required to develop and manage an enterprise information security program. The CISO reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer, who in turn reports to the Chief Executive Officer.


text: Members of senior management have regular meetings with the CISO and other members of Farmer Mac's information technology team to discuss and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. The participants in these meetings also discuss their management of, and participation in, the cybersecurity risk management and strategy processes described in this report, including the operation of Farmer Mac's incident response plan.


text: Dime Community Bank ("Dime", "the Bank") maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Dime's Cybersecurity Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recovery strategies to help mitigate the impact of a cybersecurity incident across all business lines. Management Role and Board Oversight.


text: The cybersecurity program is overseen by the Chief Information Security Officer ("CISO") reporting into the Chief Risk Officer ("CRO"), the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others, and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors. Our Board of Directors includes members who have expertise in cybersecurity, data privacy law, fraud and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards, and Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank's Risk Management function is led by the CRO, who has extensive experience in risk management and audit. The cybersecurity program includes a cross-sectional team of internal and external Information Security professionals, all of which are provided with relevant training and are required to maintain industry accredited certifications. Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Enterprise Risk Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, status of operational changes, status of regulatory compliance, and risk reporting.


text: Managing Material Risks & Integrated Overall Risk Management The Bank maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.


text: Cybersecurity Threats To assess and manage cybersecurity threats from material risks, Dime maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank's business strategy, results of operations, or financial condition by following implemented processes. Dime has not identified any cybersecurity threats that have materially affected operations or financial position.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Safehold Inc.

ticker: SAFE


text: Engagement With Third-Parties on Risk Management Cybersecurity is part of Dime's overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, Dime is a regulated entity and undergoes regulatory reviews to ensure the Bank remains in compliance with all appropriate standards.


text: The Bank maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.


text: The Bank's Cybersecurity Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recovery strategies to help mitigate the impact of a cybersecurity incident across all business lines. Management Role and Board Oversight.


text: The cybersecurity program is overseen by the Chief Information Security Officer ("CISO") reporting to the Chief Risk Officer ("CRO"); the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others; and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors. Our Board of Directors includes members who have expertise in cybersecurity, data privacy law, fraud and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards, Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank's Risk Management function is led by the CRO, who has extensive experience in risk management and audit. The cybersecurity program includes a cross-sectional team of internal and external Information Security professionals, all of which are provided with relevant training and are required to maintain industry accredited certifications. Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.


text: Cybersecurity Threats To assess and manage cybersecurity threats from material risks, the Bank maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank's business strategy, results of operations, or financial condition by following implemented processes. The Bank has not identified any cybersecurity threats that have materially affected operations or financial position.


text: Oversee Third-Party Risk The Bank has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank's Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.


text: Cybersecurity Risks The Bank considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by the Bank and third-party service providers, are critical to business operations and therefore require appropriate risk management.


text: Engagement With Third-Parties on Risk Management Cybersecurity is part of the Bank's overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, the Bank is a regulated entity and undergoes regulatory reviews to ensure it remains in compliance with all appropriate standards.


text: Our Chief Security and Trust Officer, who reports to our Executive Vice President, Operations, works collaboratively across our business to implement policies and procedures designed to protect our IT environment and our products and services from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with our incident response policies and procedures. Our Chief Security and Trust Officer has extensive cybersecurity experience and has served in various roles in information technology and information security for over 25 years.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Risk Management and Strategy Cybersecurity is a critical component of the Company's enterprise risk management program given the Company's extensive reliance on technology and increased and evolving risks from cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for the Company's information systems and cyber security program, which is designed to protect the confidentiality, integrity, and availability of our technology systems and data. The information systems and cyber security program is vital to protecting our customers, maintaining our reputation, and preserving shareholder value, as well as safeguarding the interests of other stakeholders. The CISO is a key member of the Company's risk management organization and reports directly to the Chief Risk Officer ("CRO") and, periodically, to the Risk Committee of the Board of Directors.

companyName: LAKELAND BANCORP INC


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cyber security program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, the program leverages certain industry and government associations, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.


text: The CISO and the Chief Information Officer ("CIO"), who oversees the Company's Information Technology functions and reports directly to the Chief Administrative Officer, along with key members of their respective teams, regularly collaborate with peer institutions, industry groups, consultants, and others to discuss cybersecurity trends and issues, emerging risks, and best practices. The information systems and cyber security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company's information systems and cyber security policy defines standards, specifies controls, and establishes management responsibilities with respect to identity and access management, authentication requirements, system and device hardening, network security, virus and malware protection, threat intelligence, security event logging and monitoring, endpoint protection, incident response, third-party information security, cybersecurity awareness and training, data backup and restoration, and program governance. In addition, the Company maintains complementary policies that similarly address standards, controls, and responsibilities pertaining to data classification and protection, acceptable use of information technology assets, vulnerability and patch management, business continuity and resilience, information technology lifecycle and asset management, change management, project management, and quality assurance.


text: The Company employs an in-depth, layered, defense strategy to mitigate information systems and cyber security risks. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls. The Company uses a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. Processes and systems designed to mitigate cybersecurity risks, including regular and on-going education and training for our associates, preparedness simulations and tabletop exercises, and recovery and resilience testing, have been established. The Company engages in regular assessments of our technology infrastructure, software systems, network architecture, and data repositories, including periodic penetration tests and vulnerability assessments and social engineering simulations performed by third-party specialists. Additionally, vulnerabilities are identified via the use of internally-managed automated scanning tools. Vulnerabilities identified via third-party assessments and internal scans, and the status of corresponding remediation efforts, are inventoried and tracked by the Information Security department, under the direction of the CISO, and regularly reported to management. Summarized results of external and internal assessments and related remediation efforts are reported to the Risk Committee on a quarterly basis.


text: The Company leverages internal auditors and independent external partners to periodically review processes, systems, and controls, including with respect to the Company's information systems and cyber security policy and program, to assess their design and operating effectiveness and make recommendations to strengthen the risk management program.


text: The Company also maintains a third-party risk management ("TPRM") program designed to identify, assess, and manage risks, including technology and cybersecurity risks, associated with vendors and other external service providers. The TPRM program defines standards and identifies management responsibilities relative to risk assessment, due diligence, contract review and structuring, and third-party oversight and ongoing monitoring; the program aligns with Interagency Guidance on Third-Party Relationships: Risk Management. The TPRM program is a second line function that is overseen by the Company's Operational Risk Manager, who reports directly to the CRO. The status of the TPRM program is reported to management on a regular basis and, periodically, to the Risk Committee.


text: Cybersecurity Governance Our Board of Directors and executive management team oversee cybersecurity risk. Our Chief Information Officer is responsible for day-to-day management of cybersecurity risk. Our Chief Information officer periodically provides reports to executive management and our Board (which receives a report at least annually) on information security, including cybersecurity risk and the prevention, detection, mitigation and remediation of cybersecurity incidents. Our executive management is notified of potentially material cybersecurity incidents according to our cybersecurity incident management procedures.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: The Company also maintains an Incident Response Program that establishes security incident response protocols, principally relevant to the Information Security and Information Technology teams, including identification, containment, recovery, and follow up related to security incidents. The Incident Response Program specifies when an incident is deemed a potential information security breach requiring escalation of handling in accordance with the Company's Crisis Communication Plan and Protocols. The Crisis Communication Plan and Protocols supplement the Incident Response Program and, although they may be used as general guidance with respect to a variety of incidents, they are designed to assist the incident response team in responding to an actual or possible systems or data breach incident. In connection with an incident involving an actual or possible systems or data breach, the Crisis Communication Plan and Protocols establish a cross-functional response team to identify incidents, determine whether systems or data have been compromised and, if so, initiate protocols to identify the extent of the incident, contain and mitigate any damage, communicate the incident to all necessary parties (including regulatory agencies and law enforcement agencies, as applicable), maintain the Company's brand integrity, sustain customer trust, and establish the foundation to recover from the incident and rebuild the Company's brand reputation.


text: The Company's Board of Directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from information systems and cyber security threats. The Risk Committee periodically receives presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party reviews, technological trends, and other cybersecurity related topics. The Risk Committee also receives information regarding any material cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been addressed. On a quarterly basis, the Risk Committee and the Board of Directors receive updates on key risk and key performance metrics related to the Company's information systems and cyber security posture with the Risk Committee receiving additional information regarding noncompliance with risk limits and associated remediation efforts. On at least an annual basis, the full Board of Directors discusses the Company's approach to information systems and cyber security risk management with the CISO.


text: The CISO is accountable for managing the Information Security department and the information systems and cyber security program. The responsibilities of Information Security include overseeing the design, implementation, ongoing enhancement, monitoring, and testing of the Company's information systems and cyber security program to ensure the confidentiality, availability, and integrity of information assets in accordance with applicable laws, regulations, and regulatory guidance. Information Security establishes appropriate standards for information system security and access, and develops and implements relevant policies, procedures, and controls to ensure such standards are maintained. The Information Security department has overall responsibility for security awareness and training programs, business continuity analysis and planning, and initial assessment and periodic monitoring of key third-party technology service providers, as well as data classification and risk assessments related to information and cyber security. Information Security also provides guidance on and participates in incident response planning and protocols.


text: The Information Technology department, under the direction of the CIO, is principally responsible for managing first line functions to protect and secure the Company's technology infrastructure, systems, and data. Second line functions, including Information Security under the direction of the CISO, provide guidance, oversight, monitoring and challenge of the first line's activities. Second line functions are separated from first line functions through organizational structure and ultimately report directly to the Chief Risk Officer. Information Security consists of information security professionals with varying degrees of education and experience. Associates within the department with information systems and cyber security related responsibilities and job duties typically hold professional certifications and regularly participate in continuing education in their field. The CISO has substantial relevant experience in information and data security, cybersecurity risk management, and information technology infrastructure and operations. The CISO has served in various roles in Information Security and Information Technology with the Company for over 30 years and maintains several professional affiliations, including serving as a member of the cybersecurity advisory board of a state university and as a member of the governing body of a cybersecurity peer exchange.


text: To our knowledge, cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition. With regard to the possible impact of potential future cybersecurity threats or incidents, refer to the section titled "Information Technology or Cybersecurity Risks" under Item 1A, Risk Factors.


text: Cybersecurity Governance Our board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The board carries out its risk oversight and management responsibilities by monitoring risk directly as a full board and, where appropriate, through its committees. Our board has delegated to the audit committee the oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The audit committee reports any material or notable cybersecurity incidents, findings and recommendations, as appropriate, to the full board for consideration. Our Chief Information and Innovation Officer ("CIIO") also presents to the audit committee and to the board, as appropriate, any updates, changes, or improvements on the Company's cybersecurity risk management program.

companyName: Lifevantage Corp

ticker: LFVN


text: Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program through our security steering committee, which is designed to assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. The members of our security steering committee represent the following functional areas: cybersecurity and infrastructure; corporate risk and privacy; personnel; and finance and fraud management. The security steering committee collaborates with and manages third parties, as appropriate, to assess the effectiveness of our cybersecurity prevention and response systems and processes. These third parties may include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. To protect our information systems from cybersecurity threats, we also ask our employees to take periodic cybersecurity training and we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: We have not identified risks from known cybersecurity threats to the business, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See our risk factor "We are subject to evolving laws, policies, and contractual obligations related to data privacy and security, including cybersecurity, and our actual or perceived failure to comply with such obligations or perceived failure to maintain the integrity of our data could expose us to data loss or litigation, harm our reputation, subject us to significant fines and liability, or otherwise affect our business, prospects, financial condition, and operating results." in Part I, Item 1A. ("Risk Factors") for additional details regarding cybersecurity risks and potential impacts on our business.


text: Cybersecurity Governance Our board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The board carries out its risk oversight and management responsibilities by monitoring risk directly as a full board and, where appropriate, through its committees. Our board has delegated to the audit committee the oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The audit committee reports any material or notable cybersecurity incidents, findings and recommendations, as appropriate, to the full board for consideration. Our Chief Technology Officer ("CTO") also presents to the audit committee and to the board, as appropriate, any updates, changes, or improvements on the Company's cybersecurity risk management program.


text: Our CTO, with over 28 years of experience in IT and operational technology security, has the primary responsibility of overseeing our cybersecurity risk management program and assessing and managing any material risks related to cybersecurity threats. Our CTO supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information systems personnel and reports produced by security tools deployed in the technical environment.


text: Our CIIO, with over 40 years of experience in IT and operational technology security, has the primary responsibility of overseeing our cybersecurity risk management program and assessing and managing any material risks related to cybersecurity threats. Our CIIO supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information systems personnel and reports produced by security tools deployed in the technical environment.


text: Cybersecurity risk management and strategy We maintain a cybersecurity program designed to protect our systems and data from information security risks, including regular oversight of our programs for security monitoring. Gen has a process for identifying and assessing material risks from cybersecurity threats on a regular basis that operates alongside our broader overall risk assessment process, covering all identified enterprise wide risks. Cybersecurity risk is reviewed quarterly with management and with the board of directors. In addition, we regularly perform evaluations (including independent third-party evaluations) of our security program and our information technology infrastructure and information security management systems. Our processes also address risk and identification of cybersecurity threat risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, reviewing security and controls reports, implementing contractual security and notification provisions, and ongoing monitoring as needed.

companyName: Gen Digital Inc.

ticker: GEN


text: Our information security management system is based upon industry frameworks. Our Chief Information Security Officer (CISO) leads our cybersecurity program, which includes the implementation of controls designed to align with these industry frameworks and applicable statutes and regulations. Our CISO has over 30 years of prior work experience in various roles involving managing information security programs, developing cybersecurity strategy, implementing effective information and cybersecurity initiatives and has been the Head of IT Audit, CISO and CIO at three other companies prior to Gen Digital. He has a Bachelor of Science in Computer Information Systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes periodic testing and is designed to restore business operations quickly. In addition, employees participate in mandatory annual training and receive communications regarding the cybersecurity environment to increase awareness throughout the company. We also implemented an enhanced annual training program for specific specialized employee populations, including secure coding training.


text: The Technology and Cybersecurity Committee of the Board has direct oversight to the Company's (1) technology strategy, initiatives, and investments and (2) key cybersecurity information technology risks against both internal and external threats. The Technology and Cybersecurity Committee is comprised entirely of independent directors, all of whom have experience related to information security issues or oversight and meets and reports to the Board on a quarterly basis. The Audit Committee, which is also comprised entirely of independent directors, considers cybersecurity information technology risks in connection with overseeing our enterprise risk management system, and reports to the Board on enterprise risk management matters on a quarterly basis. We have processes in place for management to report security instances to the Technology and Cybersecurity Committee and Audit Committee as they occur, if material, and to provide a summary multiple times per year of other incidents to the Technology and Cybersecurity Committee. Additionally, our CISO attends each Technology and Cybersecurity Committee meeting and meets regularly with the Board of Directors or the Audit Committee of the Board of Directors to brief them on technology and information security matters. We carry insurance that provides protection against some of the potential losses arising from a cybersecurity incident. In the last fiscal three years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our solutions, systems, websites and the data on these sources have been in the past and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales." included as part of "Risk Factors" in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity risk management and strategy We maintain a cybersecurity program designed to protect our systems and data from information security risks, including regular oversight of our programs for security monitoring. Gen has a process for identifying and assessing material risks from cybersecurity threats on a regular basis that operates alongside our broader overall risk assessment process, covering all identified enterprise wide risks. Cybersecurity risk is reviewed quarterly with management and with the board of directors. In addition, we regularly perform evaluations (including independent third-party evaluations) of our security program and our information technology infrastructure and information security management systems. A retained independent third-party firm reviews the maturity of our information security program and the results are discussed annually in the Technology and Cybersecurity Committee of the Board. Our processes also address risk and identification of cybersecurity threat risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, reviewing security and controls reports, implementing contractual security and notification provisions, and ongoing monitoring as needed.


text: While we have not had any cybersecurity incident that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, future cybersecurity incidents or threats could have a material impact on our results of operations or financial condition as discussed in "Risk Factors"—" Increased Information Technology Security Threats and More Sophisticated and Targeted Computer Crime Could Pose a Risk to Our Systems, Networks, Products, Solutions and Services."

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition.

companyName: Zeo Energy Corp.

ticker: ZEO


text: Our information security management system is based upon industry frameworks including but not limited to ISO 27001 and NIST Cybersecurity Framework. Our Chief Information Security Officer (CISO) leads our cybersecurity program, which includes the implementation of controls designed to align with these industry frameworks and applicable statutes and regulations. Our CISO has over 30 years of prior work experience in various roles involving managing information security programs, developing cybersecurity strategy, implementing effective information and cybersecurity initiatives and has been the Head of IT Audit, CISO and CIO at three other companies prior to Gen Digital. He has a Bachelor of Science in Computer Information Systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes an annual table top exercise and is designed to restore business operations quickly. In addition, employees participate in mandatory annual training and receive communications regarding the cybersecurity environment to increase awareness throughout the company. We also implemented an enhanced annual training program for specific specialized employee populations, including secure coding training.


text: We are committed to protecting our critical information and data and information technology environment and defending against cybersecurity threats. We focus on relevant areas of cybersecurity risks and vulnerabilities and seek to mitigate such risks by maintaining secure environments, maintaining processes to identify cybersecurity threats and raising awareness of cybersecurity risks to our employees.


text: We utilize a comprehensive, multi-layered approach for our cybersecurity management which is generally aligned with the National Institute on Standards and Technology Cybersecurity Framework. We have a number of controls and procedures in place to recognize potential cybersecurity threats and potential incidents and elevate such potential incidents to senior management and our outside advisors to determine the materiality of such incidents. Automated tools and our third party security operation center provide alerts to our cybersecurity staff regarding potential threats. We also use an array of defenses to protect our cybersecurity environment and mitigate cybersecurity threats, including multi-factor authentication, access controls, email filtering, firewalls, intrusion prevention and detection systems, partitioning and encryption of information, backup and data recovery procedures, malware defenses, disaster recovery and incident plan responses, hardware and software updates and patching, and related programs. We regularly assess the efficacy of these defenses and mitigation measures and implement improvements, focusing on critical matters. To further promote a culture of cybersecurity awareness and defense, we also have regular educational and training sessions for our relevant employee population about the importance of cybersecurity and our key information more generally.


text: We regularly engage third parties and leverage their expertise to improve our cybersecurity environment and defenses against third party threats. Such third parties assist us in the assessment and testing of our cybersecurity environment and help us identify any potential gaps in our cybersecurity defenses. We also regularly discuss evolving cybersecurity threats with third parties and interface with software and hardware providers to manage our cybersecurity environment.


text: We have extensive incident response plans in place that provide a documented framework to, among other things, identify the critical steps to be taken for immediate rescue and recovery actions when a system disruption occurs. We also have comprehensive business continuity plans in place for disruptions, including a system disruption, that include recovery actions and alternate methods including manual work arounds that allow us to continue operating and shipping products. Our incident response plans and business continuity plans are regularly reviewed and updated, with a focus on continuous improvement.


text: Our Board of Directors is responsible for risk oversight for the Company, which includes cybersecurity. Our Board of Directors risk oversight process, including for cybersecurity, builds upon management's assessment of the Company's risks and processes for managing and mitigating such risks. Our senior management presents a report to our Board of Directors at each of its quarterly regular meetings regarding our cybersecurity environment, relevant cybersecurity projects, actions we are taking to address and mitigate cybersecurity risks and other relevant cybersecurity related topics applicable to us. During such presentations and other discussions regarding risks, senior management reviews cybersecurity risks with our Board of Directors.


text: In support of such oversight process of our Board of Directors, our management maintains robust cybersecurity management processes. Our cybersecurity function is led by our Executive Vice President, Corporate Development and Administration and our Vice President of our Business Technology Group. Our Vice President of our Business Technology Group has been with us for over 35 years in various roles related to information technology, cybersecurity and support of our business and enterprise systems. He has over 38 years of direct experience in multiple roles related to information technology and cybersecurity and a deep understanding of how information technology data and specialized software and hardware relates to our business operations. Our Vice President of our Business Technology Group also has significant experience in identifying third party cybersecurity risks and integrating acquired companies into our cybersecurity environment.


text: We have a Cybersecurity Governance Committee, consisting of our Chief Executive Officer, our Executive Vice President, Corporate Development and Administration, our Executive Vice President, General Counsel and Secretary, our Senior Vice President and Chief Financial Officer, our Senior Vice President, Corporate Development (formerly the Chief Financial Officer for our U.S. metal container operations), our Vice President of our Business Technology Group and the IT Director for one of our businesses. Our Cybersecurity Governance Committee meets multiple times per quarter to address cybersecurity risks and threats, our responses to such risks and threats, the results of cybersecurity tests and controls and the impact of completed and planned projects to support our cybersecurity environment. We also maintain a cybersecurity working committee among our businesses that is comprised of our Vice President of our Business Technology Group, the IT Directors of our businesses and other key members of our Business Technology Group. The cybersecurity working committee meets at least monthly with a primary focus on goals and improvements to our cybersecurity management processes, and members of our management and of the management of our businesses are invited to attend.


text: We utilize a comprehensive, multi-layered approach for our cybersecurity management which is generally aligned with the National Institute on Standards and Technology Cybersecurity Framework. We have a number of controls and procedures in place to recognize potential cybersecurity threats and potential incidents and elevate such potential incidents to senior management and our outside advisors to determine the scope and materiality of such incidents. Automated tools and our third party security operation center provide alerts to our cybersecurity staff regarding potential threats. We also use an array of defenses to protect our cybersecurity environment and mitigate cybersecurity threats, including multi-factor authentication, access controls, email filtering, firewalls, intrusion prevention and detection systems, partitioning and encryption of information, backup and data recovery procedures, malware defenses, disaster recovery and incident plan responses, hardware and software updates and patching, and related programs. We regularly assess the efficacy of these defenses and mitigation measures and implement improvements, focusing on critical matters and threats. To further promote a culture of cybersecurity awareness and defense, we also have regular educational and training sessions for our relevant employee population about the importance of cybersecurity and our key information more generally.


text: We have extensive incident response plans in place that provide a documented framework to, among other things, identify the critical steps to be taken for immediate access, rescue and recovery actions when a system disruption occurs. We also have comprehensive business continuity plans in place for disruptions, including a system disruption, that include recovery actions and alternate methods including manual work arounds that allow us to continue operating and shipping products. Our incident response plans and business continuity plans are regularly reviewed and updated, with a focus on continuous improvement.


text: In support of such oversight process of our Board of Directors, our management maintains robust cybersecurity management processes. Our cybersecurity function is led by our Executive Vice President, Corporate Development and Administration and our Vice President of our Business Technology Group. Our Vice President of our Business Technology Group has been with us for over 36 years in various roles related to information technology, cybersecurity and support of our business and enterprise systems. He has over 39 years of direct experience in multiple roles related to information technology and cybersecurity and a deep understanding of how information technology data and specialized software and hardware relates to our business operations. Our Vice President of our Business Technology Group also has significant experience in identifying third party cybersecurity risks and integrating acquired companies into our cybersecurity environment.


text: Tredegar's business model depends on the efficiency and reliability of its information systems, networks, and essential assets, with a portion of these systems and networks being administered by third-party service providers. Tredegar's Cybersecurity Program (the "Program"), which was designed utilizing a risk-based approach, was developed to not only prevent, identify, investigate, resolve, and mitigate potential cybersecurity vulnerabilities within Tredegar but also to enhance the information security posture of Tredegar's operations involving third-party service providers.

companyName: TREDEGAR CORP

ticker: TG


text: Tredegar entrusts the third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks. Additionally, Tredegar also periodically conducts assessments of the third-party service providers' security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.


text: The Program leverages a blend of automated systems, manual operations, and external evaluations to proactively identify and mitigate potential cybersecurity threats. Key components of the program include Tredegar's Cybersecurity Incident Response Plan and Cyber Crisis Management Plan. These plans encompass a strategic approach that includes detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to the Board of Directors is necessary, containment of incidents, eradication or mitigation of threats, recovery processes, and a comprehensive post-incident review.


text: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology ("IT") departments to assess Tredegar's information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement.


text: The results of such an assessment are regularly presented to the Audit Committee. Notably, these assessments include periodic penetration tests, which allow Tredegar to identify vulnerabilities, refine procedures, and enhance its crisis management and recovery capabilities. The Program is also supported by an organizational structure, involving collaboration across various business sectors and an interdisciplinary Global Data Protection and Cybersecurity Oversight Team that meets regularly to identify information security risks and appropriate risk mitigation strategies. Additionally, because Tredegar recognizes the significant role that its employees play in information security, it provides annual formal information security training to all of its employees that covers critical topics such as phishing and email security best practices.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ENCORE WIRE CORP


text: Tredegar's IT Director has over 10 years of cybersecurity expertise, including a robust history of similar roles, cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco. Our IT Director is responsible for overseeing the Program, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. Tredegar's IT Director also regularly collaborates closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication within Tredegar.


text: The Board is responsible for risk management, with specific oversight of cybersecurity risks being delegated to the Audit Committee. The Audit Committee receives updates from the IT Director at each of its quarterly meetings. These updates encompass an assessment of Tredegar's cybersecurity risk profile, including the efficacy of Tredegar's cybersecurity policies, procedures, strategies, and areas of emerging risk. Additionally, the Board receives annual, but often more frequent, updates on Tredegar's cybersecurity systems.


text: Tredegar entrusts its third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks. However, Tredegar also periodically conducts assessments of the third-party service providers' security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.


text: The Program leverages a blend of automated systems, manual operations, and external evaluations to proactively identify and mitigate potential cybersecurity threats. Key components of the Program include Tredegar's Cybersecurity Incident Response Plan and Cyber Crisis Management Plan. These plans encompass a strategic approach that includes: (i) detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to Tredegar's Board of Directors ("Board") is necessary; (ii) containment of incidents; (iii) eradication or mitigation of threats; (iv) recovery processes; and (v) a comprehensive post-incident review.


text: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology ("IT") functions to assess Tredegar's information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement. The results of such an assessment are regularly presented to the Audit Committee. Notably, these assessments include periodic penetration tests, which allow Tredegar to identify vulnerabilities, refine procedures, and enhance its crisis management and recovery capabilities. The Program is also supported by an organizational structure, involving collaboration across various business sectors and an interdisciplinary Global Data Protection and Cybersecurity Oversight Team that meets regularly to identify information security risks and appropriate risk mitigation strategies. Additionally, because Tredegar recognizes the significant role that its employees play in information security, it provides annual formal information security training to all of its employees that covers critical topics such as phishing and email security best practices. Furthermore, periodic simulated phishing exercises are conducted to reinforce these practices.


text: Tredegar's IT Director and Bonnell's Director of Information Security are responsible for managing the Program, including the prevention, mitigation, detection and remediation of cybersecurity incidents. Tredegar's IT Director has over 10 years of cybersecurity expertise, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco. Bonnell's Director of Information Security has over 30 years of cybersecurity experience, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ISC^2 and holds a degree in Mechanical Engineering from the Georgia Institute of Technology. Tredegar's IT Director and Bonnell's Director of Information Security also regularly collaborate closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication regarding the Program within Tredegar.


text: The Board is responsible for risk management, with specific oversight of cybersecurity risks being delegated to the Audit Committee. The Audit Committee receives updates from Tredegar's and Bonnell's IT Directors at each of its quarterly meetings. These updates encompass an assessment of Tredegar's cybersecurity risk profile, including the efficacy of Tredegar's cybersecurity policies, procedures, strategies, and areas of emerging risk. Additionally, the Board receives annual, but often more frequent, updates on Tredegar's cybersecurity systems.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for further information.


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Cybersecurity Breaches and other Disruptions to our Information Technology Systems", which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The Board regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic and ad-hoc risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Cybersecurity Officer ("CCO"), who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage auditors and other third parties in connection with our risk assessment processes. These service providers assist us to monitor, enhance and test our safeguards.


text: We require key third-party service providers to certify that such providers have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity incidents, including data security breaches or computer viruses, could harm our business by disrupting our business operations, compromising our products and services, damaging our reputation or exposing us to liability".


text: Our CCO is primarily responsible for assessing and managing our material risks from cybersecurity threats, in close coordination with our Senior Vice President, Operations and IT, and the senior executive leaders of our Video and Broadband business segments. Our CCO's cybersecurity experience includes overseeing the design and implementation of cybersecurity measures and safeguards for Harmonic's Video business software and SaaS offerings as the former long-serving Chief Technology Officer of the Video business, and responsibility at a previous company for the cybersecurity architecture and implementation of an online banking platform and an online transaction processing system for gaming.


text: Our CCO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, in close coordination with the senior executive leaders of our corporate information technology function and Video and Broadband business segments. The processes by which our CCO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: regular reports from the Company's 24/7 cybersecurity operations center monitoring systems and established incident reporting and escalation from the executive leaders of our corporate information technology function and Video and Broadband business segments.


text: Our CCO provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our CCO provides annual briefings to the board of directors on cybersecurity risks and activities.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Cybersecurity Officer ("CCO"), who reports to our Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Information Officer, who reports to the Chief Executive Officer, has over twenty years of experience in IT, including IT security. In addition, a member of our board of directors, Hatem Naguib, recently retired from his role as President and Chief Executive Officer of Barracuda, a cybersecurity solutions provider, and brings expertise in IT security.


text: Our CCO provides briefings to the audit committee throughout the year regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our CCO provides annual briefings to the board of directors on cybersecurity risks and activities. Our board may also be notified and engaged as part of the Company's cybersecurity incident response plans, depending on the significance of an incident.


text: Our current CCO will depart the Company at the end of February 2025, and will be succeeded by our new Chief Information Officer ("CIO"), who will join the Company in March 2025. The CIO's responsibilities will include the Company's cybersecurity efforts and policies, and he will report directly to our CFO. Our new CIO previously served in relevant leadership positions at other large public companies and brings to the role a wealth of information security and information technology knowledge and experience.


text: Risk Management and Strategy The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Senior Director of Cybersecurity, who functions as the chief information security officer (CISO). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology ("IT"), legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK