text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all of the information systems we use. Incidents may lead to reputational harm, revenue and client loss, legal actions, or statutory penalties, among other consequences. For a more detailed discussion of these risks, see our discussion in the Risk Factors in Item 1A of this report.


text: The Board of Directors has delegated primary oversight of the Company's cybersecurity risk to the Audit Committee, which receives updates on cybersecurity risks, risk mitigation initiatives, and incidents at each regularly scheduled Audit Committee meeting from the CIO, CISO, and other members of management, as needed. When making decisions regarding director appointments and committee assignments, the Board of Directors takes into consideration the cybersecurity experience of directors and director candidates and strives to maintain cybersecurity expertise on the Board of Directors and Audit Committee. We have protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board of Directors.

companyName: UNION PACIFIC CORP

ticker: UNP

secItem: Item 1C


text: At the management level, our CIO, CISO, and Deputy CISO, each of whom has extensive cybersecurity knowledge and skills gained from over 28 years, 29 years, and 20 years of relevant work experience, respectively, head the Internal Cybersecurity Team that is responsible for implementing and maintaining cybersecurity and data protection practices across our business, with our CIO reporting directly to our Chief Executive Officer. Our CISO and Deputy CISO receive reports on cybersecurity threats from a number of experienced information security professionals for various parts of our business on an ongoing basis and, in conjunction with other management personnel, regularly consult on risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: In addition, our Risk and Compliance Committee (RCC) is responsible for oversight and support of the Company's Enterprise Risk Management and Compliance and Ethics programs and is comprised of the Executive Leadership Team and the Senior Vice President and Chief Accounting, Risk, and Compliance Officer (Compliance Officer). The RCC also created a subcommittee, the Enterprise Risk Management Committee (ERMC), who is charged with continually monitoring, evaluating, and managing enterprise risks. The ERMC includes the Compliance Officer, General Auditor, Vice President Law - Finance, Compliance and Commercial Litigation, Vice President and Chief Safety Officer, CISO, Vice President - Strategy and Corporate Development, and Assistant Vice President - Executive Services. The RCC and ERMC both meet throughout the year and receive periodic updates on cybersecurity from the CISO.


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Cybersecurity risk oversight is a focus area of our Risk Management Committee and the full Board of Directors. The Risk Management Committee's charter requires it to assist the Board of Directors in identifying and evaluating risks inherent in our business and to oversee and review the significant policies, procedures, and practices employed to manage risks. The Risk Management Committee receives a quarterly cybersecurity update from the Chief Administrative Officer, which is shared with the full Board of Directors. The Board of Directors discusses cybersecurity matters and risks on a quarterly basis or more frequently, as needed, at the recommendation of the Risk Management Committee.


text: The Company's executive enterprise risk management committee (the "Executive ERM Committee") is tasked with, among other responsibilities, identifying and evaluating operational risks, which includes risks associated with information technology and cybersecurity. The Executive ERM Committee includes senior leaders across business functions, including the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer, Chief Risk Officer and Chief Administrative Officer. The Executive ERM Committee, as part of its comprehensive risk management duties, discusses Company strategies to prevent cyber-attacks and the Company's response and remediation of threats. The Chief Administrative Officer provides a quarterly report to the Risk Management Committee that summarizes cybersecurity risks, relevant events and other items of note identified by management or the Executive ERM Committee. The Executive ERM Committee meets independently of the Risk Management Committee, with a representative from the Risk Management Committee in attendance. Certain members of the Executive ERM Committee are invited to attend and participate in meetings of the Risk Management Committee.


text: In addition, we maintain internal working groups called "corporate risk register groups" dedicated to assessing and managing the various ERM risks facing the Company. There are two corporate risk register groups that relate to cybersecurity risk: Cyber Incident Prevention and Cyber Incident Recovery; the Chief Administrative Officer is the leader of both of these risk register groups. The Chief Administrative Officer likewise serves on the Business Continuity Team as the business continuity technology lead, a role in which she comprehensively evaluates IT system readiness and preparedness should a business continuity event involving cybersecurity or technology interruption occur.


text: The lead management team member responsible for cybersecurity matters is the Chief Administrative Officer, who has 20 years of experience in information technology and a B.A. in Management Information Systems. She is assisted by the Information Security Manager and the Assistant Vice President and Senior Corporate Counsel for Privacy and Governance.


text: Cybersecurity Program We have adopted a Written Information Security Program (WISP) designed to align with the guidelines recommended by the National Institute of Standards and Technology (NIST). We have made ongoing continuous improvements to our information security program; specifically in the implementation of secure remote access solutions with multifactor authentication, next-generation endpoint detection and remediation, cloud-based security controls, automated scanning and outside validation of security controls. Additionally, we require employees to complete cybersecurity training at least annually. When a specific cyber threat is identified, we may create additional trainings with targeted content for our employees. As part of our efforts to manage our cybersecurity risks, we have engaged an independent firm to assist with conducting penetration tests and provide advice on our information security program. We also carry insurance to mitigate losses from cyber events.


text: We have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. All proposed third parties are subject to a preliminary assessment to identify those that may handle or have access to company information and scope appropriate due diligence activities relating to the engagement. Third parties that may handle or have access to company information are subject to enhanced due diligence procedures prior to onboarding and security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by third parties and information obtained through other channels. In addition, we require our providers to adhere to appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party service providers, as appropriate.


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address – and guide our employees, management and the Board of Directors on – our response to a cybersecurity incident, including the requirements of notification, classification, analysis and communication of cybersecurity incidents based on the identified severity level. The Executive ERM Committee regularly reviews and evaluates the corporate incident response plan and business continuity plan.


text: Cybersecurity Threats To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, for additional discussion about cybersecurity-related risks.


text: Cybersecurity risk oversight is a focus area of our Risk Management Committee and the full Board of Directors. The Risk Management Committee's charter requires it to assist the Board of Directors in identifying and evaluating risks inherent in our business and to oversee and review the significant policies, procedures, and practices employed to manage risks. The Risk Management Committee receives a quarterly cybersecurity update from the Chief Administrative Officer (CAO), which is shared with the full Board of Directors. The Board of Directors discusses cybersecurity matters and risks on a quarterly basis or more frequently, as needed, at the recommendation of the Risk Management Committee.


text: The Company's enterprise risk management committee (the "ERM Committee") is tasked with, among other responsibilities, identifying and evaluating operational risks, which includes risks associated with information technology and cybersecurity. The ERM Committee includes senior leaders across business functions, including the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer (CFO), Chief Legal Officer, Chief Risk Officer (CRO) and CAO. The ERM Committee, as part of its comprehensive risk management duties, discusses Company strategies to prevent cyber-attacks and the Company's response and remediation of threats. The CAO provides a quarterly report to the Risk Management Committee that summarizes cybersecurity risks, relevant events and other items of note identified by management or the ERM Committee. The ERM Committee meets independently of the Risk Management Committee, with a representative from the Risk Management Committee in attendance. Certain members of the ERM Committee are invited to attend and participate in meetings of the Risk Management Committee.


text: In addition, we maintain internal "risk evaluation teams" dedicated to assessing and managing the entity-level risks facing the Company. There are two risk evaluation teams that relate to cybersecurity risk: Cyber-Attack Prevention and Cyber-Attack Recovery. The CAO and Vice President of Technology Operations participate in both risk evaluation teams. The CAO likewise serves on the Business Continuity Team as the business continuity technology lead, a role in which she comprehensively evaluates IT system readiness and preparedness should a business continuity event involving cybersecurity or technology interruption occur.


text: The lead management team member responsible for cybersecurity matters is the CAO, who has 20 years of experience in information technology and a B.A. in Management Information Systems. She is assisted by the Vice President of Technology Operations, the Information Security Manager and Corporate Counsel, Privacy. The CAO regularly reviews the lines of accountability and responsibility to ensure alignment with the ERM Committee.


text: Cybersecurity Program We have adopted a Written Information Security Program (WISP) designed to align with the guidelines recommended by the National Institute of Standards and Technology (NIST). We make ongoing continuous improvements to our information security program; specifically in the implementation of secure remote access solutions with multifactor authentication, next-generation endpoint detection and remediation, cloud-based security controls, automated scanning and outside validation of security controls. Additionally, we require all employees to complete cybersecurity training at least annually, with additional training targeted for employees with greater data access. When a specific cyber threat is identified, we may create additional trainings with targeted content for our employees. As part of our efforts to manage our cybersecurity risks, we have engaged an independent firm to assist with conducting penetration tests and provide advice on our information security program. We also carry insurance to mitigate losses from cyber events.


text: We have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. All proposed third parties are subject to a preliminary assessment to identify those that may handle or have access to company information and scope appropriate due diligence activities relating to the engagement. Third-parties that may handle or have access to company information are subject to enhanced due diligence procedures prior to onboarding and security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by third-parties and information obtained through other channels. In addition, we require our providers to adhere to appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party service providers, as appropriate.


text: We have established comprehensive incident response and recovery plans and intend to test and refine the effectiveness of those plans under the leadership of the Chief Human Resources Officer, who is accountable for the overall business continuity program at UFG. Our incident response and recovery plans address and guide our employees, management, and the Board of Directors on our response to a cybersecurity incident, including the requirements of notification, classification, analysis and communication of cybersecurity incidents based on the identified severity level. The ERM Committee is accountable for regularly reviewing and evaluating the corporate incident response plan and business continuity plan.


text: We have a process to appropriately identify and escalate incidents that would be considered "material" in nature and require disclosure under the SEC's reporting requirements. Our identification and escalation process requires any potentially material incidents to be escalated to the CAO, who would promptly meet with the ERM Committee to determine if the incident is considered material and trigger a reporting obligation through a Current Report on Form 8-K. We did not experience any material cyber incidents since the beginning of our last fiscal year.


text: Risk Management and Strategy We have implemented cybersecurity controls and processes to identify, detect, protect against, respond to and recover from threats and cybersecurity risks. These threats and risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our approach is informed by external cybersecurity experts and aligns to the U.S. National Institute of Standards and Technology (NIST) framework and standards. Our senior vice president, Technology and Innovation and CIO ("CIO"), who has a Bachelor of Arts in computer science and over 35 years of business experience managing large-scale system environments and the associated risks from cybersecurity threats, and developing and implementing cybersecurity policies and procedures, oversees our cybersecurity program. In addition, our cybersecurity team has a diverse range of certifications from reputable organizations in the field, such as Cybersecurity and Infrastructure Security Agency (CISA), EC-Council (ECC), and Global Information Assurance Certification (GIAC), in addition to many vendor-specific certifications. Our enterprise risk management program considers cybersecurity risks alongside other Company risks. As part of our enterprise risk management process, our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.

companyName: MARATHON OIL CORP


text: Our cybersecurity risk management processes include a suite of IT and security policies and procedures, tabletop simulation exercises, technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We also leverage government partnerships, industry and government associations, third-party benchmarking, internal and third-party audit results, threat intelligence feeds and other similar resources to inform our cybersecurity processes. Our technical controls are regularly evaluated and assessed, including through internal audits, by an annual third-party assessment of our cybersecurity posture and a biannual assessment of our cybersecurity standards, processes and team. Our Information Technology Steering Committee approves the implementation of new technologies and upgrades of our current systems using a formal process that includes a rigorous third-party risk assessment. This assessment evaluates and mitigates cyber risk associated with any new technology or suppliers before they are deployed. We employ continuous monitoring technology that provides real-time updates on our suppliers' cyber security posture, alerting us to any significant changes due to cyber events or technological shifts. In our contractual process with third party providers, we require initial and ongoing certification of their cyber security and data protection standards.


text: To further cybersecurity awareness among our employees and contractors, we leverage formal mandatory training and incorporate other training and educational opportunities. We also maintain a cybersecurity incident response plan to guide our detection, response to, and recovery from cybersecurity incidents, which includes processes for assessing the severity of, escalating, containing, investigating and remediating incidents, as well as complying with legal and regulatory obligations and mitigating reputational impacts. We test our cybersecurity incident response and disaster recovery plans through an annual, scenario-based tabletop exercise. We also have processes and technologies to provide redundant computing and backup operations should a cyber incident occur that requires a full or partial data center recovery.


text: Furthermore, in 2023, we engaged a third party to conduct a Cyber Risk Quantification assessment. This assessment focused on estimating the likelihood and potential financial impact of a widespread ransomware attack within our network. It involved a thorough evaluation of both our current and planned cybersecurity capabilities.


text: Our Audit and Finance Committee, comprised fully of independent directors, is responsible for oversight of cybersecurity risk in connection with its oversight of the Company's enterprise risk management process.


text: Marathon Oil's senior leadership and the Audit and Finance Committee of our Board receive regular cybersecurity updates, with formal reporting to the Audit and Finance Committee at least annually. Our CIO regularly provides reports to senior leadership and the Audit and Finance Committee regarding our ongoing assessment of cybersecurity threats and risks, data security programs designed to prevent and detect threats, attacks, incursions and breaches, as well as management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. In addition, the Audit and Finance Committee and management review reports from internal audit regarding evaluation of our information technology department on a regular basis.


text: To date, the Company has not experienced any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company. For additional information about the Company's cybersecurity risks, please see Item 1A. Risk Factors.


text: As a global aerospace and defense company serving commercial and government customers in the aerospace industry and domestic and international military and government customers as a defense contractor, we are the target of advanced and persistent cyber-attacks from a variety of threat actors. Our products and services are highly sophisticated and specialized, involve complex advanced technologies including information technology systems, and process, store, or transmit highly sensitive unclassified and classified information. Moreover, our products and services are often integrated with third-party products and services. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: RTX Corp

ticker: RTX


text: Our Cybersecurity Program Given the nature of our business and the cybersecurity risks we face, we have a robust cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats, to our internal systems, our products, services and programs for customers, and our supply chain. Our cybersecurity program is made up of two components: our enterprise cybersecurity program and our cybersecurity program for our products and services.


text: Enterprise Cybersecurity. Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology (NIST) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.


text: Product and Services Cybersecurity. Our product development processes apply development, security and operations principles aligned with applicable government and commercial standards including DO-326 and NIST standards and guideline publications, and include vulnerability scanning and static and dynamic composition analysis. We regularly assess our product development processes, product cyber maturity and the teams providing our secure services in relation to cybersecurity. In addition, we strive to meet all security requirements mandated by government and commercial customers and adhere to regulatory guidance and standards for system security engineering. Many of our products also undergo industry audits and regulatory compliance certifications, and our products delivered to the Department of Defense (DoD) must comply with DoD risk management requirements where required.


text: Cybersecurity for U.S. Government Authorized Systems. With respect to products and services provided to, and information technology systems used in connection with programs for, the U.S. government, our cybersecurity program aligns with the NIST standard and meets the requirements of 32 CFR Part 117 and other applicable U.S. government guidance. The program includes authorization and assessment of new and existing IT systems by our customer. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Incident Response. Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage incident response teams based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis.


text: Third Party Service Providers. We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery.


text: Management of Third-Party Risks. Our suppliers, subcontractors and third-party service providers are subject to cybersecurity obligations and controls. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit our information as a service, or connect to our networks. We also require our suppliers, subcontractors and third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase. Many of these third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the U.S. Federal Acquisition Regulation and U.S. Defense Federal Acquisition Regulation Supplement, which obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of their implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.


text: Program Assessment. We continuously evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of our entities, systems and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency (DCMA) and Cybersecurity Maturity Model Certificate (CMMC) Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Enterprise Cybersecurity. Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Special Activities Committee supports the Board in oversight of classified business cybersecurity, including with respect to company internal information and operational technology systems. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role.


text: Our global chief information security officer (CISO), under the direction of our chief digital officer, leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks. Our CISO regularly updates the Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, in addition to updates on enterprise cybersecurity incidents and key Company defenses and mitigation strategies.


text: Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience building and leading cybersecurity, risk management, and information technology teams. In performing his role, he regularly reviews enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: Product and Services Cybersecurity. The Special Activities Committee of our Board of Directors has primary oversight responsibility for cybersecurity risks related to our products and services. The full Board of Directors also receives periodic briefings from management on the Company's product cybersecurity risks and programs. The Audit Committee also considers product and services cybersecurity risks in connection with its financial and compliance risk oversight role.


text: Our product cybersecurity officer (PCO), under the direction of our chief technology officer, leads our cybersecurity program for our products and services and is responsible for assessing and managing related cybersecurity risks. Our PCO updates the Special Activities Committee on cybersecurity risks as they relate to our products and services, in addition to updates on product and service cybersecurity incidents, defenses and mitigation strategies.


text: Our PCO is an experienced embedded systems engineer and chief engineer with nearly 20 years' experience in the development, product assurance, and security of critical and highly regulated embedded and other computer systems in medical, aviation, and military products and services. In performing her role, she regularly reviews cybersecurity risks, controls, program policy and processes, including training, and oversees and advises teams performing policy and program development, implementation and updates. Our PCO is regularly apprised of product and service cybersecurity events, threats and activities including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: Enterprise Risk Management Our cybersecurity risk processes are a key element of our Enterprise Risk Management (ERM) process, which is designed to identify and evaluate the full range of significant risks to RTX Corporation (RTX). As part of our ERM program, RTX's functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our Enterprise Cybersecurity and Product Cybersecurity functions as part of the overall review of significant RTX risks. The top ERM risks are compiled annually and shared with the Audit Committee of the Board of Directors as well as the full Board of Directors. In addition, Internal Audit incorporates these risks into its continuous risk assessment process and periodically audits specific ERM risks.


text: As a global aerospace and defense company serving commercial and government customers in the aerospace industry and domestic and international military and government customers as a defense contractor, we are the target of advanced and persistent cyber-attacks from a variety of sources. Our products and services are highly sophisticated and specialized, involve complex advanced technologies including information technology (IT) systems, and process, store, or transmit highly sensitive unclassified and classified information. Moreover, our products and services are often integrated with third-party products and services. Cybersecurity threats include attacks on, or other attempts to infiltrate, our IT infrastructure and the IT infrastructure of our customers, suppliers, subcontractors, and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, such as attacks targeting the security, confidentiality, integrity or availability of the hardware, software and information installed, stored, or transmitted in our products, which may occur after the purchase of those products or when they are incorporated into third-party products, facilities, or infrastructure.


text: Enterprise Cybersecurity. Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology (NIST) standards. Our program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications to educate individuals on the latest threats.


text: Product and Services Cybersecurity. Our product development processes apply development, security, and operations principles aligned with applicable government and commercial standards, and include vulnerability scanning and static and dynamic composition analysis. We regularly assess our product development processes, product cyber maturity, and the teams providing our secure services in relation to cybersecurity. In addition, we strive to meet all security requirements mandated by government and commercial customers and adhere to regulatory guidance and standards for system security engineering. Many of our products also undergo industry audits and regulatory compliance certifications, and our products delivered to the Department of Defense (DoD) must comply with DoD risk management requirements.


text: Cybersecurity for Systems used in Support of U.S. Government Customers. With respect to products and services provided to, and IT systems used in connection with programs for, the U.S. government, our cybersecurity program aligns with the NIST standards and meets the requirements of 32 CFR Part 117 and other applicable U.S. government guidance. The program includes authorization and assessment of new and existing IT systems by our customers and third parties. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Incident Response. Our cybersecurity program includes monitoring for potential security threats that may lead to exploitation of vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage incident response teams based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident management process is designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis.


text: Third-Party Service Providers. We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring, and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery.


text: Management of Third-Party Risks. Our suppliers, subcontractors, and other third-party service providers are subject to cybersecurity obligations and controls. We assess and periodically reassess the cybersecurity posture of third-party service providers who store, process, or transmit our information as a service, or connect to our networks. We also require our suppliers, subcontractors, and other third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase. Many of these third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS). Among other things, mandatory government procurement clauses obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of the implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.


text: Program Assessment. We continuously evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of our systems and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements, and assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the Defense Contract Management Agency (DCMA) and Cybersecurity Maturity Model Certification Third-Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Enterprise Cybersecurity. Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Special Activities Committee of the Board supports the Board in oversight of classified business cybersecurity, including with respect to Company internal information and operational technology systems. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role.


text: Our global chief information security officer (CISO), under the direction of our chief digital officer, leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks. Our CISO regularly updates the Board of Directors on cybersecurity risks as they relate to our information and operational technology systems, our suppliers, and other third-party service providers, in addition to updates on enterprise cybersecurity incidents and key Company defenses and mitigation strategies.


text: Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience building and leading cybersecurity, risk management, and IT teams. In performing his role, he regularly reviews enterprise cybersecurity risks, controls, program policy, and processes, including training, oversees policy and program development, implementation and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status.


text: Product and Services Cybersecurity. The Special Activities Committee of our Board of Directors has primary oversight responsibility for cybersecurity risks related to our products and services. The full Board of Directors also receives periodic briefings from management regarding the Company's products and services cybersecurity risks. The Audit Committee also considers product and services cybersecurity risks in connection with its financial and compliance risk oversight role.


text: Our product cybersecurity officer (PCO), under the direction of our chief technology officer, leads our cybersecurity program for our products and services and is responsible for assessing and managing related cybersecurity risks. Our PCO updates the Special Activities Committee on cybersecurity risks as they relate to our products and services, in addition to updates on product and service cybersecurity incidents, defenses, and mitigation strategies.


text: Our PCO is an experienced embedded systems engineer and chief engineer with nearly 20 years' experience in the development, product assurance, and security of critical and highly regulated embedded and other computer systems in medical, aviation, and military products and services. In performing her role, she regularly reviews cybersecurity risks, controls, program policy and processes, including training, and oversees and advises teams performing policy and program development, implementation, and updates. Our PCO is regularly apprised of product and service cybersecurity events, threats, and activities including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status.


text: Enterprise Risk Management Our cybersecurity risk processes are a key element of our Enterprise Risk Management (ERM) process, which is designed to identify and evaluate the full range of significant risks to RTX. As part of our ERM program, RTX's functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our Enterprise Cybersecurity and Product Cybersecurity functions as part of the overall review of significant risks to RTX. The top ERM risks are compiled annually and shared with the Audit Committee of the Board of Directors as well as the full Board of Directors. In addition, Internal Audit incorporates these risks into its continuous risk assessment process and periodically audits specific ERM risks.


text: We have developed cybersecurity risk management processes to identify, manage, and prevent risks related to cybersecurity. Our Information Technology ("IT") team manages our cybersecurity program and the security measures and processes we have in place.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Risk Management and Strategy Global cybersecurity threats and incidents can pose risks to UEI, impacting data security, operational efficiency, and financial stability. Our business requires collection, processing, and retention of large volumes of Company and sensitive and confidential third party data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract, including in areas such as customer product servicing, human resources outsourcing, website hosting, and various forms of electronic communications. Cybersecurity incidents risk disclosure of sensitive information and disruption of our operations. Financial consequences include recovery costs, fines, and potential legal repercussions. Such incidents could result in losses, severely damage our reputation or expose us to the risks of litigation and liability.


text: Cybersecurity is managed as part of the Company's enterprise risk management program. We have integrated cybersecurity risk management into our enterprise-wide risk assessment through evaluations of IT infrastructure, compliance audits and aligning cybersecurity goals with overall business objectives. We work with cybersecurity experts to better understand potential cybersecurity threats.


text: Measures we have employed to identify potential cybersecurity threats include advanced threat detection systems, such as intrusion detection systems and security information and event management tools. We manage and work to prevent these cybersecurity threats using a variety of strategies, including deploying firewalls and anti-malware tools, implementing access controls and leading security audits. Our incident response plans and monitoring systems also support detection and prevention of cybersecurity threats.


text: We aim to monitor these risks in connection with third parties in addition to our own operations. We collaborate with external cybersecurity consultants and auditors for independent audits and vulnerability assessments of our existing processes and systems. Our third-party cyber risk assessment program is designed to oversee certain third parties and have those third parties adhere to cybersecurity standards. This program has measures to help further manage and attempt to mitigate potential cybersecurity risks arising from third-party engagements, including security audits, compliance checks for cybersecurity standards, risk evaluation procedures for certain third parties, contractual security requirements in certain third party agreements and monitoring tools. We conduct cybersecurity training with our employees as appropriate based on their roles within the Company.


text: Our Board of Directors plays a role in guiding and overseeing our cybersecurity strategies. Our Audit Committee maintains responsibility for cybersecurity oversight by setting policies, reviewing risk management strategies and reviewing compliance with legal and regulatory requirements. The Audit Committee, as appropriate, briefs the broader Board of Directors on cybersecurity matters.


text: Management is also responsible for upholding our cybersecurity processes. Our Vice President of IT Infrastructure is responsible for cybersecurity oversight and for developing strategies to mitigate cyber risks, monitoring policy compliance and educating staff on security practices. Our Cybersecurity Management team, led by our Vice President of IT Infrastructure, reports to the Audit Committee of the Board of Directors on cybersecurity matters, including incident reports, compliance status and updates on cybersecurity initiatives. The Audit Committee aims to meet at least once each fiscal quarter to specifically address cybersecurity matters, but convenes as necessary to fulfill its cybersecurity oversight responsibilities.


text: To date, management has not identified risks from cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we work to maintain our cybersecurity processes, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.


text: Risk Management and Strategy Cybersecurity is managed as part of our enterprise risk management program. We have integrated cybersecurity risk management into our enterprise-wide risk assessment through evaluations of IT infrastructure, compliance audits and aligning cybersecurity goals with overall business objectives. We work with cybersecurity experts to better understand potential cybersecurity threats.


text: We aim to monitor these risks in connection with third parties in addition to our own operations. We collaborate with external cybersecurity consultants and auditors for independent audits and vulnerability assessments of our existing processes and systems. Our third-party cybersecurity risk assessment program is designed to oversee certain third parties and have those third parties adhere to cybersecurity standards. This program has measures to help further manage and attempt to mitigate potential cybersecurity risks arising from third-party engagements, including security audits, compliance checks for cybersecurity standards, risk evaluation procedures for certain third parties, contractual security requirements in certain third party agreements and monitoring tools. We conduct cybersecurity training with our employees as appropriate based on their roles within the Company.


text: Our Board of Directors plays a role in guiding and overseeing our cybersecurity strategies and has tasked our Audit Committee with the responsibility for cybersecurity oversight by setting policies, reviewing risk management strategies and reviewing compliance with legal and regulatory requirements. The Audit Committee, as appropriate, briefs the Board of Directors on cybersecurity matters.


text: Management is also responsible for upholding our cybersecurity processes. To this end, we have established a global cybersecurity management team, led by our Vice President, Cybersecurity. Our Vice President, Cybersecurity reports directly to our Senior Vice President and CFO and is primarily responsible for cybersecurity oversight and for developing strategies to mitigate risks from cybersecurity threats, monitoring policy compliance and educating staff on security practices. In carrying out his duties, our Vice President, Cybersecurity provides periodic reports to the Director of our Internal Audit Department, who, in turn, briefs the Audit Committee of the Board of Directors on the contents of such reports, including incident reports, compliance status and updates on cybersecurity initiatives.


text: Our Vice President, Cybersecurity has extensive experience assessing and managing risks from cybersecurity threats, including more than 20 years of experience in information technology and information security positions; serving in information technology leadership positions at the Company for more than 7 years; and has other significant experience in the areas of risk management, information technology and information security, including the following industry certifications: MCSE, MCDBA and CISSP.


text: To date, management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we work to maintain our cybersecurity processes, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks or threats to such systems, networks, and data or those of our third-party providers.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are considered within our broader enterprise risk management ("ERM") framework as part of our overall risk assessment process. We maintain a comprehensive Information Security Program and controls that are designed to assess, identify, manage, contain, and recover from material cybersecurity risks. The Information Security Program is also designed to identify emerging cybersecurity and information security risks and apply safeguards to the Company, our assets, customer, and employee data. The Information Security Program also addresses cybersecurity risks associated with our use of third-party service providers through systems and processes that are designed to assess, identify, and reduce the potential likelihood and impact of a cybersecurity incident at our third-party service providers. The Information Security Program is based on Center for Internet Security ("CIS") Controls, a cybersecurity framework that is acknowledged worldwide and is designed to comply with applicable laws and guidelines.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: We also have adopted a cybersecurity incident response and recovery plan to enable us to properly respond to cybersecurity incidents that may affect the function and security of the Company, our IT assets, customer and employee data, information resources, and business operations. We have adopted cyber and data security policies, which address matters including user access, incident response, third-party compliance, personal devices, and data privacy. These policies are reviewed annually, including by our independent auditor. We also maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur.


text: Our Information Security Program is further supported by regular educational and awareness training for employees. The training includes an annual assessment, focused on security, appropriate use, incident reporting, and social engineering, as well as multiple courses per year on global security trends and emerging risks. We also provide employees with educational materials about emerging cybersecurity threats and update employees when our information security policies are amended.


text: We regularly evaluate our Information Security Program based on software vendor assessments and reports, insurance underwriter evaluations, and internal and external audits, including, without limitation, customer audits. We also periodically engage third parties to review the effectiveness of its Information Security Program. To date, these engagements have included third-party penetration testing, risk identification, and a Fiscal Year 2023 comprehensive evaluation of the maturity of our Information Security Program.


text: Management has determined that no cybersecurity incidents that we have experienced to date have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy. For additional information on risks from cybersecurity threats and potential related impacts on the Company, please see Item 1A – Risk Factors.


text: The Board of Directors is ultimately responsible for our Information Security Program, and it has delegated to the Audit Committee primary oversight responsibility for this program. The Audit Committee periodically reviews the program and information security, cybersecurity, and technology risks. At least quarterly, the Audit Committee reviews and discusses with management and our senior information officers the Information Security Program, including the structure and function of the program and any enhancements made to the program as a result of third-party reviews or an identified security risk. The Audit Committee regularly briefs the Board on these discussions. In addition, our Incident Response Policy outlines procedures pursuant to which cybersecurity incidents or risks are escalated within the Company, and, as applicable, timely reported to the Audit Committee and Board.


text: Management Oversight The Information Security Program is overseen by our Information Security Steering Team, which provides cross-functional program oversight and maintenance and includes members from the Information Technology, Internal Audit, Legal, and Risk Management Departments. This team is also responsible for developing, implementing, and maintaining our information security policies and procedures.


text: Our Chief Information Officer and Corporate Director of Information Technology Security, in coordination with our Information Technology Department and other appropriate personnel, are responsible for assessing and managing our risks from cybersecurity threats. The Chief Information Officer has served in various roles in information technology and information security for over 25 years, has been in his current role for more than 10 years, and holds a degree in Computer Science. The Corporate Director of Information Technology Security has served in various roles in information technology and information security for over 30 years, has been in his current role for more than 15 years, and has been trained in multiple cybersecurity subjects.


text: A third-party security operations center, which is in operation at all times, is responsible for monitoring all logs, events, and alerts from our Endpoint Detection & Response ("EDR") platforms and cloud deployed services. This third-party also quarantines any systems displaying suspicious behavior for automatic or approved remediation. Our Information Technology Department maintains regular oversight of this third-party's actions through the monitoring of alerts displayed on the third-party's threat management dashboard to identify and respond to any irregularities that could be associated with threats. Significant threats are promptly reported to our Information Security Steering Team, who will assess the respective threat, with the help of external advisers as necessary, and initiate a plan to address it. The Information Security Steering Team will advise the General Counsel and Audit Committee of the threat as well as other third parties or authorities who are required to be notified pursuant to applicable law or contract.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are considered within our broader enterprise risk management ("ERM") framework as part of our overall risk assessment process. We maintain a comprehensive Information Security Program and controls that are designed to assess, identify, manage, contain, and recover from material cybersecurity risks. The Information Security Program is also designed to identify emerging cybersecurity and information security risks and apply safeguards to the Company, our assets, customer, and employee data. The Information Security Program also addresses cybersecurity risks associated with our use of third-party service providers through systems and processes that are designed to assess, identify, and reduce the potential likelihood and impact of a cybersecurity incident at our third-party service providers. However, we rely on our third-party partners to implement effective information security programs commensurate with the risk associated with the nature of their business relationships to us and cannot ensure in all circumstances their efforts will be successful. The Information Security Program is based on Center for Internet Security ("CIS") Controls, a cybersecurity framework that is acknowledged worldwide and is designed to comply with applicable laws and guidelines.


text: We also have adopted a cybersecurity incident response and recovery plan to enable us to respond to cybersecurity incidents that may affect the function and security of the Company, our information technology assets, customer and employee data, information resources, and business operations. We have adopted cyber and data security policies, that address matters including user access, incident response, third-party compliance, personal devices, and data privacy. These policies are reviewed annually. We also maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur.


text: We regularly evaluate our Information Security Program based on software vendor assessments and reports, insurance underwriter evaluations, and internal and external audits, including customer audits. We also periodically engage third parties to review the effectiveness of its Information Security Program. To date, these engagements have included third-party penetration testing, risk identification, and a fiscal year 2023 comprehensive evaluation of the maturity of our Information Security Program.


text: Management has determined that no cybersecurity incidents that we have experienced to date have resulted in, or are reasonably likely to result in, a material adverse effect on our financial condition, results of operations, or business strategy. For additional information on risks from cybersecurity threats and potential related impacts on the Company, please see Item 1A. "Risk Factors."


text: The Board of Directors is ultimately responsible for our Information Security Program, and it has delegated to the Audit Committee primary oversight responsibility for this information security and technology (including cybersecurity) risk management program. The Audit Committee periodically reviews the program and information security, cybersecurity, and technology risks. At least quarterly, the Audit Committee reviews and discusses with management and our senior information officers the Information Security Program, including the structure and function of the program and any enhancements made to the program as a result of third-party reviews or an identified security risk. The Audit Committee regularly briefs the Board on these discussions. In addition, our Incident Response Policy outlines procedures pursuant to which cybersecurity incidents or risks are escalated within the Company, and, as applicable, timely reported to the Audit Committee and Board.


text: Management Oversight Our Information Security Program is a comprehensive framework of policies, procedures, and guidelines designed to ensure the security, availability, and confidentiality of our systems.


text: Our Chief Information Officer (CIO) and Corporate Director of Information Technology Security (CDIS), in coordination with our Information Technology Department and other appropriate personnel, are responsible for assessing and managing our risks from cybersecurity threats. The CIO has served various roles in information technology and information security for over 25 years, including Corporate Director, Technology & IS Strategy and Director of Applications and Technology, has been in his current role for more than 10 years, and holds a BS degree in Computer Science. Our CIO has various industry certifications, including being a Microsoft Certified Professional (MCP) and holding the Project Management Professional (PMP) certification, offered by the Project Management Institute (PMI).


text: The program is led by our CDIS, who operates under the direction of the CIO. With over 30 years of experience in IT and cybersecurity, the CDIS heads our global Information Security team and the Security Steering team. This multidisciplinary team comprises experts from IT, Infosec, Legal, Audit, and Risk. The CDIS brings extensive expertise across a diverse array of platforms, services, and technologies.


text: Cybersecurity is a significant and integrated component of the Corporation's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Corporation has not, to its knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Corporation.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. To prepare and respond to incidents, the Corporation has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. the Corporation engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Security Department of the Corporation is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Chief Information Security Officer (the "CISO") who reports directly to the Corporation's Chief Risk Officer. The CISO has over 40 years of combined experience in all aspects of information technology ("IT") from field support to software development to management. Prior to joining the Corporation, the CISO has held management roles of increasing responsibility in a variety of regulated industries including food, pharma, and manufacturing. The CISO holds a Bachelor of Science Degree in Computer Science and has earned a certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The CISO also oversees the Corporation's Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Corporation and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CISO is a member of various management committees, chairs the Corporation's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a quarterly basis to the Corporation's Enterprise-Wide Risk Management Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer of the Corporation, as well independent members of the Board of Directors.


text: The Enterprise-Wide Risk Management Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the CISO provides information security updates to the Enterprise-Wide Risk Management Committee at each Enterprise-Wide Risk Management Committee meeting. Additional information security training to the committee is provided through a management Information Security Steering Committee and also through targeted training overseen by the CISO. In addition, as discussed below, the Corporation has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Corporation. The Incident Response Plan is implemented and maintained by the CISO and is subject to annual review and approval by the Enterprise-Wide Risk Management Committee. Cybersecurity metrics are reported to both management level committees and the Enterprise-Wide Risk Management Committee on a quarterly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the CISO, in conjunction with the Enterprise-Wide Risk Management Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Corporation's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Enterprise-Wide Risk Management Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: a. Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. b. Ensuring that changes to security configurations are documented, approved, and tested.


text: c. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. d. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. e. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: f. Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Corporation.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Corporation's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, the Corporation relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Corporation maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Corporation data. The Third-Party Risk Management Policy applies to any business arrangement between the Corporation and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited as part of the Corporation's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. On a quarterly basis, the CISO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program, including the Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Corporation and its customers, the Corporation maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Corporation, including the Corporation's data held, or IT services provided, by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes: a. Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.


text: b. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: c. Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: e. Reviewing the IRP at least annually, or whenever there is a material change in the Corporation's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is significant. For further discussion of risks from cybersecurity threats, see the section captioned "The Corporation's information technology systems, and the systems of third parties upon which the Corporation relies, may experience a failure, interruption or breach in security, which could negatively affect our operations and reputation." in Item 1A. Risk Factors.


text: Cybersecurity is a significant and integrated component of the Corporation's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Through December 31, 2024, the Corporation has not, to its knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Corporation.


text: The structure of our information security program is generally designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. To prepare and respond to incidents, the Corporation has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Corporation engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Security Department of the Corporation is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Chief Information Security Officer (the "CISO") who reports directly to the Corporation's Chief Risk Officer. The CISO has over 40 years of experience in various aspects of information technology ("IT") from field support to software development to management. Prior to joining the Corporation, the CISO held management roles of increasing responsibility in a variety of regulated industries including food, pharma, and manufacturing. The CISO holds a Bachelor of Science Degree in Computer Science and has earned a certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The CISO also oversees the Corporation's Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Corporation and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts ongoing technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CISO is a member of various management committees, chairs the Corporation's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a quarterly basis to the Corporation's Enterprise-Wide Risk Management Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer of the Corporation, as well independent members of the Board of Directors. The Enterprise-Wide Risk Management Committee provides oversight, from a risk perspective, of information systems security.


text: Additional information security training to employees is provided through a management Information Security Steering Committee and also through targeted training overseen by the CISO. In addition, as discussed below, the Corporation has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Corporation. The Incident Response Plan is implemented and maintained by the CISO and is subject to annual review and approval by the Enterprise-Wide Risk Management Committee. Cybersecurity metrics are reported to both management level committees and the Enterprise-Wide Risk Management Committee on a quarterly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the CISO, in conjunction with the Enterprise-Wide Risk Management Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Corporation's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Enterprise-Wide Risk Management Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: a. Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. b. Ensuring that changes to security configurations are documented, approved, and tested.


text: c. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. d. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. e. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: f. Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Corporation.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Corporation's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, the Corporation relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Corporation maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Corporation data. The Third-Party Risk Management Policy applies to any business arrangement between the Corporation and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is reviewed as part of the Corporation's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are an important defense against cybersecurity threats. Each employee is responsible for protecting Corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. On a quarterly basis, the CISO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, on the overall status of the Information Security Program, including the Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Corporation and its customers, the Corporation maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Corporation, including the Corporation's data held, or IT services provided, by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes: a. Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.


text: b. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: c. Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: e. Reviewing the IRP at least annually, or whenever there is a material change in the Corporation's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is significant. For further discussion of risks from cybersecurity threats, see the section captioned "The Corporation's information technology systems, and the systems of third parties upon which the Corporation relies, may experience a failure, interruption or breach in security, which could negatively affect our operations and reputation." in Item 1A. Risk Factors.


text: Risk Management and Strategy Our information security program covers a range of cybersecurity activities with a primary objective of maintaining the confidentiality, integrity, and availability of information for our business and customers. The program and our systems are designed to identify and mitigate information security risks and data privacy breaches. Our risk mitigation processes include a cybersecurity incident response plan that is exercised regularly with tabletop exercises, security awareness training with attack simulations to reinforce the training, cybersecurity risk assessment integrated with technology acquisition processes and utilization of third-party partnerships for threat intelligence, incident response and escalation, and attack surface monitoring.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: We measure our security performance against the International Organization for Standardization 27001 Framework and Enterprise Risk Management strategies. We implement policies and practices to mitigate risks to organization data and operational processes.


text: Our Global Data Privacy Program continues to align with environmental, social, and corporate governance standards and considers both risks and benefits of privacy-driven spending. The program operating model is based on the General Data Protection Regulation, which is adjusted for specific local requirements. The operating model is scalable to manage strategic, operational, legal, compliance, and financial risks and benefits, and uses technology to automate portions of the program, such as data subject access requests and consent and preference management.


text: Our membership on the Data Privacy Board, a group comprised of some of the world's largest companies with a mission to help members engage in confidential, leader-level discussion, presents opportunities using unbiased benchmarking and support from peers in various industries. We continue to build privacy resilience across international operating environments.


text: We work with third-party vendors to enhance our processes against the occurrences and impact of unauthorized access to our network, computers, programs, and data. Risk is inherent in risk management and strategy for cybersecurity. See "Risk Factors" in Part I, Item 1A in this report for further discussion.


text: The Board of Directors has oversight responsibility for cyber risks affecting the Company. The Board has delegated risk oversight with respect to operational, compliance, and financial matters, including cybersecurity and information technology risk, to the Audit Committee.


text: Our Director of Security has extensive experience implementing and managing cybersecurity policies including oversight of investments in tools, resources, and processes that allows for the continued maturity of our cybersecurity program. Team members who support our information security program have relevant educational and industry experience. Our CEO, Chief Financial Officer, and Audit Committee receive regular reports provided by our Director of Security on the Company's risk and compliance with respect to cybersecurity matters including data privacy, incidents, and industry trends, along with prevention, detection, mitigation, and remediation of cyber incidents.


text: Risk Management and Strategy Our information security program covers a wide range of cybersecurity activities, with the primary objective of maintaining the confidentiality, integrity, and availability of information for both our business and customers. The program and our systems are designed to identify and mitigate information security risks and data privacy breaches. Our risk mitigation processes include a cybersecurity incident response plan, which is regularly exercised through tabletop exercises, security awareness training with attack simulations to reinforce the training, cybersecurity risk assessments integrated with technology acquisition processes, and the utilization of third-party partnerships for threat intelligence, incident response and escalation, and attack surface monitoring.


text: We measure our security performance using the International Organization for Standardization 27001 Framework and Enterprise Risk Management strategies. We implement policies and practices to mitigate risks to organizational data and operational processes.


text: Our Global Data Privacy Program continues to align with environmental, social, and corporate governance standards, taking into account both the risks and benefits of privacy-driven spending. The program's operating model is based on the General Data Protection Regulation, adjusted to meet specific local requirements. This scalable model manages strategic, operational, legal, compliance, and financial risks and benefits, and utilizes technology to automate portions of the program, such as data subject access requests and consent and preference management.


text: Our membership in the Data Privacy Board, a group comprised of some of the world's largest companies with the mission of engaging in confidential, leader-level discussions, offers opportunities for unbiased benchmarking and support from peers across various industries. We continue to build privacy resilience across international operating environments.


text: We collaborate with third-party vendors to enhance our processes against unauthorized access to our network, computers, programs, and data. Risk is inherent in risk management and cybersecurity strategy. See "Our operations could be adversely affected if our information technology systems and networks are compromised or targeted by cyberattacks" under Risk Factors in Part I, Item 1A of this report, which we incorporate here by reference.


text: The Board of Directors has oversight responsibility for cyber risks affecting the Company. The Board has delegated risk oversight of operational, compliance, and financial matters, including cybersecurity and information technology risk, to the Audit Committee.


text: Our Director of Security has extensive experience implementing and managing cybersecurity policies, including overseeing investments in tools, resources, and processes that enables the continued maturity of our cybersecurity program. Team members supporting our information security program possess relevant educational backgrounds and industry experience. Our CEO, Chief Financial Officer, and Audit Committee receive regular reports from our Director of Security on the Company's risk and compliance with cybersecurity matters, including data privacy, incidents, industry trends, and the prevention, detection, mitigation, and remediation of cyber incidents.


text: Risk Management and Strategy We have an information security process integrated into our overall enterprise risk management (ERM) process that is designed to identify, assess, and manage material risks and threats from cybersecurity. To protect our information systems against cybersecurity threats, we employ a range of security processes designed to identify, prevent, detect, respond to, and recover from identified vulnerabilities and cybersecurity incidents in a timely manner. These include internal reporting mechanisms, monitoring solutions, and detection tools. We also leverage the expertise and support of key cybersecurity third-party partners and tools. Our protective measures include technical and organizational safeguards, employee training, incident response capability assessments, cybersecurity insurance, and business continuity mechanisms. We perform employee training as part of our information security processes for all employees. We regularly assess cybersecurity risks and technology threats, utilizing a qualitative risk model to identify, measure, and prioritize certain risks, and develop related security controls and safeguards.

companyName: VSE CORP

ticker: VSEC


text: Risk assessments are conducted when we onboard certain new services and new vendors, including third-party vendors, applications, and other technology services, and when there are significant changes to IT or security architecture. Further, we monitor key vendors to understand how such vendors manage cybersecurity risks and threats during the term of their provision services or products to us.


text: As part of our cybersecurity incident response framework, our incident response team focuses on responding to, containing, and recovering from a cybersecurity threat and minimizing any business impact. In the event of a cybersecurity incident, the cybersecurity team assesses, among other factors, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from business stakeholders and external technical, legal and law enforcement support.


text: Our Board of Directors ("Board") and Audit Committee have oversight responsibility for cybersecurity risks and incidents, including compliance with disclosure requirements, collaboration with law enforcement, and related effects on financial and other risks. Findings and recommendations are reported, as deemed appropriate, to the Board. Senior management including our Chief Information Security Officer (CISO) engages in regular discussions with the Board regarding cybersecurity risks, trends, and any material incidents that may arise. Furthermore, the Board receives briefings on cybersecurity matters from the CISO on our cybersecurity and information security.


text: Our CISO has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional. Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.