text: Cybersecurity risk management is integrated with our overall risk management framework overseen by our Enterprise Risk Management Committee – a management level committee, including senior management and other leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments. Our Enterprise Risk Management Committee is responsible for approving policies to support the management and implementation of the cybersecurity program. Our policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of our information in accordance with Finance Agency regulations and applicable laws. Additionally, the Enterprise Risk Management Committee recommends the annual information technology strategic plan to senior management prior to Board review and approval. This committee receives regular reporting from our chief information security officer similar to what is provided to the Board, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.


text: Our chief information security officer, who reports both to our chief risk officer and our chief information officer, manages the cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of our information technology assets and data under our control. Our chief information security officer has approximately six years of experience with the FHLB in successively more responsible roles and has led teams to design, secure, implement, and audit numerous technology solutions. Our information security group is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by the Board and management committee. They are experienced and knowledgeable in both technology and cybersecurity and maintain industry recognized security certifications.

companyName: Federal Home Loan Bank of Cincinnati

secItem: Item 1C


text: The business continuity program is overseen by the Business, Operations, and Technology Committee of the Board and includes business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Enterprise Risk Management Committee is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the Board.


text: At Meta, cybersecurity risk management is an important part of our overall risk management efforts. Our industry is prone to cybersecurity threats and attacks, and we regularly experience cybersecurity incidents of varying degrees. We believe we are a particularly attractive target as a result of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. Our products and services reach billions of users and involve the collection, storage, processing, and transmission of a large amount of data. In addition, our business and operations span numerous geographies around the world, involve thousands of employees, contractors, vendors, developers, partners, and other third parties, and rely on software and hardware that is highly technical and complex. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Meta Platforms, Inc.

ticker: META


text: We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. However, we may not be successful in fully addressing such areas for remediation or enhancement. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment (TPA) process. Under our TPA process, we gather information from certain third parties who contract with Meta and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the audit & risk oversight committee of our board of directors (Audit & Risk Oversight Committee). Our Audit & Risk Oversight Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The privacy & product compliance committee of our board of directors (Privacy & Product Compliance Committee) oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including through the Audit & Risk Oversight Committee and Privacy & Product Compliance Committee.


text: Our Chief Information Security Officer (CISO), Guy Rosen, leads our cybersecurity program and oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Mr. Rosen has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Mr. Rosen has served in a number of significant leadership roles at our company since 2013, including oversight of security, safety, and integrity initiatives, and was appointed as our CISO in 2022. Prior to joining our company, Mr. Rosen served in senior leadership, engineering, and operational roles across technology organizations.


text: Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO is part of the senior management team at the company and regularly updates the Audit & Risk Oversight Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: TrueCar, Inc.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: proactively review systems and applications, audit against applicable data security policies, perform penetration testing to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: • detection of a security incident, • identification and containment, • response, eradication and recovery, and • post-incident analysis. Incident responses are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the company and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third party risks, and we have a third-party risk management program designed to identify and mitigate risks from vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when selecting third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business" included within Item 1A of this Annual Report on Form 10-K. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. As part of our Board's overall responsibility for oversight of management's general risk identification and management activities, our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee review and discuss with management and our auditors the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy. Members of the Audit Committee also receive cybersecurity updates on a quarterly basis from senior management. This update includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams. These individuals have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third-party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: proactively review systems and applications, audit against applicable data security policies, perform penetration testing to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Our risk management program also assesses third-party risks, and we have a third-party risk management program designed to identify and mitigate risks from vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when selecting third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams, including our Director of Cybersecurity and Compliance. These individuals have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: As a global cybersecurity provider, cybersecurity risk management is an integral part of our overall enterprise risk management program. We recognize the critical importance that a strong cybersecurity risk management program plays in maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. We have established processes and procedures for identifying, evaluating, and responding to risks from cybersecurity threats, including any potential unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems, data, or information assets.

companyName: Palo Alto Networks Inc

ticker: PANW


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents. Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following: • Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems, data, and information assets. The organizational, administrative and technical measures we implement are based on recognized security frameworks established by the National Institute of Standards and Technology, security measures aligned with the ISO/IEC 27000 series of standards, and other generally recognized industry standards. The program is assessed regularly and in light of new and emerging cybersecurity risks. • Technical Safeguards and Product Security. We deploy and maintain a variety of technologies to prevent and detect cybersecurity threats across the network, endpoint and cloud. We also apply security-by-design principles in our software development lifecycle, track vulnerabilities of open-source software, and run internal and external network scans at least weekly and after any meaningful change in our network configuration. We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data. We also employ tooling in certain areas to help prevent deviations from policy. • Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps. We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications and accounting, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition. This allows for prompt direction of appropriate personnel and resources for incident management and response, and internal notification to appropriate members of management, which may include our chief executive officer, chief product officer, chief information security officer, general counsel, chief financial officer, and/or chief accounting officer, and the security committee of our board of directors (the "Security Committee"). The protocols also establish steps designed to publicly report and/or alert external stakeholders as and when required by applicable law or otherwise determined appropriate.


text: • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by certain third parties, including vendors, service providers, suppliers, operations parties, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes a security process to conduct due diligence prior to engaging contractors and vendors and assess the security capabilities of subcontractors and vendors on a periodic basis. • Risk and Readiness Assessments. We engage in at least quarterly assessments and testing of the effectiveness of our cybersecurity risk management program and incident response protocols that are designed to identify and evaluate vulnerabilities and weaknesses, address cybersecurity threats and test our readiness to respond to cybersecurity incidents. These efforts include, but are not limited to, threat modeling, vulnerability scans, penetration testing, audits, and tabletop exercises. We regularly engage third parties to perform assessments on our cybersecurity measures, such as audits and independent reviews of our compliance with various security compliance standards, including those established by the American Institute of Certified Public Accountants, operating effectiveness and penetration tests. The results of such assessments are reported to management and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Awareness and Training. We provide regular training for educating employees about corporate policies and procedures and information security designed to provide our employees with knowledge of best practices and effective tools for safeguarding our data and assets and reducing security risks based on the human threat vector. Our information security compliance training, data protection training, and code of conduct training is mandatory for all employees. • Governance. As discussed in more detail below under the heading, "Cybersecurity Governance," our board of directors' has delegated oversight of enterprise security risk management, including, but not limited to, cybersecurity risk management to the Security Committee. As part of our cybersecurity risk management procedures, senior members of management and the Security Committee are informed regarding security events based on established reporting thresholds, and are provided ongoing updates regarding any such meaningful threat or incident.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition, to date. However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions. For additional information regarding these risks, please refer to Part I, Item 1A, "Risk Factors," in this Form 10-K, including, but not limited to, the risk factor entitled "A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results."


text: Cybersecurity Governance The Security Committee, which is composed of all of our independent directors, facilitates our board of directors' responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks. The Security Committee reports regularly to the Board following meetings of the Security Committee with respect to its review and assessment of security matters and other matters that are relevant to the Security Committee's discharge of its responsibilities. The Security Committee meets quarterly to review with our chief information security officer and other members of management, which may include our chief executive officer, chief product officer, chief financial officer, and general counsel, our cybersecurity programs, cybersecurity risks, mitigation or remediation strategies, and other matters impacting the committee's responsibilities.


text: Management is responsible for day-to-day risk management activities, including identifying, assessing and managing our exposure to cybersecurity risks, establishing processes and procedures to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures as needed, and maintaining cybersecurity risk management programs. Our chief information security officer is responsible for defining, overseeing, managing, implementing, and reviewing compliance with the information security programs described above under the heading "Cybersecurity Risk Management and Strategy." Our chief information security officer receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. In addition, as described in further detail above under the heading "Cybersecurity Risk Management and Strategy," a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.


text: Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties. In particular, our chief information security officer has extensive experience in the management of cybersecurity risk management programs, having served in various roles in information technology and security for over 20 years, including having previously served as the chief security officer of two other publicly traded technology companies. In addition, six of the ten members of our board of directors have expertise in overseeing cybersecurity and information security management.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents. Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following: • Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems, data, and information assets. The organizational, administrative and technical measures we implement are based on recognized security frameworks established by the National Institute of Standards and Technology, security measures aligned with the ISO/IEC 27000 series of standards, and other generally recognized industry standards. The program is assessed regularly and in light of new and emerging cybersecurity risks. • Technical Safeguards and Product Security. We deploy and maintain a variety of technologies to prevent and detect cybersecurity threats across the network, endpoint and cloud. We also apply security-by-design principles in our software development lifecycle, track vulnerabilities of open-source software, and run internal and external network scans at least weekly and after any meaningful change in our network configuration. We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data. We also employ tooling in certain areas to help prevent deviations from policy. • Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps. We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications, and finance, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition. This allows for prompt direction of appropriate personnel and resources for incident management and response, and internal notification to appropriate members of management, which may include our chief executive officer, chief product and technology officer, vice president acting as chief information security officer, general counsel, chief financial officer, and/or chief accounting officer, and the security committee of our board of directors (the "Security Committee"). The protocols also establish steps designed to publicly report and/or alert external stakeholders as and when required by applicable law or otherwise determined appropriate.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition, to date. However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions. For additional information regarding these risks, please refer to Part I, Item 1A, "Risk Factors," in this Form 10-K, including, but not limited to, the risk factor entitled "A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results. "


text: Cybersecurity Governance The Security Committee, which is composed of our independent directors and chaired by our chief product and technology officer, facilitates our board of directors' responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks. The Security Committee reports regularly to the Board following meetings of the Security Committee with respect to its review and assessment of security matters and other matters that are relevant to the Security Committee's discharge of its responsibilities. The Security Committee meets quarterly to review with our vice president acting as chief information security officer and other members of management, which may include our chief executive officer, chief product and technology officer, chief financial officer, and general counsel, our cybersecurity programs, cybersecurity risks, mitigation or remediation strategies, and other matters impacting the committee's responsibilities.


text: Management is responsible for day-to-day risk management activities, including identifying, assessing and managing our exposure to cybersecurity risks, establishing processes and procedures to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures as needed, and maintaining cybersecurity risk management programs. Our vice president acting as chief information security officer is responsible for defining, overseeing, managing, implementing, and reviewing compliance with the information security programs described above under the heading "Cybersecurity Risk Management and Strategy. " This vice president receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. In addition, as described in further detail above under the heading "Cybersecurity Risk Management and Strategy," a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.


text: Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties. In particular, our vice president acting as chief information security officer has extensive experience in the management of cybersecurity risk management programs, having served in various roles in information technology and security for over 25 years. In addition, six of the eleven members of our board of directors have expertise in overseeing cybersecurity and information security management.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Workday, Inc.

ticker: WDAY


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such material risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) a variety of tools designed to monitor our networks, systems and data for suspicious activity; (5) an internal red team program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (6) a threat intelligence program designed to model and research our adversaries; and (7) a variety of privacy, cybersecurity, and incident response trainings and simulations. We leverage industry standard security frameworks, including from the National Institute for Standards in Technology (NIST), the International Organization for Standardization (ISO), and the American Institute of Certified Public Accountants (AICPA), to evaluate our security controls, which vary in maturity across the business and are processes we work to continually improve.


text: We also maintain a privacy and cybersecurity incident response program to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cybersecurity incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party service providers, including those in our supply chain and those who have access to our customer or employee data or our systems. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings "We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results," "If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected," and "If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities" included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday's business strategy. Additionally, the Board has delegated to our Audit Committee oversight of cybersecurity risks and processes to manage them. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.


text: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer ("CISO"). Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.


text: Our CISO leads all aspects of our global cybersecurity program, including the identification, evaluation, and prioritization of security risks, as well as the company's response to material security incidents. Our CISO joined Workday in 2010 and has served as our CISO since April 2018. Our CISO has more than 15 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm. He also has a degree in information systems management.


text: Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks. This team includes our CIO, our Chief Privacy Officer, and our Chief Legal Counsel. This team contributes to the development of the company's cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions. This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.


text: We also maintain a privacy and cybersecurity incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cybersecurity incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: When appropriate, we use external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls and risk assessment process. Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party service providers, including those in our supply chain and those who have access to our customer or employee data or our systems. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings " We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results," "If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected," and "If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities " in our "Risk Factors" included in Part I, Item 1A of this report, which disclosures are incorporated by reference herein.


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday's business strategy. Additionally, the Board has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.


text: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer ("CISO"). Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.


text: Our CISO leads all aspects of our global cybersecurity program. Our CISO joined Workday in 2010 and has served as our CISO since April 2018. Our CISO has more than 20 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm. He also has a degree in information systems management.


text: Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks. This team includes our CIO and our Chief Legal Counsel. This team contributes to the development of our cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions. This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.


text: Cybersecurity Risk Oversight and Risk Assessment We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: BOISE CASCADE Co

ticker: BCC


text: One of the key functions of our board of directors is to provide informed oversight of our risk management processes. While management is assigned responsibility for the day-to-day response to material risks we face, our board of directors maintains responsibility for risk oversight, including risks related to cybersecurity threats. The Audit Committee of our board of directors is responsible for discussing risk exposures relating to cybersecurity, including current and emerging developments and threats, and the steps management has taken to monitor and control such exposures. The Audit Committee is composed of board members with diverse expertise, including financial, governance, and information security and controls, which equips them to oversee cybersecurity risks effectively.


text: Our cybersecurity risk identification and assessment process is integrated into our enterprise risk management process. Our board of directors and key members of management across the organization rank previously identified risks, identify new or emerging risks, and provide commentary on the financial or strategic impact these risks could have on the Company. The risk survey responses are analyzed in the context of our business, recommendations are made where appropriate, and ownership of risk response is assigned to specific individuals. The results of this process are presented to our board of directors at least annually. In addition, our Information Technology (IT) Director provides quarterly updates to our board of directors on cybersecurity incidents, cybersecurity awareness activities, including results of mock-phishing exercises, regulatory and compliance matters specific to cybersecurity, and activities related to business continuity, including data validation and restore testing and tabletop exercises. Risk assessment for cybersecurity threats is embedded into these quarterly updates, with each topic discussed being assigned a risk level.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: Cybersecurity Risk Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT Director. Our current IT Director has been in his position since 2014 and has over 30 years of information technology, finance, and operational experience in our organization. Our IT Director is certified in governance of enterprise IT (CGEIT), is a Certified Data Privacy Solutions Engineer (CDPSE) and a Certified Information Systems Auditor (CISA). Our IT Director and other IT leaders systematically use the Control Objectives for Information and Related Technology (COBIT) framework as an IT governance framework and remain educated on other best practices in compliance, projects, and processes. In addition, our IT Director reviews our operational plan annually with our operating segments, which includes review and discussion of a cybersecurity risk management framework.


text: Our information services department, led by our IT Director, manages and continually enhances our information systems with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We work to install new and upgrade existing information technology systems. We recognize the importance of preventative controls in mitigating the risk from cybersecurity threats and have implemented measures such as anti-virus security, two-factor authentication, web filtering, browser isolation tools, and mobility safeguards to enable enhanced security on personal devices. In addition, we provide mandatory cybersecurity training to our employees around phishing, malware, and other cybersecurity risks to ensure that we are protected, to the greatest extent possible, against cybersecurity risks and security breaches.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage independent third parties to penetration test our systems, consult on security enhancements, and perform industrial control system audits. In addition, our IT-related internal controls over financial reporting are audited by our independent external auditors. These practices allow us to leverage specialized knowledge and insights, identify risks, and continuously improve our information technology internal controls and processes to respond to the evolving cybersecurity threats.


text: We also acknowledge the risks associated with third-party service providers. We employ a risk-based due diligence process of engaging and managing third-party relationships. The third-party management program is integrated into our enterprise risk management process to measure risks and evaluate current and evolving resource needs. We perform risk assessments of new and existing service providers, develop and maintain a proactive approach to address non-compliance, and establish monitoring plans based on risk scores. This process continues throughout the lifecycle of the third-party relationship. Initially, new third parties are segmented into risk categories based on reputational/sanction screenings, geographical location, contractual obligations, financial arrangements, data transfer/sharing agreements, subcontractor/additional entity relationships of the third party, and business relationship oversight feedback. When the ongoing risk monitoring identifies a change in risk profiles, monitoring plans are adjusted as appropriate to ensure proper controls are in place and due diligence is applied to mitigate higher-risk relationships. These practices are designed to mitigate risks related to data breaches and other security incidents originating from third-party service providers.


text: Monitoring and Responding to Cybersecurity Incidents and Data Breaches Management reduces the risk of cyber incidents by monitoring network traffic through security controls, including firewalls, intrusion detection/prevention systems, anti-virus/anti-malware systems, cyber threat intelligence, and vulnerability monitoring tools. We use extended detection and response (XDR) technology to integrate network, endpoint, and cloud data to stop sophisticated attacks by detecting malware and exploit threats, including using artificial intelligence (AI) behavioral analytics. We also partner with a security operation center (SOC) to provide 24-7 outside monitoring services for additional support to the internal IT team.


text: We have an established cross-functional IT incident response team, which includes our IT Director, to respond to cyber incidents effectively and to coordinate communications that may be necessary in the event of an incident. The incident response team has a prescriptive plan to track cyber incidents and responses and has established communication protocols when an event occurs, enabling better reporting of such events. Our incident response plan includes involving law enforcement, as needed, depending on the nature of the attack. Members of the IT incident response team and data breach team, discussed in more detail below, maintain relationships with key suppliers and other entities in order to collaborate and communicate about ongoing cyber threats that may impact the Company.


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of the data breach response team members, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.


text: In addition, we perform quarterly incident response and data breach tabletop exercises, which are simulations of cybersecurity incidents that are designed to test the effectiveness of our incident and data breach response plans. These exercises identify potential process improvements, opportunities to enhance the incident and data breach response plans and help prepare for actual cybersecurity incidents.


text: We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, we have made it a priority to ensure the risk of cybersecurity threats is integrated into our risk assessment and risk management processes.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage independent third parties to penetration test our systems, consult on security enhancements, and perform industrial control system audits. In addition, our IT-related internal controls over financial reporting are audited by both our internal auditors and independent external auditors. These practices allow us to leverage specialized knowledge and insights, identify risks, and continuously improve our information technology internal controls and processes to respond to the evolving cybersecurity threats.


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a data breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of each team member, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 21.

companyName: Federal Home Loan Bank of Chicago


text: In alignment with industry standards, such as the National Institute of Standards of Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risks through a layered approach throughout our environment and in our service provider arrangements, including software-as-a-service and infrastructure-as-a-service engagements. We look to continuously improve our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk management program, which works in tandem with the Bank's Enterprise Risk Management program, includes risk management practices, procedures, and technology solutions aimed at addressing potential cybersecurity threats faced by the Bank in alignment with the Bank's strategic plans, risks tolerance, and enterprise operational risk policy. Cybersecurity risk-mitigation processes include, but are not limited to, performing regular risk assessments to identify, understand and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, real-time network monitoring; on-going employee training to educate employees on how to identify and avoid various forms of social engineering; performing routine threat monitoring (including use of a third party service provider monitoring) and controls testing; and maintaining a vulnerability management program to timely identify and remediate cybersecurity risks. The Bank also maintains a Cyber Security Incident Response Plan (CSIRP) to determine how cybersecurity threats and incidents are identified, classified, escalated, mitigated and remedied. The CSIRP is implemented and maintained by the Bank's threat and incident response team and overseen by our Chief Information Security Officer (CISO). Additionally, the Bank maintains a business resiliency management program to mitigate and respond to critical disruptive events (such as fire, cybersecurity incidents, and power loss). Our business resiliency management program (as further discussed below) includes, but is not limited to, testing our disaster recovery plans and reviewing department level business continuity procedures.


text: We regularly engage with third parties, including cybersecurity experts, to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews. Additionally, the Bank seeks to identify, monitor and prioritize substantial risks from cybersecurity threats associated with our use of critical third parties. As part of its risk assessment, the Bank endeavors to use the information obtained from these efforts to reach a reasonable conclusion as to that third party's cyber risk management protocols.


text: During the period covered by this report, the risk from cybersecurity threats or incidents did not have a material impact on our strategy, results of operations, or financial condition. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident may result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of data, as well as the likely extent and effect of lost revenue, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank' risk tolerance conditions. Our Board of Directors provides oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated) controls.


text: Our Bank Operational Risk Oversight Committee (OROC) (a management level committee, consisting of members of our senior leadership) and its subcommittee, the Technology Risk Sub-Committee (TRSC) (consisting of representatives across the Bank, including from the Risk Management and Information Technology groups), are responsible for reviewing our cybersecurity risk management program's efforts and activities to track the progress of the program's support of the Bank's objectives. TRSC (and to the extent necessary, OROC) receives regular reporting from our CISO including information security metrics, material technology changes and cybersecurity threats being monitored. The Bank's Executive Team is the primary management committee for the Bank across all functions and receives reports from the OROC, Technology Risk Sub-Committee, and the CISO as appropriate on matters impacting cybersecurity risks.


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 13 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.


text: Our business resiliency management program is overseen by our Board of Directors and its Operations and Technology Committee, which provides oversight of the Bank's implementation of the program and maintenance of the plans that reflect the Bank's current operating environment and risk tolerance. The implementation of our business resiliency management program is delegated to our Executive Team and their designees, and the Bank's OROC is responsible for the direct governance, oversight and monitoring of the program.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 18.


text: Cybersecurity Governance Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank's risk tolerance conditions. Our Board of Directors provides Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated)


text: oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and controls.


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 14 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.


text: Cybersecurity Risk Management and Strategy We are subject to cybersecurity risk, which includes intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risk can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering, such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. Refer to Item 1A — Risk Factors for a description of cybersecurity and other operational risks that may affect our information technology assets and data under our control.

companyName: Federal Home Loan Bank of Boston


text: In alignment with industry standards, such as the NIST Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.


text: We also maintain a business continuity program designed to ensure that resources and plans are in place to protect the Bank from potential loss during a disruption, which includes the unavailability of our information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. These business continuity resources and plans include, but are not limited to, maintaining a business continuity site to ensure continued operations, regular backing up of data and systems, testing our ability to operate on disaster recovery systems, and annually reviewing department level business continuity procedures.


text: We regularly engage with third parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, incident response exercises, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews.


text: Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents during the period covered by this report. However, to assess, identify, and manage risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested, and expect to continue to invest, significant resources to maintain and enhance our information security and business continuity programs designed to preserve the confidentiality, integrity, and availability of our information technology assets and data under our control. As a result, the risk of cybersecurity threats has materially affected our business strategy. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of each cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members, any loss of or unauthorized access to data, lost revenue, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors and our Management Committee, the Bank's highest-level governance, strategic planning, oversight, and policymaking group, on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.


text: Our Bank Technology Governance Committee, a management level committee, consisting of members of our senior leadership, including our chief risk officer and chief information officer, is responsible for approving policies to support the management and implementation of the cybersecurity program. This committee receives regular reporting from our director of information security similar to what is provided to the board of directors, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology with the Bank in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.


text: The business continuity program is overseen by the Finance Committee of our board of directors and includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Operational Risk Committee, a management level committee, including leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments throughout the Bank, is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the board of directors.


text: In alignment with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.


text: Cybersecurity Governance Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.


text: Cybersecurity Risk Management and Strategy The Bank has implemented processes for assessing, identifying, and managing risks from cybersecurity threats or incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition. Please refer to Item 1A. Risk Factors for a description of cybersecurity incident and threat risk.

companyName: Federal Home Loan Bank of Atlanta


text: The Bank's cybersecurity risk management framework for assessing, identifying, and managing risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data and include specific controls for the monitoring, mitigation, and reporting on cybersecurity risk management. Those processes include information security policies, incident response and business continuity plans focusing on the Bank's appropriate response to threats and incidents and operations and business continuance.


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee, and reported to the board. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses, and minimize the impact to service to members during a disruption event, which includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact with, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced minor cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service the Bank's members and protect the privacy of their data entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board's Enterprise Risk and Operations Committee oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.


text: The Bank's Security Governance Committee is led by the chief information security officer and has a cross-functional membership comprised of representatives from the Bank's operational risk, information security, information technology, legal, operations, and other departments that provide both specific, technical and multidisciplinary expertise to the committee. The committee has integrated oversight of the information security program, the physical security program, and is responsible for reviewing security policies and procedures, security exceptions and violations, the processes and standards to implement the policies and procedures defined in the cybersecurity risk management program, the Bank's cyber incident response plan, the security awareness program and implementation reports, and for providing guidance and monitor progress on major information security projects, and regulatory changes and requirements.


text: The Bank has a dedicated Information Security Department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk and that handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect the Bank against those risks, responsible for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.


text: The combined expertise of the Bank's chief information officer and the chief information security officer in cybersecurity include graduation in Computer Science, Certification in Risk and Information Systems Control (CRISC), Certification in Information Systems Security Professional (CISSP), and Certification in Information Systems Auditor (CISA), along with decades of experience in computer science, information and records security, business continuity, technology governance and compliance, technology risk services, cyber risk assessments, security operations monitoring and response, incident response, security strategy and architecture, awareness training, threat intelligence, identity and access management, vulnerability and penetration testing, maturity assessment, impact analysis, disaster events, recovery response, business resiliency, third party systems due diligence, deep knowledge of software systems and platforms, implementation methodologies, and various technology systems servicing internal and external customers.


text: The Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.


text: Bank policies and processes are designed such that the board would receive prompt and periodic information from management or the Security Governance Committee on any cybersecurity or information security incident or threat that may pose significant risk to the Bank and would continue to receive regular reports on any incident or threat until its conclusion. The Bank's Enterprise Risk and Operations Committee also receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, or more often, as necessary, the Enterprise Risk and Operations Committee discusses cybersecurity and information security risks with the Bank's chief information officer and chief information security officer.


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses and the impact to service to members during a disruption event. A disruption event includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service its members and protect the privacy of their data entrusted to the Bank, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.