text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer ("CISO") on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. Additionally, quarterly advisory services and annual training are provided to the Committee from an independent firm which gives the Committee an outside perspective on the Company's cybersecurity program and keeps them abreast of cybersecurity trends affecting the industry. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer or Chief Financial Officer of any potentially significant cybersecurity incident should one occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.


text: The CISO leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups. The CISO reports to the Chief Technology and Information Officer, who has over 20 years of experience leading technology teams for multi-brand consumer businesses and leads the Company's information technology strategy and oversees the global cybersecurity function.

companyName: PVH CORP. /DE/

ticker: PVH

secItem: Item 1C


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: The Audit Committee of the Board of Directors oversees the technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee of the Board of Directors on our cybersecurity and information security posture semi-annually and on an as needed basis and the full Board of Directors is apprised on an annual basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), customers, as well as senior leadership and the Board, in each case, as appropriate.


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Vice President of Product Security (VP of Product Security) provides additional expertise and focus attempting to ensure the integrity and resiliency of the products and services we provide to our customers. Combined, the CISO and VP of Product Security possess over 50 years of deep information technology, cyber security, program management, and risk experience. The information security organization manages and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We have adopted a risk-based management process used to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture and periodic training, supportive of security, which we believe improves our overall cybersecurity posture.


text: We have also extended our cybersecurity governance to our operational business executives. Mission critical information assets, those that would cause significant business, customer, or employee impact, are periodically presented by technical leadership to the appropriate senior management executive. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. In addition, the Company's Privacy and Cybersecurity Steering committee, which is co-led by the CISO and the VP of Product Security and comprised of leaders from the Company's information technology, innovation, legal and internal audit organizations, meets periodically to ensure the overall Cybersecurity Program is progressing against its goals and new risks are operationally prioritized.


text: We rely heavily on third parties to support our products, business operations and technology services, and a cybersecurity incident at a supplier, subcontractor or partner could materially adversely impact us. Where possible, we endeavor to include information security provisions, audit rights and insurance requirements, in contracts with our suppliers and third-parties based on their level of access to our systems and data. For our most critical suppliers, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee of the Board. We also engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee of the Board of Directors.


text: Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware, and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur. Our processes for assessing, identifying, and managing material risks from cyberecurity threats are described below. These cybersecurity risk managment processes are integrated into our overall risk management system.


text: The Audit Committee of the Board of Directors oversees the Company's technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture on a regular cadence. In addition to this regular reporting, cybersecurity risks or threats may also be escalated to the Audit Committee on an as-needed basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery, escalation to senior management, the Board of Directors, and functional areas, and notification to customers and employees as appropriate.


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, product security, operations and cybersecurity threat detection and response. The CISO has 32 years of experience serving in various information technology roles. The information security organization manages and continually enhances an enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system and product resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We also strive to maintain ISO certification and assurance reporting under AICPA SOC2 for several of our systems and products. We have adopted a risk-based management process to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our information security organization also have a role in our cybersecurity defenses and are required to receive periodic cybersecurity training, which we believe improves our overall cybersecurity posture.


text: We have also extended our cybersecurity governance to our operational business executives. Technical leadership periodically presents an assessment of mission critical information assets, those that would cause significant business, customer, or employee impact to the appropriate senior management executives. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. It ensures that the cybersecurity program in the business unit is progressing against its goals and new risks are operationally prioritized. In addition, the CISO meets with leaders from the Company's legal, IT, and internal audit organizations to ensure alignment with privacy, regulations, legal compliance and audit plans.


text: We rely heavily on third party partners (i.e. suppliers, subcontractors, consultants, etc.) to support our products, business operations and technology services, and a cybersecurity incident at a partner could materially adversely impact us. Where possible, we include information security provisions, audit rights and insurance requirements, in contracts with these partners based on their level of access to our systems and data. For our most critical partners, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select partners, we engage third party cybersecurity monitoring and alerting services, and seek to work directly with those partners to address potential deficiencies identified.


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee. We also engage third party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the organization. The Company and its service providers have experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's information technology ("IT") strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's Global Information Security ("GIS") Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board of Directors (the "Board"), the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.

companyName: BRINKS CO

ticker: BCO


text: Cybersecurity Risk Management and Strategy The Company's Processes for Assessing, Identifying, and Managing Material Cybersecurity Risks The Company's processes for assessing, identifying, and managing cybersecurity risks generally follow frameworks established by the International Organization for Standardization (ISO) and the U.S. National Institute of Standards and Technology (NIST). The Company relies on its IT infrastructure, including the GIS Program, which is designed to reduce cybersecurity risks by ensuring that computer systems are secure through protecting networks, systems, applications, hardware, and data to mitigate cyber attacks. Our business includes managing, processing, storing and transmitting proprietary and confidential data, including personally identifiable information and other confidential information. The Company's IT infrastructure and GIS Program are critical to its business activities, and any unauthorized access to, unplanned disruptions or failures of, or cybersecurity attacks, on these systems pose risks to our business, financial condition and results of operations.


text: The Company has an enterprise risk management ("ERM") program, for which the Board has oversight responsibility. Under the ERM program, senior leaders from across the Company's global footprint annually evaluate risks according to likelihood, significance and velocity to identify and prioritize the most significant risks facing the Company. "IT and Cybersecurity risk" has been identified as part of the ERM program as a significant risk, and the CFO is assigned to this risk area to ensure the development of mitigation plans, monitor progress against those plans, and maintain and measure against a set of key risk indicators.


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources..


text: Cybersecurity Risk Management and Mitigation The Global CISO manages our risk monitoring and mitigation processes and is responsible for cybersecurity risk management. The Company has adopted physical, technological and administrative cybersecurity controls and has defined procedures for incident detection, containment, response and remediation. The Global CISO works with business units and IT to ensure the appropriate policies are in place and to improve efficiency. Our global IT governance, risk and compliance team, which is a part of the GIS Program, manages IT general controls and cybersecurity best practices. We have an internal cybersecurity incident response plan designed to minimize the impact of cyber incidents and ensure consistent responses to any such incident. This plan undergoes regular reviews and updates.


text: The Company builds information security awareness among our employees by conducting regular training on our cybersecurity and data protection policies and executing vulnerability testing with employee simulated email threats. The Company also regularly updates employees on cybersecurity issues, assesses for susceptibility to email phishing and provides tools to alert the global information security team to potential phishing activity. Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns to the Company, including the Brink's GSOC and the Brink's Ethics Hotline. We believe providing ongoing training and real-world learnings to the Company's workforce is a crucial part of ensuring security and defending against future attacks.


text: The Company internally assesses its cybersecurity regularly and engages a third-party external auditor to conduct annual cybersecurity risk assessments, both of which allow us to identify key cybersecurity and data protection risks and develop plans, policies, and procedures to mitigate such risks.


text: We also have a vulnerability management program in place that is designed to protect our external and internal networks and critical assets. In addition, we have designed policies and procedures so that our Disclosure Committee, which is composed of members of management and is co-chaired by the Company's CFO and General Counsel, is appropriately informed of significant cybersecurity matters to ensure compliance with applicable cybersecurity disclosure requirements for our public filings. The Disclosure Committee meets on a quarterly basis and more often as necessary.


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of cybersecurity controls in place. We also perform periodic assessments of our key vendors, which allows the Company to identify vendor cybersecurity risks and to develop reasonable mitigation plans.


text: Impacts of Cybersecurity Threats and Prior Incidents We have experienced and expect to continue to experience cybersecurity attacks and have expended human and financial resources to respond to such attacks.


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2023, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled "Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.


text: Cybersecurity Governance Board's Oversight of Risks from Cybersecurity Threats The Board oversees our ERM program, including the review of cybersecurity and IT risks. The Board is also regularly briefed by the Global CIO, with the support of the Global CISO, on our cybersecurity risk management framework and completed, ongoing and planned actions relating managing to cybersecurity risks. These reports also include updates on the status of projects to strengthen our information security systems, recent assessments of the information security program and the emerging threat landscape.


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Ms. Sethi serves as the Company's Global CIO and reports to Kurt McMaken, the Company's CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to Neelu Sethi, the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a Master's Degree in Computer Science with a concentration in information security as well as multiple information security certifications.


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's IT strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's GIS Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board, the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources.


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of existing cybersecurity controls. We also perform periodic assessments of our key vendors, which allow the Company to identify vendor cybersecurity risks and develop reasonable mitigation plans.


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2024, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled " Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Neelu Sethi serves as the Global CIO and reports to Kurt McMaken, the CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a master's degree in computer science with a concentration in information security as well as multiple information security certifications.


text: PPG's cybersecurity program is designed to protect and preserve the confidentiality, integrity and availability of our networks and systems as well as information that we own or is in our care through a risk-based approach. The Company's program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.


text: PPG has continued to invest in cybersecurity to evolve and improve its program. PPG regularly assesses and measures itself against industry practices to identify opportunities to improve its people, processes and technology used to identify, prevent, detect, respond and recover from cybersecurity incidents. When such improvements are identified and validated as appropriate in PPG's business context, they are incorporated in the roadmap for implementation.


text: To date, the risks from cybersecurity threats have not materially affected the Company. We have significantly increased our cybersecurity investments over the last five years and have implemented cybersecurity safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company. Notwithstanding our increased cybersecurity investments and preparedness activities, sophisticated and targeted computer crime perpetrated by threat actors internal or external to the Company poses a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property and confidential and personal data. This could lead to negative publicity, theft or other financial loss, modification or destruction of proprietary information or key information, manufacture of defective products, production downtimes and operational disruptions, which could materially and adversely affect our reputation, competitiveness and results of operations. Refer to the risk factor titled "The security of our information technology systems could be compromised which could adversely affect our operations or reputations" in Item 1A of this Form 10-K for further detail regarding cybersecurity risks that could affect PPG's operations. We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The PPG Board of Directors (the "Board") has overall responsibility for the oversight of risk management at PPG, which includes cybersecurity risks. The Audit Committee of the Board (the "Audit Committee"), is responsible for oversight of the Company's enterprise risk management ("ERM") program which provides oversight and governance of all of the Company's operational and financial risks including risks from cybersecurity threats to the Company. The Audit Committee receives bi-annual reports and periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from our Vice President and Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are both responsible for overseeing our cybersecurity program. In addition, the full Board receives bi-annual briefings from our CIO on our cybersecurity program. The Board and the Audit Committee also periodically review the results of exercises performed by our advisors as part of an independent assessment of PPG's cybersecurity program and internal preparedness.


text: In addition, the Enterprise Risk Committee, a committee of senior executives who identify and monitor the risks to PPG and are responsible for our ERM program, receives updated information on cybersecurity risks at each of its meetings.


text: As part of their oversight of our cybersecurity program, our CIO and our CISO oversee a team of cybersecurity professionals and are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO and CISO are trained information technology professionals, each of whom has earned degrees in information systems and business administration and has many years of experience in or managing global enterprise information technology at various organizations.


text: PPG maintains an internal communication hierarchy that is designed to communicate the occurrence of certain cybersecurity events and/or incidents into our systems to our CISO, our CIO, our company crisis response team, and, as appropriate, to certain members of senior management. This communication hierarchy includes protocols for informing the Audit Committee and the full Board of certain cybersecurity events and/or incidents and for determining the materiality thereof.


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provisions into various contracts.


text: Cybersecurity Risk Management and Strategy Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of Powell's internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors to monitor and respond to security threats via a 24/7/365 Security Operations Center. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.


text: Third-Party Risk Management We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Information Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.


text: The Audit Committee receives a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the Chief Information Security Officer reports to the Audit Committee on various metrics on threat management, incident response and recovery planning, along with industry benchmarks. The Audit Committee reports on these matters to our Board of Directors as needed. In addition, the Chief Information Security Officer periodically presents directly to our Board of Directors on our cybersecurity program.


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have no material impact on our business including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Item 1A. Risk Factors.


text: Cybersecurity Risk Management and Strategy Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Cybersecurity Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Financial Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.


text: Risk Management and Strategy The Company employs multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a large library of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber intelligence, insights and assessments of its cybersecurity risk posture and governance.


text: Cybersecurity reviews are embedded into the Company's Third-Party Risk Management program. Generally under this program, third parties that process personal data or high-risk business data on behalf of the Company complete privacy and cybersecurity assessments on a risk basis, which may require such third parties to sign data processing agreements, comply with particular security controls or complete an additional security and privacy assessment.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. However, as of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we have faced in the past and expect to continue to face in the future, please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews at least annually the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers any key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.


text: The Company's management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks. Within management, the Company's CISO has specific responsibility for cybersecurity risk management, reporting to the CIO.


text: The Company's CISO has over 15 years of experience in cybersecurity, information security and information risk management, including several years each in security engineering and in operations, as well as running incident response organizations. The CISO's organization includes a dedicated team of centralized information security experts and a network of security professionals embedded in each business unit and function.


text: The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.


text: 10 The Procter & Gamble Company A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.


text: Risk Management and Strategy The Company employs multiple tools and processes for assessing, identifying and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program. When cybersecurity risks are identified through the Enterprise Risk Management program or otherwise, they are reported to relevant business and governance leaders within the Company for appropriate action.


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews, at least annually, the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.


text: 10 The Procter & Gamble Company The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.


text: A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ internal resources and, regularly, external resources, to evaluate our environment, information systems, and processes.


text: Through appropriate risk evaluation, security assessments, and financial due diligence, we seek to protect the security and confidentiality of information provided to our vendors under service provider cloud computing or other arrangements. We also employ contractual nondisclosure requirements and use limitations consistent with our published Privacy Policy, and typically reserve the right to review third-party compliance against the required standards, where we deem appropriate.


text: Our response to cybersecurity threats is triggered through various means. Through annual user awareness training, we teach our employees to identify and appropriately respond to such threats. Our incident response program is designed to mitigate and recover from suspected and actual cybersecurity incidents and provide all required consumer and regulatory notices regarding cybersecurity threats in a timely manner.


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the Chief Executive Officer, other members of the executive team, and the Board of Directors' Technology Committee. Our CSO has served in this capacity at Progressive for more than 11 years and, prior to joining us, had over 10 years of cybersecurity experience in the banking industry. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology and cybersecurity experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks rapidly evolve and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data and information that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.


text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ a variety of internal resources to evaluate our environment, information systems, and processes. In addition, we engage third parties to test the vulnerability of our cybersecurity infrastructure on a regular basis and we have a third-party assessment performed annually.


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the CEO, other members of the executive team, and the Board of Directors' Technology Committee. Assuming the role in 2012, our CSO has served in this capacity at Progressive for more than a decade and, prior to joining us in 2010, had over 10 years of cybersecurity experience in the banking industry in security and risk management leadership roles, primarily focused on cybersecurity and banking compliance, with additional experience in the areas of anti-money laundering and financial fraud. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks evolve rapidly and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.


text: PSCo is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: PUBLIC SERVICE CO OF COLORADO


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.


text: The Company's information technology systems, as well as those of the Company's third party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of or disruptions in the information technology systems of the Company or its third party service providers, could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.

companyName: PUBLIX SUPER MARKETS INC


text: The Board of Directors and Audit Committee have oversight responsibility for the Company's cybersecurity risks. While the Company's employees play a key role in cybersecurity, the Company's Chief Information Officer, General Counsel and other members of management have shared responsibility for assessing and managing the Company's cybersecurity risks. The Company's management has sufficient knowledge, experience and expertise for assessing and managing the Company's cybersecurity risks. The Board of Directors and Audit Committee receive updates from management regarding cybersecurity risks, cybersecurity threats that could impact the Company and cybersecurity initiatives to enhance the Company's cybersecurity practices. The Audit Committee also receives updates on the results of assessments and audits of the Company's information technology systems and controls.


text: The Company has information technology security practices to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: • cybersecurity controls embedded in the Company's information technology systems; • implementation of changes to address potential threats and vulnerabilities of the Company's information technology systems; • incident response program, including proactive simulations, to identify and manage cybersecurity threats, risks or incidents; • participation in industry forums and collaboration with peers; and • security awareness and data protection training for applicable employees.


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.


text: The Company assesses cybersecurity risks and changes in the cyber environment and adjusts its practices as deemed appropriate. To date, risks from cybersecurity threats have not materially affected, or are not reasonably likely to materially affect, the Company's business strategy, financial condition or results of operations. Refer to Item 1A. Risk Factors in this Annual Report for additional information on risks related to the Company's business, including cybersecurity risks.


text: The Company's information technology systems, as well as those of its third party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of or disruptions in the information technology systems of the Company or its third party service providers, could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.


text: Additionally, the Company assesses and manages cybersecurity threats associated with the information technology systems of its third party service providers that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: As of the date of this report, we are not aware of any risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, individually or in the aggregate.


text: The Board, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. Management provides cybersecurity updates to the Audit Committee, at least quarterly, and material cybersecurity incidents are reported to the Board.


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Director, Global Security that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.


text: The Global Cyber Security team reports to the Chief Digital Information Officer ("CDIO"), who in turn reports to the Chief Executive Officer ("CEO"). Refer to the "Information about our Executive Officers" section, which appears in Item 4(a) of this report for more information about the CDIO's relevant professional experience and qualifications.


text: Risk Management and Strategy Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into five categories: identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinates the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity products. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties and including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks. In response to these risks, we have implemented cybersecurity processes, technologies, and controls detailed below to aid in our efforts to assess, identify, and manage cybersecurity risks. Our Global Cyber Security team works to identify, assess and manage cybersecurity threat risks, their severity, and potential mitigations.


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Senior Director, Cybersecurity and Compliance that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data security and privacy, enterprise risk management, cloud security and ethical hacking.


text: Risk Management and Strategy Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into six categories: govern, identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinate the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity tools and program. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: Our executive leadership team is responsible for the global risk management framework and influences the culture of risk management within the Company. Additionally, our Board is responsible for oversight of the executive leadership team's approach to risk management and cybersecurity strategy. The Board recognizes the importance of maintaining security and the trust of our customers, clients, business partners and associates. The Company has developed a cybersecurity program founded on a strong management approach, policy driven governance, standards and procedures, and execution of a comprehensive strategy that adapts to changing risks. The Company's cybersecurity policies and standards are fully integrated into our overall risk management process and were created based upon the National Institute of Standards and Technology cybersecurity framework and other applicable industry standards. The Company endeavors to manage cybersecurity risks through a comprehensive and multidisciplinary approach that emphasizes confidentiality, security, and availability of our information by deploying processes to support identification of cybersecurity threats and using tools for prevention and mitigation of cybersecurity incidents. To the extent that cybersecurity incidents may occur, the Company has established cross functional procedures that enable a prompt and effective response to cybersecurity incidents.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Risk Management and Strategy Our global risk management policy provides a uniform approach for monitoring, identifying, measuring and responding to enterprise-wide risk to minimize potential disruptions to business operations and harm to reputation. Our global risk management policies framework encompasses, enterprise risk management, business continuity and cybersecurity. Cybersecurity risk is a key component of our overall global risk management policy. The Company's cybersecurity program is focused on the following areas: • Governance: In furtherance of the Board's risk management oversight goals, the Company convenes a Risk Committee comprised of key functional and business leaders. Among other members, the Risk Committee includes our Chief Information Security Officer ("CISO"), our Director of Global Risk and Property Management, our Vice President, Internal Audit, and our Vice President, Environmental, Health and Safety. This diverse group supports a strong focus on cybersecurity, business continuity, and associated enterprise risks. The Risk Committee's members are charged with, among other things, identifying and assessing significant and emerging risks, as well as working with executive leadership teams to develop and execute plans, responses and mitigation strategies to address significant cybersecurity risks, that could otherwise negatively impact our ability to achieve our objectives. The Risk Committee's cybersecurity management function addresses the Company's information security challenges and risks from various IT-related sources. • Collaborative Approach: The Company has developed and implemented a robust approach to identify, prevent and mitigate cybersecurity threats and incidents. This is supported by clear and direct cross-functional escalation paths to ensure proper handling and analysis so that decisions regarding response, materiality and any resulting disclosure and reporting of such incidents are clearly allocated and can be made in a timely manner. • Technical Safeguards: The Company employs industry accepted security tools, techniques, and system monitoring to protect the confidentiality of our systems and data. Maintaining the privacy and security of our associate, customer, and supplier data is paramount. The company deploys technical safeguards which include, but are not limited to, encryption, multi-factor authentication, network segmentation, privilege access management and, endpoint detection and response. These safeguards are evaluated on a routine basis with the intention of identifying and remediating potential vulnerabilities and enhancing the overall security framework. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive cyber incident response policy. This policy provides direction and guidance to address and manage security incidents, including identification, classification, and response. • Third-Party Risk Management: The Company maintains a risk-based approach to third party engagement and the cybersecurity risks associated therewith. This approach adheres to Company-policy, which includes regularly evaluating and identifying material risks from cybersecurity threats associated with third parties' access to our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides annual mandatory global information security training and certification for personnel regarding cybersecurity threats. This training is offered in 20 languages to maximize associate accessibility and comprehension. Additionally, the Company administers monthly targeted trainings and phishing simulations for our associates. These activities are designed to develop a mature and vigilant, risk-aware culture among our associates.


text: The Company completes periodic assessments and testing of its practices addressing cybersecurity threats and incidents. These efforts include, but are not limited to, audits, assessments, tabletop exercises, and vulnerability testing and are focused on evaluation of cybersecurity policy efficacy. These assessments and testing efforts are supported by third-party consultants who specialize in cyber-risk mitigation. The results of these third-party engagements are used to inform enhancements and adjustments to our cybersecurity policies and practices.


text: Our full Board is responsible for the oversight of the Company's operational and strategic risk management processes. Our Board believes that oversight of risk management belongs at the full Board level rather than with any single committee, primarily because of the importance of understanding and mitigating risk to the overall success of our Company. As part of its risk management responsibilities, our full Board provides oversight of the Company's management and mitigation of cybersecurity risks.


text: To gather information about risks to the organization, including cybersecurity, the Risk Committee identifies primary areas that generate enterprise risk and then distributes a survey to a group of our top leaders. The Risk Committee periodically summarizes its activities and findings (including the results of its survey and heat map analysis) related to cybersecurity and other risks directly to our CEO, as well as the Audit Committee and our full Board. The Risk Committee's work is also used by our management team as part of our disclosure controls and procedures to ensure that information regarding material risks applicable to the Company are appropriately disclosed in our public filings.


text: While our Board maintains responsibility for oversight of all areas of risk management, it relies on our Audit Committee to address significant financial risk exposure we may face and the steps management has taken to monitor, control and report such exposures. These risks are further reported to the full Board, as appropriate.


text: The Risk Committee receives prompt information regarding any cybersecurity incident in accordance with our cyber incident response policy and crisis communication procedures. The Risk Committee, in concert with the executive leadership team, evaluate this information and escalates notice to the Board, as appropriate.


text: The CISO works collaboratively with the Risk Committee. The CISO has implemented and monitors a program designed to protect the Company's information systems and to promptly respond to any cybersecurity incidents in accordance with the documented incident response plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are engaged to identify, classify, and address cybersecurity threats and incidents. Through prompt notifications and ongoing communications, the CISO and other key management personnel work to monitor, prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The Company's cybersecurity programs are supported by experienced and knowledgeable leaders. The CISO has served in various roles related to information technology and information security for over 20 years. The CISO maintains relevant certifications, including Certified Information Systems Security Manager ("CISM") and Certified Information Systems Auditor ("CISA"). Additionally, several cybersecurity team members reporting directly to the CISO maintain certifications, including CISM, CISA and Certified Information System Security Professionals ("CISSP"). The Company's Chief Digital & Information Officer has over 30 years of experience with information technology and digital strategy. The Company's CEO, CFO and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including those resulting from previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.