text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The Company conducts regular risk assessments on systems and applications to help detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also currently relies on services provided by Kellanova, under the Transition Service Agreement.

companyName: WK Kellogg Co

secItem: Item 1C


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures on how to define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and defines the process for assessing impact for materiality purposes. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For further discussion of these risks, see "Risk Factors—Risks Related to Our Intellectual Property and Technology—Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."


text: Governance The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates from the Chief Information Security Officer on a periodic basis on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.


text: As of February 25, 2025, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. There have been instances of unauthorized access to company assets, including both those managed directly by the Company and those managed by vendors or stored in vendor systems containing company information. These systems have also been, and will likely continue to be, vulnerable to threats such as computer viruses, malware, malicious code, social engineering attacks, unauthorized access attempts, password theft, physical breaches, employee errors, misconduct, and cyber or phishing attacks. For a more detailed discussion of our cybersecurity risks, see "Risks Related to Our Intellectual Property and Technology - Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."


text: Cybersecurity risk management and strategy Ginkgo integrates risk management into its overall cybersecurity strategy, and has implemented processes designed to identify, assess, prioritize and manage risks to protect Ginkgo's data, intellectual property and information assets. As part of our risk governance and management, Ginkgo has developed processes designed to: identify and assess risks, evaluate those risks against pre-defined criteria, develop and implement strategies to address identified risks, monitor and review those risks and communicate risks to relevant stakeholders. Identifying Ginkgo's cybersecurity risks involves a multifaceted approach that encompasses both internal assessments and external information sources. For example, we use security audits conducted by internal and external auditors to assess compliance with security policies and industry frameworks; vulnerability assessments to discover vulnerabilities in networks, systems and applications; penetration testing using simulated cyberattacks to test the resilience of systems and identify weaknesses; and risk assessment processes to evaluate IT infrastructure, including using a risk register to identify risks, likelihood of their occurrence, potential impact, and remediation. We also oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Cybersecurity risk management is overseen by Ginkgo's Chief Information Security Officer ("CISO"), who is supported by full-time information security staff. The CISO advises the executive team on the development and implementation of the information security program.


text: Ginkgo incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, Ginkgo has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, "Significant disruptions to our and our service providers' information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."


text: Cybersecurity governance The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the " Audit Committee ") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of public and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.


text: Ginkgo also has a Disclosure Committee, which is composed of representatives from executive leadership from various departments across Ginkgo (e.g., legal, finance, accounting). Their role is to determine materiality of a cyber incident and provide guidance with respect to any disclosure obligations resulting from a cyber incident.


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), who has over 20 years of experience in information security and technology leadership, and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, our information security team also regularly conducts penetration testing of our business and information systems in close collaboration with a third-party expert, and promptly remediates identified vulnerabilities to prevent any potential compromise of our systems or data.


text: Using threat models and intelligence, we regularly assess a range of cyber threats, including hacking attempts, malware attacks, phishing schemes, infrastructure intrusions, and insider threats. In conjunction with our ongoing threat and vulnerability assessments, we evaluate the various ways, and the extent to which, cyberattacks may materially impact our business, including financial loss, regulatory penalties, reputation damage, and litigation risks. In this rapidly evolving cybersecurity environment, we recognize staying informed about emerging cybersecurity threats and industry best practices is an indispensable part of assessing and identifying cybersecurity risks, particularly within the manufacturing sector. Our involvement includes active participation in industry associations, sharing threat intelligence, and collaborating with regulatory bodies and law enforcement. This collaboration strengthens our defenses against potential threats to our financial and information systems.


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, security monitoring tools, and multi-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including senior management and the Board.


text: Our Board of Directors has the overall oversight responsibility for our risk management, and delegates the cybersecurity and other risks relating to our information controls and security to our Audit Committee. Both the Audit Committee and the full Board regularly receive updates from our management on cybersecurity matters and our ongoing risk management efforts, and actively participate in ongoing discussions. In addition, the Board and the Compensation Committee review and approve the key performance indicators applicable to all management personnel responsible for effectively managing cybersecurity risk management programs at UCT, and engage in regular review of the Company's performance against those indicators.


text: We continue to face cybersecurity risks related to our business. While these risks have yet to materially affect us, we cannot guarantee that our ongoing and increasingly robust approach towards cybersecurity will be able to prevent cybersecurity incidents that could have a material adverse effect on us. For additional information about cybersecurity risks we face, see the risk factor item "Our business may be adversely affected by IT disruptions, including by impairing our ability to effectively deliver our products or services, which could cause us to lose customers" in Item 1A-Risk Factors.


text: Risk Management and Strategy We have developed a cybersecurity program that continuously evaluates material risks to our business and applies controls in an attempt to help avoid or mitigate them. Our key cybersecurity risks include, among others: brand and reputational damage, business disruption, regulatory and compliance risk, sensitive data loss, and reliance on third parties.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: We recognize cybersecurity as an enterprise risk, and accordingly cybersecurity risk has been integrated into our overall risk management process. As part of our overall enterprise risk management process, we have established our management-level Risk Committee, composed of our Chief Information Officer, Chief Information Security Officer, Chief Legal Officer and Chief Financial Officer, among others, which assesses overall risks to the Company based on input from our other business leaders. We have also implemented an incident response process that is overseen by our Chief Information Security Officer, who reports to the Chief Information Officer and is supported by a multi-level incident response process led by our cybersecurity team. This is a documented framework that addresses our processes to assess, identify, and manage material risks from cybersecurity threats and incidents, which are prioritized for response and remediation efforts. Our incident response process includes analysis of the impact of a cybersecurity threat or incident for materiality to ensure proper reporting. Our incident response process is continually enhanced and validated through tabletop exercises and engagements with third-party partners.


text: We engage third parties and auditors to assess our cybersecurity program, including the use of select penetration testing and threat intelligence services, and to assist us in adopting and implementing industry-standard practices to improve our cybersecurity program. We have also retained third parties for cybersecurity incident response engagement in the event that a cybersecurity threat or incident requires capabilities beyond those of our own cybersecurity program. In addition, we have a third-party managed security operations center that provides 24/7 monitoring and alerting, threat intelligence, and posture recommendations. We are members of the Retail and Hospitality Information Sharing and Analysis Center, with more than 250 member companies from the retail, hospitality, and travel industries, which enables us to benchmark our cybersecurity risks, identify and adopt industry-standard practices for our cybersecurity program, subscribe to threat intelligence alerts, and contribute to the collective defense of our industries.


text: We have a process to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. We conduct a third-party risk assessment program through the use of assessment templates, surveys and contractual requirements that evaluates certain potential and current vendors in connection with our security standards. If, following an evaluation, a third-party's cybersecurity controls are assessed by us as inadequate based on risk, we work with our business partners to engage a replacement vendor and remediate or seek to reduce our exposure, if any.


text: While we are subject to continuous cybersecurity threats and attacks like most companies, we are not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors," cybersecurity threats are continually evolving to become more sophisticated and there is a risk that we could experience compromise of our information technology systems and data. Accordingly, while we continue to make significant investment in physical and technological security measures, including third-party services designed to help us anticipate cyber-attacks and prevent breaches, we cannot provide assurance that we will be successful in adequately responding to, or preventing, cyber-attacks. We also maintain cybersecurity insurance that is regularly reviewed to assess whether there is appropriate coverage.


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of strategic risk, including cybersecurity risk oversight. The Audit Committee receives regular reports on at least a quarterly basis from our cybersecurity team, typically on, among other things, our cybersecurity posture, cybersecurity benchmarking, potential cybersecurity vulnerabilities, and other cybersecurity interest items such as the external cybersecurity environment, items requiring Audit Committee input, and our broader cybersecurity program roadmap, in order to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The Audit Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: Role of Management We have established a management-level Risk Committee, that is led by the Chief Legal Officer, and also includes the Chief Information Officer and Chief Financial Officer, as well as certain of their respective Team Members. The Risk Committee meets on at least a quarterly basis to review enterprise risks, including with respect to cybersecurity, as applicable. Enterprise risks, including cybersecurity risk, are briefed to the Audit Committee on at least a quarterly basis by our Chief Legal Officer in coordination with the Chief Information Officer and Chief Financial Officer, or through general updates. In addition, our cybersecurity team, led by the Chief Information Officer, works cross functionally with our legal and other business functions to provide cybersecurity training and, as appropriate, manage cybersecurity risks and incidents.


text: Our Chief Information Officer and our Chief Information Security Officer each have more than two decades of experience in technology and cybersecurity. The cybersecurity team has related academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks and is responsible for building out the materials for review by leadership.


text: Risk Management and Strategy Mattel has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which include developing, implementing, and maintaining cybersecurity measures and controls. Mattel considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk; impact on Mattel and others, including retail customers, suppliers, consumers, or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on operations.

companyName: MATTEL INC /DE/

ticker: MAT


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, identity and access management, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.


text: Mattel seeks to identify vulnerabilities and mitigate risks from cybersecurity threats posed by its use of third-party technology, information systems, and service providers through oversight by Mattel's information technology ("IT") organization through a variety of processes, including conducting onboarding due diligence, imposing contractual obligations related to privacy and information security, and regularly monitoring the performance of third parties providing critical support systems.


text: To support incident response preparedness, Mattel has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact Mattel or arise from Mattel's use of third-party technology, information systems, and service providers. Mattel also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that Mattel relies upon. Further, Mattel monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.


text: As part of Mattel's overall risk management program, Mattel's IT organization has a governance, risk, and compliance group that provides oversight regarding IT-related risks, including cybersecurity risks, and monitors Mattel's IT control environment. This group also works with Mattel's Internal Audit team to assess Mattel's cybersecurity processes. In addition, Mattel's IT organization has a steering committee comprised of internal privacy and cybersecurity experts, chaired by Mattel's Chief Information Security Officer ("CISO"), which is responsible for the development and maintenance of Mattel's privacy and information security programs and regularly reports to Mattel's Chief Technology Officer ("CTO").


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the event of future attacks or other cyber incidents.


text: Mattel's CISO has more than twenty years of cybersecurity industry experience at Mattel and elsewhere and is responsible for coordinating cybersecurity efforts within Mattel, with a focus on cybersecurity threat prevention, detection, and mitigation, as well as enhancement of privacy and security measures, including security updates, security architecture and engineering, and identity access management. Mattel's CISO reports to the CTO, regularly communicating risks and other relevant information related to cybersecurity threats and incidents. Mattel's CTO has significant leadership, cybersecurity, and technology experience, is responsible for overseeing the monitoring and mitigation of cybersecurity threats, and advises and consults Mattel's senior management regarding material cybersecurity risks.


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Mattel and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Mattel systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees Mattel's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.


text: Risk Management and Strategy. We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats that is aligned with the National Institute of Standards and Technology framework. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We maintain technical and organizational safeguards, including regular employee training and phishing simulations, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.


text: From time to time, our processes are audited and validated by internal and external experts. We leverage third-party cybersecurity experts with the goal of minimizing disruption to our business and production operations, strengthening supply chain resilience in response to cyber-related events, and supporting the integrity of IT systems. We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration tests to help identify exploitable cybersecurity vulnerabilities. Our IT team assesses these testing results and implements any appropriate measures to mitigate vulnerabilities identified.


text: We rely on various third-party service providers and a cybersecurity incident at any of our third-party service providers could materially adversely impact us. We evaluate third-party service providers from a cybersecurity risk perspective using a range of measures, including information security and cybersecurity due diligence assessments, ongoing monitoring and evaluation of our providers, examination of available System and Organization Controls attestation reports, and inclusion security and privacy contractional provisions in our agreements with our providers. However, we rely on our third-party service providers to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.


text: We have not experienced any material impacts from any cybersecurity threats or incidents in the last three fiscal years. We use each cybersecurity threat or incident as an opportunity to review our protocols and implement enhancements as applicable. For more information about our risks from cybersecurity threats, see Item 1A—Risk Factors—A failure of one or more of our key information technology ("IT") systems, networks, processes, associated sites, or service providers could have a negative impact on our business.


text: Governance. The Audit Committee of our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reported to our Chief Financial Officer during 2024. Our Vice President of Information Technology and Security provides updates on cybersecurity threats and risks to the Audit Committee of our Board of Directors throughout the year. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2024 as part of their oversight of our enterprise risk management process.


text: Our Vice President of Information Technology and Security has over 25 years of experience in IT and has held a variety of IT roles across multiple business lines within the financial services, aviation, and hospitality industries. He received both his bachelor's and master's degrees in information management and holds Certified Information Systems Security Professional ("CISSP") certification.


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Interim Chief Executive Officer and Chief Financial Officer, as appropriate.


text: Risk management and strategy With respect to cybersecurity risks, we have invested and continually invest in new cybersecurity services, technologies, and capabilities. On an ongoing basis we provide our employees with comprehensive cybersecurity awareness training around phishing, malware and other cybersecurity risks, all in a manner reasonably intended to educate employees to safely avoid cyber attacks and mitigate the risk of employee related security breaches. In support of our cybersecurity program, our systems and services undergo regular reviews by management to determine if any insufficiencies in cybersecurity exist.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: If an incident is detected, our cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that cybersecurity incident is determined to be material, the appropriate public disclosures are made.


text: We monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and reevaluate these risks periodically. We also perform third-party cybersecurity audits at least annually and conduct third-party security reviews and testing of our network, processes and systems periodically.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition We rely on our computer networks and systems, some of which are managed by third-parties, to manage and store electronic information (including sensitive data such as confidential business information, personally identifiable data and personal health information), and to manage or support a variety of critical business processes and activities. We may face threats to our networks from unauthorized access, security breaches and other system disruptions. Despite our security measures, our infrastructure may be vulnerable to external or internal attacks. Any such security breach may compromise information stored on our networks and may result in significant data losses or theft of sensitive or proprietary information. A cybersecurity breach could hurt our reputation by adversely affecting the perception of customers and potential customers about the security of their orders and personal information, as well as the perception of our manufacturing partners of the security of their proprietary information. In addition, a cybersecurity attack could result in other negative consequences, including disruption of our internal operations, increased cybersecurity protection costs, lost revenue, regulatory actions or litigation. Any disruption of internal operations could also have a material adverse impact on our results of operations, financial condition and cash flows.


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Our Board actively oversees our corporate strategy and enterprise risk management ("ERM") programs, including those relating to cybersecurity and data privacy risks.


text: Our Audit Committee and Nominating and Corporate Governance Committee are primarily responsible for, among other things, overseeing our compliance and ERM programs, information technology systems, and our processes and data, including cybersecurity and data privacy. These responsibilities include reviewing and discussing with management our policies and processes relating to risk assessment and risk management. Cybersecurity and data privacy are regular topics on the Audit Committee's agenda and management reviews at least quarterly the results of cybersecurity monitoring and discusses performance metrics, any incidents identified and potential recommended modifications to our technology, organization training, awareness and governance with our Audit Committee. A summary of these results are also reported by the Audit Committee to the Board at least annually.


text: Management, including our Chief Information Officer, who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards. We have conducted and continue to conduct evaluations of our cybersecurity program through periodic external audits and penetration tests. We also require cybersecurity trainings when onboarding new employees, contractors and other workforce members, as well as annual cybersecurity awareness training for our employees, contractors and other workforce members. Our program is based on industry frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including collecting vendor questionnaires and conducting due diligence in connection with onboarding new vendors. We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat; containing the threat; remediating the threat, including recovery of data and access to systems; analyzing any reporting obligations associated with the incident and performing post-incident analysis. We have relationships with a number of third-party service providers to assist with cybersecurity monitoring, containment and remediation efforts.


text: Management Oversight Our controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology ("IT") Security and Risk Committee, which consists of our Chief Information Officer ("CIO") and internal and third-party cybersecurity professionals. Our CIO has more than 25 years of experience as an IT professional overseeing and supporting IT operations in the biopharmaceutical industry, including several years of experience in cybersecurity. The members of the IT Security and Risk Committee also have expertise in cybersecurity. The IT Security and Risk Committee is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure that the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CIO provides regular briefings to our senior management team on cybersecurity matters, including threats, events and program enhancements.


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management and overseeing our data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) our information governance and cybersecurity policies and programs and (iv) major legislative and regulatory developments that could materially impact our data privacy and cybersecurity risk exposure. On a quarterly basis, our General Counsel, Chief Financial Officer ("CFO") and CIO report to the Audit Committee on information technology and cybersecurity matters, including, as appropriate, key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on our business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures and any major legal developments that could significantly impact our cybersecurity risk exposure.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across our organization, including those risks related to cybersecurity. While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate IT systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our systems, networks and technology.


text: To date, there have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. See the section titled "Risk Factors—General Risk Factors—A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations." in this Annual Rep ort for more information.


text: Risk Management & Strategy Cybersecurity is identified as a top enterprise risk given the company's reliance on information technology systems and networks for business and operational activities. Linde has taken steps to address these risks and concerns by implementing cybersecurity and risk management processes that include advanced security technologies, internal controls, network and data center resiliency and disaster recovery processes.

companyName: LINDE PLC

ticker: LIN


text: Linde is implementing a series of security enhancements based on the Zero Trust principle. Linde maintains a Standard Operating Procedure for Global Security Incident Response that defines how Linde responds to cyber incidents, including escalation, reporting and remediation procedures. Dedicated cybersecurity teams conduct surveillance for potential threats and implement both procedural and technological controls to protect data and to maintain safe, uninterrupted operations. The company engages third parties in connection with these efforts to provide independent analysis and advice on cybersecurity risks, incidents and other cyber security related matters. In addition, to help our people recognize information and cybersecurity concerns and respond accordingly, Linde conducts mandatory trainings and cybersecurity awareness programs for employees.


text: Third party software providers that facilitate Linde's business activities are also sources of cybersecurity risk for the company. Linde performs risk assessment procedures including evaluation of the overall health of the control environment for certain third-party providers.


text: Despite these steps, however, our information technology systems have in the past been and in the future will likely be subject to increasingly sophisticated cyber attacks. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to Linde or our employees and customers or suppliers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on Linde's operations, reputation and financial results. To date, such attempts have not had any significant impact on Linde's operations or financial results.


text: Information and cybersecurity risk management fall under the oversight of the Audit Committee. T he Audit Committee receives an annual review, followed by quarterly updates, of the Company's cybersecurity systems, enhancements, strategies and risk management efforts, and the Chair of the Audit Committee will be promptly notified of any material cybersecurity breach incident. In addition, the full Board reviews cybersecurity as part of its regular risk reviews. Linde has appointed a Global Chief Information Officer (CIO) reporting to the Chief Financial Officer (CFO). A Chief Information Security Officer reports to the CIO and is supported by a global IT security team.


text: Enterprise Risk Management Gulfport increasingly relies on digital technology to optimize our business. As our reliance on technology expands, we are exposed to additional cyber-risks, which we focus on assessing, identifying, and managing. These risks include, but are not limited to: financial risks, operational risks, safety concerns, employee and owner personal information and violation of data privacy or security laws.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Index to Financial Statements Managing Material Risks & Integrated Overall Risk Management We take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology's (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security's (CIS) control framework.


text: We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year we implemented tools that provide additional visibility into lateral movement, enhancements for multifactor authentication, and patching of servers. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur.


text: We acknowledge that—even with advanced security tools—we are only as strong as the people that use our technology. That is why we design phishing simulations and require multiple security trainings for every employee annually. Our partnerships with law enforcement, the Oil and Natural Gas Information Sharing Center and our third party partners continually mature our cyber program as threats evolve.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assess and mitigate cybersecurity threats to us. For example, in addition to our security analysts, we partner with third parties that provide 24/7 security operations monitoring, enhancing our response time. We are also audited by third parties for compliance with information security standards and assess vulnerabilities annually, providing additional expertise that strengthens our security posture.


text: Managing Third Party Risk We also recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and we have processes in place to oversee and manage these risks. We maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Incidents As of December 31, 2024, and for the past five years, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. Cybersecurity Governance We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.


text: Risk Management Personnel Cybersecurity remains a top identified enterprise-wide risk for our business and is overseen by our Chief Information Officer who is responsible for identifying and mitigating information security risks. Our current CIO has 20 years of industry experience and over 10 years of experience with the development, training and controls of effective global enterprise cybersecurity programs. The CIO's responsibilities include but are not limited to: (i) reviewing our enterprise risk register and functional risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) analyzing logs of cybersecurity threats and vulnerabilities; (iv) overseeing prevention, detection, mitigation and remediation efforts; and (v) developing, maintaining, and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Chief Information Officer in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: Board of Director Oversight The Audit Committee receives a detailed cybersecurity update annually from the Chief Information Officer and receives a cybersecurity update quarterly through the ERM program as a key risk.


text: Cybersecurity Risk Management and Strategy Overview of Cybersecurity Risk Management The Company maintains a cybersecurity program that is designed to identify, prevent, detect, respond to, and recover from cybersecurity threats, and protect the confidentiality, integrity, and availability of our information technology, including the information residing on such systems. The Company has a dedicated Chief Information Security Officer ("CISO") with overall responsibility for developing and implementing the global cyber strategy, risk management, and operational initiatives. The Company leverages recognized cybersecurity frameworks to organize, improve, and assess its cybersecurity program and to manage and reduce cybersecurity risk. The global information security team, under the direction of the CISO, develops, implements, and manages cybersecurity-related internal controls and risk processes for the Company, with internal controls consisting of a mix of administrative, technical, and physical controls.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We deploy, configure, and maintain numerous technologies to enforce security policies, detect and protect against cybersecurity threats, and help safeguard the Company's information systems and assets. We operate a Security Operation Center ("SOC") to monitor cybersecurity threats, coordinate incident response resources, and reduce response times. Our internal SOC team is augmented by a third-party managed security services provider. The Company maintains a cybersecurity incident response plan that provides a structured approach for the Company's response to cybersecurity incidents. Under the plan, cybersecurity incidents are escalated based on a defined incident severity scale, including to the Board of Directors as appropriate. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises multiple times throughout the year. These exercises are conducted by internal team members and in some instances with assistance from third-party experts. The Company's cybersecurity program also includes regular cybersecurity trainings for staff. We actively evaluate the training effectiveness and adjust the trainings based on the evaluations.


text: The Company's cybersecurity program is periodically reviewed and adjusted by the CISO's office so that it can remain flexible and responsive as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Engagement of Third Parties We engage third-party cybersecurity consultants and experts to supplement staffing of our SOC as well as to assess, validate, and enhance our security practices, including conducting cybersecurity maturity assessments, vulnerability assessments, and penetration tests. As part of the incident response process described above, we engage third-party experts as needed to support the incident response team, such as external legal advisors, cybersecurity forensic firms, and other specialists.


text: Third Party Service Provider Risk Management Vendor risk assessment is part of the Company's cybersecurity program, which facilitates management of third-party service providers' IT-related risks. Third-party service providers that have access to the Company's network, data and information are subject to a cybersecurity due diligence process and the corresponding security contractual and control requirements based on the nature of the engagement. The vendor risk assessment process is reviewed at least annually.


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on Sealed Air's risks relating to our technologies, systems, and networks.


text: Governance of Cybersecurity Risk Management The Board of Directors has oversight responsibility for our risk management programs, including cybersecurity risk management. The Board of Directors has delegated the specific responsibility of cybersecurity risk oversight to the Audit Committee, although the Board remains actively involved in overseeing cybersecurity risk management, both through presentations given by management during Board meetings, as well as through regular reports from the Audit Committee on its cybersecurity risk oversight activities.


text: Our Chief Information Officer ("CIO") and CISO provide cybersecurity updates to the Audit Committee three times each year and the Board at least annually. These updates cover various topics, including information relating to cybersecurity strategy, program management, and performance trends. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee and the Board of Directors.


text: The Company's management team is responsible for the day-to-day assessment and management of cybersecurity risks. As mentioned above, a dedicated CISO leads the information security team and is responsible for the Company's cybersecurity risk management and strategy. The CISO has a master's degree in cybersecurity from the University of Maryland Global Campus, a degree in computer science from Presbyterian College and more than 15 years of experience in technology, information security and risk management with companies in various sectors. The CISO reports to the CIO, who is responsible for global IT strategy and IT operations across the enterprise. The CIO has a degree in computer science and mathematics from Wofford College and has over 30 years of experience in the IT industry, spanning various roles and sectors.


text: As part of its overall Enterprise Risk Management ("ERM") program, the Company identifies and assesses cybersecurity risks on an annual basis. These assessments are integrated into the Company's cybersecurity program to ensure alignment with broader risk management objectives. The ERM program includes identification, assessment and management of risks, including cybersecurity risks. Business process owners incorporate risk management philosophy, exposures, mitigating activities, and key indicators to develop strategies and actions. The ERM Steering Committee, comprised of senior level executives, is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation actions, and assisting the Board of Directors in overseeing the Company's cybersecurity risks.


text: Risk management and strategy We maintain an information security program designed to identify, assess, and manage material risks arising from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Our President, Product and Technology ("President of P&T"), Chief Data Officer ("CDO"), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations. To help us in assessing these threats, we use various methods, including, as applicable, using a combination of manual and automated tools, subscribing to threat reports and external intelligence feeds, conducting vulnerability assessments and penetration tests, collaborating with law enforcement, and operating a bug bounty program.


text: Depending on the environment, systems, and data, we employ various technical, physical, and organizational measures designed to mitigate material cybersecurity risks, including an incident response plan, incident detection and response processes, a vulnerability management program, disaster recovery/business continuity plans, risk assessments, data encryption, network and access controls, a vendor risk management program, physical security, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: In maintaining these measures, we consider certain principles from recognized frameworks, such as those published by the Committee of Sponsoring Organizations of the Treadway Commission, the International Organization for Standardization, and other applicable industry standards. Our approach to addressing cybersecurity risk is cross-functional and is designed to preserve the confidentiality, integrity, and availability of data by identifying, preventing, and mitigating cybersecurity incidents.


text: From time to time, we engage third-party service providers, including professional services firms, threat intelligence services, cybersecurity consultants, penetration testing firms, and forensic investigators, to assist with identifying, assessing, and managing cybersecurity risks.


text: We also rely on data-hosting companies and other third parties for certain business operations. We mitigate the associated cybersecurity risks through a third-party risk management program, which may include vendor risk assessments, security questionnaires, reviews of vendor security programs, and contractual obligations for vendors to maintain specific security measures.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading "Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor titled "If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects."


text: Our Board oversees our enterprise risk management program, including cybersecurity risk. The audit committee of our Board (the "Audit Committee") is responsible for oversight of our cybersecurity risk management processes, and a cross-functional cybersecurity committee (the "Cybersecurity Committee"), which is comprised of members of our management team, reports to the Audit Committee.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management. Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager. Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company. Prior to that, she held various leadership roles at a computer software company.


text: Members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes. Their responsibilities include hiring appropriate personnel, approving budgets, integrating cybersecurity considerations into our risk management strategy, overseeing security-related reports, communicating key priorities, and helping prepare for cybersecurity incidents.


text: We conduct periodic training to keep personnel informed of cybersecurity threats and to communicate evolving information security policies, standards, processes, and practices. Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee. Our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues. These processes include reporting significant cybersecurity threats, risks, and mitigation activities to the Audit Committee and/or the Cybersecurity Committee, as appropriate.


text: The Audit Committee and the Cybersecurity Committee receive periodic reports, summaries, and presentations from management regarding our significant cybersecurity risks and threats, incidents, and response initiatives. Through our cybersecurity governance practices, we strive to achieve a strong cybersecurity posture and to refine our security measures to respond to emerging threats.


text: Risk Management and Strategy The HHH cybersecurity program is an enterprise-wide, risk-based program that is designed to support the security, confidentiality, integrity, and availability of our systems and information. We conduct periodic assessments of the cybersecurity program to identify and manage material cybersecurity threats and risks using internal teams and independent third parties. The assessment results are used to develop appropriate cybersecurity controls best practices and risk mitigation strategies, which are then implemented throughout the Company.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: We rely on our systems and networks to support our business activities. As some networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.


text: We employ a range of tools and strategies to mitigate cybersecurity risks and regularly test them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training at a minimum on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan. Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of comparable size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.


text: Governance Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual or suspected security incident, executing the Company's incident response plan.


text: The Board of Directors' Technology Committee governs and oversees HHH's cybersecurity program. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform the Board of Directors on important matters. Furthermore, the Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: The Company has engaged third parties to perform information security risk assessments and testing on a periodic basis. It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support security incident detection and response activities. In order to identify and manage risk from third parties, the Company has implemented a third-party cybersecurity risk management program involving the assessment of information security risk related to the third-party, with consideration given to the inherent risk level, the adequacy of the third-party's control environment to mitigate those risks, and areas of residual risk. The breadth and depth of the assessment activities are designed to be commensurate with the nature and scope of the services provided by the third party.


text: The oversight of the Company's cybersecurity risk management processes are integrated into the Company's enterprise risk management process. Our board of directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, to improve long-term organizational performance and to enhance stockholder value. A fundamental part of risk management is not only understanding the most significant risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for a given company. The involvement of our full board of directors in reviewing our business is an integral aspect of its assessment of management's tolerance for risk and also its determination of what constitutes an appropriate level of risk. In connection with its reviews of the operations of our business, the board of directors addresses the primary risks associated with our business including cybersecurity. In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors' systems, or our website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects."


text: Cybersecurity Governance While our full board of directors has overall responsibility for risk oversight, it has delegated oversight of certain risks to its committees, including the oversight of risks from cybersecurity threats. The board of directors delegated the oversight of cybersecurity risks to the Audit, Risk and Finance Committee, which oversees controls for the Company's major financial and security risk exposures. The board of directors, through the Audit, Risk and Finance Committee, oversees the design and implementation of the Information Security Program. The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.


text: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company's General Counsel.


text: The Company's CISO is responsible for assessing and managing risks from cybersecurity threats. The Company's CISO also leads the Information Security group and is responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO and reports directly to the Company's President and Chief Technology Officer. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.


text: The Information Security group, senior leadership and the CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Information Security Program. At least quarterly, the CISO provides updates to the Audit, Risk and Finance Committee, which includes updates on the overall Information Security Program status and compliance, cybersecurity related risks, and recommended changes to the Information Security Program. Senior members of our Information Security and Internal Audit functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee.


text: The oil and gas industry, including the mineral and royalty space, has become increasingly dependent on digital technologies to conduct certain activities. Sitio depends on digital technologies to perform many of its services and to process and record financial and operating data. Sitio therefore recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We seek to assess, identify and manage cybersecurity risks through the processes described below.

companyName: Sitio Royalties Corp.


text: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. We also engage third-party consultants to conduct regular assessments of our cybersecurity safeguards. Our internal Information Technology ("IT") team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on third-party service providers for alerts regarding suspicious activity.


text: Incident Identification and Response We have implemented a monitoring and detection system to help identify cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Cybersecurity Training and Awareness All employees are required to receive annual cybersecurity awareness training.


text: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.


text: Encryption and Data Protection Encryption methods are used to protect sensitive data. This includes the encryption of employee laptops, customer data, financial information, and other confidential data.


text: We engage third-party consultants in connection with our cybersecurity program. For example, we have engaged an independent consultant to not only perform certain testing but to also provide remediation recommendations as applicable regarding our information security program and information technology strategic plan.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, the Company has not been subject to any material cybersecurity incidents. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company's IT function focuses on current and emerging cybersecurity matters. The Company's IT department is led by the Director of IT, who reports to the Company's Executive Vice President, Operations, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, the Director of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. The Director of IT has served at Sitio since 2022 and has over 19 years of experience in managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs at Sitio and similar companies.


text: Through the Company's enterprise risk management program, the Board is responsible for overseeing cybersecurity, information security, and IT risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. The Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and IT risks. As appropriate, the Board or Audit Committee reviews and discusses with management the Company's procedures and practices as well as any potential identified incidents with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Executive Vice President, Operations is responsible for keeping the Board apprised of cybersecurity incidents and the Board is charged with determining the materiality of such incident.


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impac ts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT


text: The Corporate Governance and Nominating Committee of our Board of Directors oversees management of risks associated with corporate governance, including cybersecurity. This committee meets regularly with Corcept management and reports to the full Board of Directors.


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: We design and assess our program based on various cybersecurity frameworks, such as the NIST and the CIS, and align our security program closely to the NIST Cyber Security Framework. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: As of the date of this Annual report on Form 10-K, we have not been materially impacted by any identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on such risks, see Item 1A, "Risk Factors - Business and Operational Risks - If we or our third-party service providers suffer a cybersecurity event, our reputation may be harmed, we may lose clients and we may incur significant liabilities, any of which would harm our business and results of operations."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its overall enterprise risk oversight function and has delegated to the Audit Committee primary oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Information Security Officer regularly briefs the Audit Committee on our cybersecurity program and threat posture. These sessions may address a wide range of topics including recent developments, emerging threats, vulnerability assessments, third-party and independent reviews, and information security considerations arising with respect to our vendors and other third parties.


text: The Audit Committee periodically reports to the full Board regarding its activities, including in relation to its oversight of cybersecurity risks. The full Board also discusses cybersecurity matters with management at least annually.


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has over 95 years of combined experience in IT and cybersecurity matters.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: FS KKR Capital Corp

ticker: FSK


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework, which accords with internationally recognized standards, to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating companies and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: CRH's operating companies and business units use a variety of tools and processes to identify and manage material cybersecurity risks. CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating companies and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating companies and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating company completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating company and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.


text: CRH also provides regular and focused training to aid employees in understanding and complying with relevant Company policies and applicable regulations, including those related to cybersecurity.


text: Assessment and management of cybersecurity risks is a key component of CRH's broader risk governance processes as cybersecurity is a core risk facing the Company. Identification of cybersecurity risks is integrated into CRH's overall ERM framework, with a focus on risks related to information systems, data security, operational technology and technology infrastructure.


text: CRH works closely with multiple external advisors specializing in cybersecurity to improve its ability to identify and detect, protect against, and recover from, cybersecurity incidents. In addition, CRH leverages certain managed service providers to aid in triaging and monitoring potentially malicious activities. CRH is dependent upon third-party service providers for certain IT-related services, and has systems of oversight to evaluate potential risks in certain critical third-parties on whom CRH has a material dependency. These systems would include the use of vendor security questionnaires, vulnerability assessments and annual audits.


text: CRH has not been subject to a cyber-attack that has had a material impact on our operations or financial results. For additional information, please refer to Item 1A. "Risk Factors".


text: Cybersecurity Governance Our Board is responsible for strategy, risk and governance, including oversight of risks from cybersecurity threats. The Board has delegated to the Audit Committee primary responsibility for oversight of cybersecurity risk management and the associated internal control systems. The Audit Committee is currently made up of six independent directors with a range of relevant cybersecurity, information technology and operational technology experience.