text: The cybersecurity program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.

companyName: Oil-Dri Corp of America

ticker: ODC

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: majority


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including leaders from our information security and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security team, such as our Chief Information Officer, Director, Applications Delivery, and our Director of Information Technology. Such individuals have nearly 40, over 30, and over 20 years of experience, respectively, in various roles involving information technology, including infrastructure and operations, security, auditing, compliance, and application development. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Risk Management and Strategy We are committed to reducing the risk of cybersecurity compromise, either intentional or unintentional, to our customers, employees, and company proprietary information resources.

companyName: JABIL INC

ticker: JBL


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, deployment of AI within the Company, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to the safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.

stage1Category: Risk Management Process

stage1Method: unanimous


text: • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems. • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us during fiscal year 2025 or are reasonably likely to materially affect us in the near term, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.


text: The Board oversees risk management directly and through its committees. Generally, the Board oversees risks that may affect the business of Jabil as a whole, including operational matters. The Cybersecurity Committee ("the Committee") assists the Board in fulfilling its oversight responsibilities with regard to the Company's cybersecurity programs and risks, including the cybersecurity practices, procedures, and controls management uses to identify, assess, and manage the Company's key cybersecurity programs and risks, to protect the confidential intellectual property information and data of the Company and its customers and to comply with applicable data protection laws and regulations.


text: The Committee of the Board meets quarterly. At each meeting, it receives reports from the Chief Information Security Officer ("CISO").


text: As part of its role in overseeing risk management, the Committee periodically reports to the Board regarding briefings provided by management and advisors as well as the Committees' own analysis and conclusions regarding cybersecurity risks faced by the Company. The Committee will review with management and the Board, and advise them regarding the following matters, as necessary: • Management's implementation of cybersecurity programs, policies, and procedures and management's actions to safeguard their effectiveness; • The effectiveness of the Company's cybersecurity programs and its practices for identifying, assessing, and mitigating cybersecurity risks across all business functions; • The Company's controls to prevent, detect and respond to cyber-attacks or information or data breaches involving the Company; • Cyber crisis preparedness, incident response plans, and disaster recovery capabilities; • Reports and presentations received from management and the Company's advisors regarding the management of cybersecurity programs and risks, including protection of confidential intellectual property, information, and data.


text: The CISO leads the Corporate Information Security organization which oversees the security posture of Jabil's data, networks, and resources. The CISO is responsible for notifying and providing updates on cybersecurity incidents to the Chief Information Officer ("CIO"). The CIO is responsible for overseeing global IT operations and digital transformation across the Company and leads the strategic direction on IT polices to safeguard company and client assets against cybersecurity threats.


text: The CISO has over 39 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 33 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.

stage1Category: Management Role


text: Effective September 1, 2025, the Company transitioned cybersecurity responsibilities to a new CISO. The new CISO has over 20 years of experience leading large-scale security programs protecting critical infrastructure and sensitive data, modernizing digital identity systems, and driving cultural transformation within security teams in the federal, healthcare, and global manufacturing sectors.


text: Cybersecurity Risk Management and Strategy We maintain an information security program with a dedicated internal team that is tasked with leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our information security team is responsible for identifying, assessing, managing, and responding to cybersecurity risks, threats and incidents relating to the protection of our information assets, systems and operations. The information security team also oversees the detection, prevention, mitigation and remediation of all cybersecurity incidents. Our information security team proactively monitors emerging cyber threat activity to proactively tune and upgrade our cyber capabilities to maintain a robust security posture.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer, a member of our Executive Leadership Team ("ELT"). Our CISO has a graduate degree in computer engineering and has worked in cybersecurity for over two decades, including at a major financial institution. The information security team is comprised of approximately 60 employees, with dedicated teams assigned to governance, risk and compliance, identity and access management, strategy and architecture, and analytics and automation. The team operates from FactSet locations around the world, including offices in the U.S., India, the Philippines and Europe.


text: FactSet's information security and governance framework is guided by International Organization for Standardization ("ISO") 27001 and System and Organization Control ("SOC") 2 Trust Service Criteria and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework. FactSet's ERM program is designed to identify, prioritize and assess the most significant risks that could impact our ability to achieve our strategic business objectives. Our information security leadership team, in concert with our ERM team, reviews our cybersecurity risks each quarter through our enterprise risk assessment process.


text: FactSet's information security program is grounded in a risk-based approach. Our information security team undertakes various activities to assess, identify and manage risks from cybersecurity threats, including managing security controls, conducting penetration testing, leading training and tabletop exercises (including an annual tabletop exercise with the ELT), and conducting internal and external vulnerability assessments. All FactSet's employees receive mandatory annual cybersecurity training; software engineers receive training on secure software development best practices; and other ad hoc training is provided to employees on the latest cyber threat landscape. In addition, we also perform quarterly "phishing simulations" to test the effectiveness of our security training program.


text: FactSet's information security team performs annual penetration testing with leading service providers, to mimic motivated threat actors, to assess the internal and external security posture of the Company. Findings from the penetration test and our internal and external vulnerability assessments are classified using a combination of scores and internal business metrics.


text: We have processes to identify and mitigate cybersecurity risks stemming from our relationships with third parties, including protocols to assess vendors' cybersecurity programs before we engage them and to monitor vendors, once engaged, for ongoing compliance with our cybersecurity standards.


text: We also have an incident response plan that provides procedures for how we can detect, respond to, and recover from potential cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate any incident, as well as to comply with any applicable legal obligations and mitigate potential brand and reputational damage.


text: Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the ELT and the FactSet Audit Committee, and, where appropriate, the Board of Directors (the "Board"). We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: The cybersecurity threat landscape is dynamic and volatile and requires significant investment. To date, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A, Risk Factors in this Annual Report on Form 10-K, although our processes are designed to help identify, detect, prevent, respond to, and mitigate cybersecurity risks, cybersecurity threats are rapidly evolving and we may not be able to anticipate, prevent, or detect all such attacks and there is no guarantee that a future cybersecurity incident could not materially affect our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity is an important part of our Audit Committee, Board and ELT's risk management focus. The Board coordinates with the Audit Committee for active Board- and Committee-level oversight of the Company's technology and cyber risk profile, cyber strategies and information security initiatives.

stage1Category: Board Governance


text: The Audit Committee monitors management's responsibility in the area of risk oversight, including cybersecurity risks. At each regular meeting, the Audit Committee receives updates from the CISO, regarding trends, emergent risks to our technology infrastructure, major updates on security assessments and threat landscape, and the steps we are taking to respond to these matters. The CISO also provides an annual update to the Board, or as may otherwise be required.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an ERM program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.

companyName: NCR Atleos Corp

ticker: NATL


text: We utilize various information technology and data protection services to help detect and prevent cyberattacks, including but not limited to firewalls, intrusion prevention systems, denial of service detection, anomaly based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, multiple threat intelligence services, threat hunting managed security service provider (MSSP), identity management technology, security analytics, multi-factor authentication and encryption. There can be no assurance that our protections will always be successful and any failure could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption of our business, damage to our reputation, legal exposure and financial losses.


text: The Company has also established relationships with cybersecurity firms and internal cybersecurity experts, which it engages in connection with certain suspected incidents. The Company also regularly undergoes evaluation of its protections against incidents, including both self-assessments and expert third-party assessments, and it regularly enhances those protections, both in response to specific threats and as part of the Company's efforts to stay current with advances in cybersecurity defense.


text: To further our commitment to data privacy and cybersecurity: • Atleos maintains the ISO 27001 certification for certain locations throughout the United States, Europe, Australia, and India; • Third-party audits for PCI-DSS, PA-DSS and SSAE-18 SOC2 are conducted for certain service offerings; • Atleos engages third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Atleos maintains a robust information security awareness and training program. Employees and contingent workers are required to complete training within 30 days of hire, as well as an annual refresher course; • Atleos performs regular testing to help ensure employees can identify email "phishing" attacks; and • Atleos' corporate insurance policies include certain information security risk policies that cover network security, privacy and cyber events.


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors.

stage1Category: Third-Party Risk


text: The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A. Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee has oversight responsibility for the Company's ERM framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board.


text: Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. For example, a member of our audit committee has recently completed executive training at MIT in artificial intelligence and was a former chief executive officer and director of a publicly listed global software company that has an array of products including compliance and cybersecurity related software. He also served as the chair of the compliance and risk committee (including cyber security) at another public company. Additionally, another member of our audit committee recently completed an online course on boardroom governance in cybersecurity. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.


text: As discussed below, members of management report to the Audit Committee, which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to ERM, ethics & compliance (E&C), data privacy, TPRM, BCP and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.


text: Under the direction of Atleos' CISO, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.


text: Our Chief Risk Officer has over 20 years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.


text: Our Chief Compliance Officer has over 40 years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.


text: Our CISO has over 25 years of experience leading global teams across a variety of IT disciplines as well as executive leadership of global Information Security / Cybersecurity organizations in complex, regulated environments. He holds an undergraduate degree in business administration from Appalachian State University.


text: Risk Management and Strategy We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. This includes multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify material cybersecurity risks in our critical IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.


text: A multi-functional enterprise cyber security and Infrastructure team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the CFO and Senior Vice President ("SVP"), IT, and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.


text: Cyber criminals do, however, target us, TPG and TPG's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or TPG's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors— Operational risks, including the risks of cyberattacks, may disrupt our businesses, result in losses or limit our growth".

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX

stage1Category: None/Other


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a combination of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber threat intelligence, insights and assessments of its cybersecurity risk posture and governance.


text: The Company's third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, the Company's cybersecurity team conducts reviews of its third-party vendors depending on the vendor's risk profile as determined by its cybersecurity team.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. However, as of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we have faced in the past and expect to continue to face in the future, please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST 2.0 cybersecurity framework.


text: Our Board of Directors is part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.


text: Management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks.


text: Internal Cybersecurity Team The Information Security organization reports into the SVP, IT and includes a dedicated team of centralized information security experts with extensive cybersecurity knowledge and experience to manage the cyber risk under the leadership of the Director of Information Security.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy


text: Network security configurations Risk Management and oversight of third parties Our cyber security and infrastructure team's experience includes a combined 102 years of experience. Further, our Director of Information Security, IT Governance Risk and Compensation Manager, Cybersecurity Team Lead, and Industrial Security and Network Senior Analyst all hold the Certified Information Systems Security Professional (CISSP) credential, widely recognized as the global standard for information security expertise. CISSP certification demonstrates advanced knowledge across eight security domains, a minimum of five years of industry experience, and adherence to strict ethical standards. This designation reflects our leaders' ability to align technical controls with business risk, ensuring robust governance, regulatory compliance, and resilience against evolving cyber threats. Our team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Incident Response We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. Internal reporting and escalation protocols are in place to ensure the involvement of the SVP, IT, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: In fiscal 2025, the Company developed a Cybersecurity Incident Materiality Policy (the "Policy") to guide the Company through the materiality decision making framework, SEC reporting and disclosures obligations, disclosure controls and procedures related to a cybersecurity incident, and a communication protocol to escalate material incidents to the Board and supplements the Company's Cybersecurity Incident Response Plan. In addition to the Policy, the Company also formed a Cyber Incident Disclosure Committee, which includes key stakeholders whose role will be to determine whether an incident is material and, therefore, requires public disclosure.


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our cybersecurity program is managed by our Director of Information Technology and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Director of Information Technology and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director of Information Technology and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Director of Information Technology and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Director of Information Technology and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Director of Information Technology has more than 25 years of information technology experience across the healthcare industry before joining Nutex Health. The Chief Operating Officer has more than 20 years of in-depth knowledge of our business operations that helps integrate the cybersecurity program into the overall business operations.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: We have developed and implemented a cybersecurity risk management program to protect critical assets, scale with business growth, identify and mitigate threats, and enable us to conduct our business securely. The program's design utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework, while adapting certain elements to align with our specific operational needs and objectives. The program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: Hillenbrand, Inc.

ticker: HI


text: Risk Management and Strategy Under our Shared Services Agreement with D.R. Horton, D.R. Horton provides us with certain administrative and compliance services which includes information technology, i nternal audit and information technology risk services. Leveraging these services provided by D.R. Horton related to cybersecurity, we have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by the D.R. Horton Chief Information Officer (CIO) and Cyber Security Risk Officer (CSRO).

companyName: Forestar Group Inc.

ticker: FOR


text: We have implemented processes to assess, identify, and manage risks from cybersecurity threats, including the following: • Multi-factor Authentication: We secure access to our network and systems through multi-factor authentication. • Layered Email Protection: We have adopted a layered approach to email protection. • Zero-Trust Security Model: We are working towards a zero-trust security model, utilizing group-based access controls to manage network resources. • Continuous Monitoring: We continuously monitor our systems for security anomalies, to help enable early detection of issues and facilitating a rapid response. • Regular Scans: We conduct weekly and monthly scans to identify and prioritize the mitigation of the most critical vulnerabilities. • Quarterly Penetration Testing: We engage third-party consultants to perform quarterly penetration testing, examining our environment from various perspectives, including end-user and employee use cases, to thoroughly assess system vulnerabilities. • Collaborative Evaluation and Remediation: In collaboration with our third-party consultants, we evaluate the outcomes of our testing, address and remediate any identified issues, and subsequently re-test the environment to confirm that the mitigations have effectively resolved the vulnerabilities. • Regular Assessments and Gap Analyses: Our cybersecurity team regularly meets with the third-party consultants to assess overall risk and conduct gap analyses, ensuring the effectiveness of our current cybersecurity measures. • Comprehensive Risk Assessment: Our comprehensive risk assessment includes evaluating potential security risks associated with the use of external service providers. • Incident Response Readiness: We maintain a documented incident response readiness process that details the procedures to follow in the event of a security incident. • Data Backup: We maintain comprehensive backups of all system files to facilitate data recovery during a security incident. In addition to the above-described technology controls, we have implemented mandatory training and awareness programs designed to educate our employees on cybersecurity risks. These include periodic exercises to help employees identify phishing schemes and other social engineering tactics, and we provide various methods for them to report suspicious activity that may give rise to a cybersecurity incident.


text: To date, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because the sophistication of cybersecurity threats continues to increase with rapidly evolving techniques to overcome security measures, the preventative actions we have taken and will continue to take to reduce the risks may not successfully protect our systems against a future cybersecurity incident. For more information on how cybersecurity risk could materially affect our business, please refer to Item 1A, "Risk Factors."


text: Our Board of Directors (Board) considers cybersecurity and other information technology risk as part of its risk oversight function. The members of our Board hear presentations on our cybersecurity risks and risk management on an annual basis from D.R. Horton's CIO and CSRO. These presentations include reviewing current trends, processes and systems used to mitigate the risk of cybersecurity threats. Our internal audit department also conducts cybersecurity reviews as part of its audit procedures and presents any findings to the Board. We have protocols by which certain cybersecurity incidents would be escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We invest a considerable amount of resources in training, tools and other resources to manage risks from cybersecurity threats. Our cybersecurity program is led by an experienced team that creates cybersecurity policies and procedures and possess expert knowledge related to controls and safeguards related to cybersecurity. The cybersecurity team, led by the D.R. Horton CIO, is responsible for assessing and managing risks from cybersecurity threats. The D.R. Horton CIO receives reports on cybersecurity threats from the cybersecurity team on an ongoing basis and in conjunction with the CSRO, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The D.R. Horton CIO and CSRO work closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: D.R. Horton's CIO has 36 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, the D.R. Horton CIO has led governance, risk, and compliance technology programs and information security programs. The D.R. Horton CIO currently reports to the D.R. Horton CFO.


text: D.R. Horton's CSRO has 24 years of experience working in information technology and cyber security roles including software development, identity and access management projects, privilege account management and multifactor authentication implementations. While in those roles, the D.R. Horton CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The D.R. Horton CSRO currently reports to the D.R. Horton CIO.


text: Supporting the D.R. Horton CIO and CSRO is a dedicated cybersecurity team that designs and monitors our cybersecurity control framework as well as implements cybersecurity control systems and solutions. The D.R. Horton cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Security+, Network+, AQS Certified Cloud Practitioner and Certified Information Systems Auditor.


text: Protecting our technology and information systems: We use various tools to help manage our overall program including unauthorized access detection, 24x7 security monitoring, email protection, network intrusion prevention systems, security training, penetration testing, and other similar tools to protect the Company's data. When adopting or changing technology, we conduct risk-based security and privacy impact assessments and deploy administrative, physical, and technical safeguards that are designed to reasonably protect us from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems and use what we learn to evolve our security controls over time to mitigate risks posed by such threats.


text: Incident response and recovery planning: We maintain incident response and recovery plans that direct our response to cybersecurity incidents. These plans guide how we evaluate and assign incident severity levels and reporting thresholds, escalate and engage cross functional incident response teams, perform materiality assessments, and manage and mitigate the related risks. We also maintain a cybersecurity insurance program to reimburse covered costs, losses and claims relating to a data or security breach.


text: Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers, and subcontractors. Further, we require third-party users with such access to our data and systems to adhere to industry policies and standards that are comparable to or exceed our policies and standards. For third-party users that do not have access to our data and systems, we require those users to maintain cybersecurity practices that align with industry standards and applicable laws.


text: Training and awareness: We have a cybersecurity training program designed to educate and train employees on how to identify and report cybersecurity threats, which includes regular phishing exercises and recurring cybersecurity awareness training to all our associates and third parties who have access to Company email and networks. Training programs are conducted on a periodic basis and are focused on giving employees awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. Specialized training is also offered to employees in sensitive roles.


text: Assessments and testing: We use third party specialists to conduct periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, risk assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Where appropriate we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, consolidated results of operations, or financial condition. However, despite our security measures, we cannot assure that we or our third-party partners will not experience a future cybersecurity incident that could materially affect us.


text: Our Board of Directors oversees overall cybersecurity risk and strategy, and the Audit Committee of the Board of Directors oversees information security compliance as part of its broader compliance oversight mandate. Together, this ensures that the Board of Directors has a comprehensive view of the Company's cybersecurity risk profile and framework. The Board of Directors and its Audit Committee include directors with knowledge, skills, and cybersecurity and information technology experience.


text: Our Company's Executive Management Team ("EMT") receives periodic briefings, and the Board of Directors and its Audit Committee receives annual and quarterly briefings, respectively, on cybersecurity matters. These briefings may include updates on critical information security and cybersecurity risks and the threat landscape; cybersecurity improvement initiatives and the internal control environment; and, if relevant, the status of actions taken with respect to any cybersecurity incidents.


text: The Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing cybersecurity risks, including implementation of our cybersecurity risk management program. The CISO works in partnership with the information technology, legal, finance, and internal audit functions to review information technology-related policies and internal controls in managing the cyber risk.


text: The CISO has information technology and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISO reports to the Chief Information Officer ("CIO"), who is a member of the EMT and reports directly to the CEO. The CIO has extensive experience overseeing and executing technology strategies and implementations in complex, global organizations.


text: As a part of our incident response plan, the CISO also reports and escalates cybersecurity incidents to the EMT and the Audit Committee as appropriate.


text: The Audit Committee receives regular reports from management on our cybersecurity risks and reviews our cybersecurity program on at least an annual basis, or more frequently as necessary or advisable. In addition, the Audit Committee is informed, as necessary, regarding material cybersecurity incidents, as well as incidents with lesser impact potential.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Risk Management and Strategy Griffon relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company and with third parties. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade cybersecurity management program designed to assess, identify, protect, detect and respond to, and manage material risks from cybersecurity threats. To protect our information systems from cybersecurity threats, we use various information technology and cybersecurity tools to safeguard our systems and data, which help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: GRIFFON CORP

ticker: GFF


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology Cybersecurity Framework to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.


text: Griffon has a third-party risk management program regarding the cybersecurity practices of its vendors and partners that is designed to oversee, identify, and minimize material risks from cybersecurity threats associated with the use of such third parties. This program involves vetting of third parties before engagement. Regular monitoring and reviews are conducted to ensure third party vendors and partners comply with Griffon's security standards.


text: From time to time, Griffon engages external experts, including cybersecurity assessors, consultants, and/or auditors to evaluate cybersecurity measures and risk management processes.


text: We also maintain a cyber incident response plan with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect us, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents, and (3) managing internal and external communications and reporting.


text: If a cybersecurity incident occurs, our incident response team ("IRT") is immediately notified, and Griffon management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. The IRT also coordinates further notifications, as applicable, to senior executives and organizational leadership, our Audit Committee and Board of Directors, business partners or service providers, and authorities.


text: Like most organizations, we and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. During the reporting period, Griffon has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operating results, and financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business strategy, operating results and financial condition. We continuously use threat models and cyber threat intelligence to identify relevant risks to our businesses and take active measures to mitigate these risks. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and regarding its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.


text: Griffon also has a Cybersecurity Management Committee, consisting of executives from Griffon and technology leaders from Griffon's business segments, that monitors and assesses progress and performance by Griffon's business segments in the area of cybersecurity; the results of such assessments are reported to the Audit Committee from time to time. The Chief Information Officers of each of HBP and CPP regularly provide updates on material cybersecurity risks to our senior management and to our Audit Committee, and along with their technology teams, are responsible for assessing and managing cybersecurity risks. Each of our business segment Chief Information Officers has over 20 years of experience in cybersecurity, information security, policy, architecture, engineering and incident response.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives an annual briefing from our Chief Information Officer, or CIO, on our cybersecurity program, including risks and priorities.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is governed by our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, network interconnectivity reviews, system access controls and monitoring, and data backup and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to emerging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and provided to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual "Living our Values" training modules and our privacy training programs.


text: Third-party risk management is a critical component of our cybersecurity strategy. We maintain oversight of service providers through proactive monitoring, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers to ensure they maintain effective security management programs, compliance with information handling and asset management protocols, and provide prompt notification of any known or suspected cybersecurity incidents.


text: To validate our security posture, we engage independent external firms to conduct regular penetration testing, security audits, and cybersecurity consulting. We maintain ISO/IEC 27001 certification for our global enterprise. We also maintain a Cybersecurity Maturity Model Certification (CMMC) L2 certification for our U.S. Federal operations, and Cyber Essentials (CE) Plus certification for our U.K. operations. Additionally, our IT General Controls (ITGCs) undergo annual testing through Sarbanes-Oxley (SOX) audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. The Board is assisted by the Audit Committee,,as it pertains to cybersecurity threats to the integrity of the Company's financial systems and compliance with cybersecurity related disclosures, and the Sustainability and Risk Committee, as it pertains to cybersecurity as a part of the Company's enterprise risk, which oversee our cybersecurity risk exposures, review management's mitigation efforts, and report their findings to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the Sustainability and Risk Committee. These updates cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board and its committees regularly engage in discussions with senior executives regarding cybersecurity and information security risks. As part of our cybersecurity governance, we also maintain a Cybersecurity Steering Committee chaired by our CISO and comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as needed, to review, assess and direct decisions related to cybersecurity and information systems matters.


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer ("CIO"). Our CISO oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting from information security professionals, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM). These efforts are supported by advanced technological tools, specialized software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following credentials: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly provide reports to the Board, the Audit Committee and the Sustainability and Risk Committee on our cybersecurity posture, key initiatives and ongoing efforts to prevent, detect, mitigate, and remediate cyber incidents. In the event of a cybersecurity incident, we follow established incident response procedures, which includes protocols for timely notification to senior management as well as the Board of Directors, with ongoing updates provided until the issue is remediated, as appropriate.


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition from cybersecurity threats or prior incidents, such events have the potential to have a material adverse effect on such aspects of our business. Realization of these risks could damage or disrupt access to our information systems or networks, compromise confidential or protected information, destroy or corrupt data or otherwise interfere with our operations. We continuously monitor our networks for unauthorized access attempts and maintain a range of defensive measures. However, the evolving and sophisticated nature of cyber threats means we cannot guarantee prevention of all potential incidents that could materially impact our business operations, financial condition, or strategic objectives. In addition, even if we effectively defend our own systems, we rely on third-party providers of products, services and networks, with whom we share data and services, and who may themselves be unable to prevent or mitigate cyberattacks.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. The incident response plan is exercised on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC


text: Governance Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee. Led by our Chief Information Security Officer ("CISO"), the Information Security Management Committee is made up of cross-functional members of company management and works closely with our third-party information technology and security providers to develop and implement our cybersecurity strategy. Our CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has over 20 years of experience in information security. Our audit committee has oversight over cybersecurity risks. The audit committee reviews the enterprise risk management program quarterly, which includes the cybersecurity risk management program and any identified cybersecurity risks. With the input of the Information Security Management Committee and our information technology providers, the CISO regularly reports to the audit committee on our cybersecurity risk management process, including updates related to security testing, assessments, cyber risk and related cyber strategy, as applicable. In addition, the CISO makes annual cybersecurity reports to our board of directors.


text: Risk Management and Strategy As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Construction Partners, Inc.

ticker: ROAD


text: We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. Dedicated members of our information security team, led by our Senior Vice President, Information Technology and our Director of Information Security, continuously monitor threat intelligence feeds, handle vulnerability management and respond to incidents. In addition, we periodically perform simulations and drills at a technical level.


text: Internally, we have a security awareness training platform that includes training to reinforce our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to evaluate our cybersecurity controls and a cybersecurity firm to conduct continuous threat detection, response and remediation.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Role of the Board. Our board of directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the board of directors in particular is responsible for overseeing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the board of directors, including members of the Audit Committee, receive periodic reports from management and our third-party service providers to assess the primary cybersecurity risks we face.


text: Role of Management. Our Senior Vice President, Information Technology and our Director of Information Security are together responsible for the day-to-day management of our cybersecurity risks. These professionals have extensive experience in the information technology area, including cybersecurity. In particular, our Senior Vice President, Information Technology has more than 30 years of professional experience in the field of management information systems and information security, including with other companies in our industry. Further, our Director of Information Security has more than 20 years of experience in the information security area, with a career spanning roles with the U.S. Air Force, healthcare, academia and private consulting, and holds various certifications related to cybersecurity.


text: Security Incident Response Plan. We have a security incident response plan in place. The incident response plan is a set of coordinated procedures that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.


text: The Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are standalone from the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Company has implemented technical safeguards that are designed to defend the Company's information systems from cybersecurity threats. These safeguards include network security capabilities such as firewalls, intrusion prevention and detection systems; endpoint protection capabilities such as anti-malware functionality; and access controls, which are evaluated for accuracy on a quarterly basis. The Company has also implemented email protection to minimize phishing attacks and ensure integrity in digital communications. We baseline our assets according to the technical controls recommended in the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). • Cyber Intelligence & Continuous Monitoring: The Company has established continuous monitoring of our environment through a third party and receives alerts on threats and policy violations to ensure we meet our 96 hour window to report material matters to the SEC. The Company is a member the Defense Industry Base ("DIB") and receives cyber intelligence based on current threat actors and tactics, techniques and procedures ("TTP's") from the DIB organization, the Federal Bureau of Investigation ("FBI") cyber division, Department of Homeland Security, and the National Security Agency Cybersecurity Collaboration Center ("NSA CCC"). • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts annual tabletop exercises that simulate a cyber-attack to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The Company performs quarterly penetration tests against both externally facing assets and internal assets. The Company also performs monthly and ad-hoc vulnerability scanning. Lastly, we collaborate with the NSA CCC to scan our public facing assets for vulnerabilities against the latest advanced persistent threats. The results of such assessments, audits, and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board oversees the Company's risk management program, including the management of cybersecurity threats. The Board will receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company's peers and third parties. The Board will receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board will discuss the Company's approach to overseeing cybersecurity threats with the Company's Chief Information Security Officer ("CISO") and other members of senior management.


text: The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to defend the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate. To ensure prompt reporting and compliance with SEC requirements, the Board has adopted a "Cybersecurity Incident Materiality Assessment Policy."


text: The CISO is a retired Air Force veteran who has served in various roles in information technology, information security and the U.S. Government for over 30 years. The CISO most recently served as the Chief Information Security Officer of Optiv Security and previously served as the Executive Director, Classified Cybersecurity, at Lockheed Martin. The CISO holds an associates degree in criminal justice from the Community College of the Air Force, an undergraduate degree in information technology from the University of Phoenix, and a graduate degree in information systems security from Colorado Technical University. The CISO has attained the professional certifications of Certified Information Systems Security Professional with a concentration in Management, Certified Chief Information Security Officer, and Certified Ethical Hacker.


text: Material Effects of Cybersecurity Incidents Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.


text: Cybersecurity Strategy and Risk Management Atkore's commitment to cybersecurity emphasizes maintaining secure technology and data environments and the cultivation of a security-minded culture and capability. We do this through education and training, and a layered approach to identifying, preventing, detecting, responding to and recovering from cybersecurity threats and incidents. Key elements of our program for assessing, identifying, and managing material risks from cybersecurity threats are anchored in widely used and industry recognized security frameworks and are described below.

companyName: Atkore Inc.

ticker: ATKR


text: We maintain cybersecurity policies that articulate Atkore's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Atkore employee, we regularly educate and share best practices with our employees to raise awareness of cybersecurity threats. Atkore employees participate in monthly training and testing. In addition to training, Atkore conducts table-top exercises as often as twice a year to simulate cybersecurity risk and response scenarios.


text: Our cybersecurity team implements measures designed to ensure that Atkore can quickly identify and mitigate cybersecurity risks. Our controls are designed to restrict access to locations that house significant physical information technology assets. Other controls include the use of multifactor authentication, various third-party tools, network security technologies, and a crisis playbook. Our notification policies and processes are escalated to the appropriate personnel on a timely basis to support effective review, response, and compliance with legal requirements. Data is also aggregated to support the identification of trends for forward looking oversight.


text: Key elements of Atkore's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity, and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Cybersecurity is one of six topical areas required to be addressed as part of the annual ERM program. Cybersecurity risks are scored using the same methodology applied to all other risks. This helps evaluate the significance and prioritization of cyber-related risks relative to wider business risks. Members of Internal Audit present annually to the Atkore Board of Directors a report on the results of the ERM process. This includes cybersecurity risks. We periodically engage external consultants to assess our cybersecurity program.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are likely to materially affect Atkore, including our business strategy, results of operations or financial condition. For more information on risks relating to our cybersecurity threats, see Item 1A, "Risk Factors-Risks Related to Our Business-Interruptions in the proper functioning of our information technology ("IT") systems and the IT systems of those with whom we do business, including from cybersecurity threats, could disrupt operations and cause unanticipated increases in costs or decreases in revenues, or both."


text: Our Information Security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Governance and Oversight At the management level, Atkore's cybersecurity program is led by the Company's Vice President - Chief Information Officer ("CIO"), who is a member of the Executive Leadership Team. Atkore's CIO has over 30 years of experience in information technology roles with responsibilities including global cybersecurity strategy, global IT strategy, technology platforms and internal controls. The CIO has a Master of Business Administration from Kellogg School of Management at Northwestern University and a Bachelor of Science in Computer Information Systems from DeVry Institute of Technology. Reporting to the CIO is a Director of Cybersecurity. The current Director of Cybersecurity has over 20 years of experience in information technology roles with responsibilities including cybersecurity and security architecture and engineering. The CIO is supported by the Cybersecurity Steering Committee ("CSC"), a management committee comprising members of the Executive Leadership Team and the leaders of the information technology, legal, finance, human resources, commercial and communications functions that report to the Chief Executive Officer. The CSC supports the CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation, and remediation.


text: At the Board level, Atkore's cybersecurity is overseen by a subset of the full Board of Directors, specifically the independent board members. This oversight includes a quarterly review of Atkore's cybersecurity program, including key program metrics, initiatives, and developments. In addition, in the event of a significant cybersecurity incident, Atkore's policy and process require engagement of, and consultation with, the Board of Directors.


text: Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and reporting processes are designed so that members of our senior management receive timely and adequate information regarding cybersecurity matters that impact the Company, including threats and incident response. We have implemented an approach to assess, identify and manage cybersecurity risks within our overall enterprise risk management program that shares common methodologies, reporting channels and governance processes and is based on a recognized framework established by the National Institute of Standards and Technology.

companyName: MOOG INC.

ticker: MOG-A


text: Cybersecurity risks, both internal and from third parties, are tracked regularly. We have established plans and procedures to guide us through an active threat or incident in order to return to normal business operations. We have developed a notification process to allow for real-time escalation of material cybersecurity incidents by and among members of our Corporate IT Security Team ("CIST").


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President - General Counsel, Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.


text: In addition, our IT infrastructure management program maintains an IT Crisis Response Plan ("ICRP") where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement.


text: We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis.


text: In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.


text: Our process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: Cybersecurity Governance Our Board of Directors ("Board") is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks.