text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event and sensitivity of any compromised data.


text: Response and Recovery. In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example forensic investigations, and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.

companyName: FRANKLIN RESOURCES INC

ticker: BEN

secItem: Item 1C


text: Education and Awareness. Our cybersecurity education and awareness program for employees and contractors covers a wide range of cyber topics including, but not limited to, policies and procedures, business/technology roles and responsibilities, threats and vulnerabilities, data privacy, confidentiality and asset protection. Our employees and contractors are required to complete mandatory initial onboarding and annual cybersecurity trainings, supplemented by other periodic cyber-related testing and training.


text: Our Board is responsible for the oversight of our cybersecurity risk management program. The Board has delegated to the Franklin Audit Committee oversight responsibility regarding cybersecurity risks. Our CSO reports directly to our Chief Risk and Transformation Officer, each of whom has extensive experience in information security and risk management. The Board and/or Audit Committee receive(s) a report on cybersecurity matters, including threats, events and program enhancements, at least annually. We update our cybersecurity policies at a minimum annually and benchmark our program to applicable cybersecurity standards and frameworks.


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2024, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.


text: Risk Management and Strategy We recognize the importance of assessing, identifying and managing material risks from cybersecurity threats. Our cybersecurity program focuses on (i) identification of and protection from cybersecurity risks, (ii) detection and analysis of cybersecurity events, (iii) response to and recovery from cybersecurity incidents, and (iv) education and awareness. Under our program, designated personnel are responsible for: • assessing the severity of a cybersecurity incident and associated threat; • containing the threat; • remediating the threat, including recovery of data and access to systems; • analyzing the reporting obligations associated with the incident; and • performing post-incident analysis and program improvements.


text: Our cybersecurity team is led by our Chief Security Officer ("CSO") or the CSO's delegee partnering with our risk, technology, legal, compliance, privacy, human resources, and other applicable business teams.


text: Identification and Protection. Our cybersecurity program has established processes to identify and categorize cybersecurity threats and vulnerabilities as part of our risk identification process, pursuant to which we regularly seek to obtain, monitor, assess and respond to evolving threat and vulnerability information. Information about threats and vulnerabilities generally originates from multiple sources, including, but not limited to, government, information-sharing organizations, industry threat intelligence sources, and third parties. The identification of risks is supported through various security controls and testing to help minimize exposure to reported cybersecurity threats and vulnerabilities. These security controls include, but are not limited to, penetration testing, compromise assessments, vulnerability scanning, and various additional internal and external security audits and assessments. In addition, we maintain a third-party risk management program that includes an initial and periodic cybersecurity assessment on critical vendors' security posture and controls.


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies that are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event, including any operational impact and sensitivity of any compromised data.


text: Response and Recovery. In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities, which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example, forensic investigations and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2025, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, individual or brand impersonation, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Consumer Banking Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Technology Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: We employ an in-depth, layered, defensive strategy that embraces a "security by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, to the Technology Committee of our board of directors, and external agencies. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is responsible for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, information governance risk and compliance, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly (in the case of the Information Technology Risk Committee) and quarterly (in the case of the Information Security Oversight Committee) to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Technology Committee of our board of directors meets quarterly and is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: We employ a comprehensive cybersecurity risk assessment program designed to evaluate threats, vulnerabilities, and the potential impact on our operations, data, and financial condition. This program is regularly reviewed and updated to address emerging risks. Our process for addressing risk is based on banking industry best practices outlined in FFIEC and National Institute of Standards and Technology ("NIST") frameworks. We engage various third-party service providers in connection with our cybersecurity processes.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: We routinely engage consultants and other third parties to assist in the continued improvement and maintenance of our cybersecurity risk assessment program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address risks and vulnerabilities. Examples of these engagements include third party security assessments, security monitoring, and program review. We closely oversee and monitor third-party cybersecurity service providers.


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate risks. Our third-party oversight process follows published frameworks from NIST and FFIEC to account for risks throughout the entire engagement with our third-party vendors.


text: We consistently engage in proactive measures aimed at preventing, detecting, and effectively minimizing the impact of cybersecurity incidents. We maintain an incident response plan to swiftly respond to breaches, protect customer data, and minimize disruption to our operations. The incident response process is consistently tested and reviewed through simulated incidents and tabletop exercises with key stakeholders. To bolster our incident response process, we have robust business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident.


text: We have not experienced a material cybersecurity breach, but risks from cybersecurity threats may impact our business strategy, results of operations, and financial condition.


text: No risks from any current or previous cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, except to the extent that such strategy, operations, and conditions are affected by our employment of the cybersecurity risk assessment programs and procedures discussed in this Item. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of sensitive customer and employee data, we are susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events. We employ ongoing processes and strategies to guard against those threats, as discussed in this Item.


text: Cybersecurity Governance We recognize the value and importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.


text: Our Board of Directors and Chief Executive Officer, in collaboration with our Chief Information Officer and Chief Risk Officer, oversee cybersecurity processes, risks, and threats.


text: Rather than designate one specific board committee to cybersecurity risk management, our entire Board of Directors is responsible for overseeing our risk management. Our Chief Risk Officer is responsible for overseeing our risk management generally, working closely with our internal audit department. Our Chief Risk Officer regularly reports directly to the Board of Directors with respect to all areas of risk management.


text: With regard to cybersecurity specifically, we have a Cyber Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Cyber Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Cyber Information Security Officer delivers an annual report to our Board of Directors.


text: In addition, our entire management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, preventing, mitigating, and remediating such risks. We have an extensive and experienced team responsible for cybersecurity risk management.


text: Our current Cyber Information Security Officer has a comprehensive information technology background with over 20 years of experience in managing or assisting in managing cybersecurity risks.


text: To support the Cyber Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Cyber Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.


text: We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: a.24x7x365 Security Alert Monitoring e. Internal and External Security Assessments f. Security Awareness Training Programs g. Identity Management h. Incident Response Plans i. Data Encryption These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats. Our cybersecurity personnel provide regular reports to the Board of Directors.


text: As noted above, our Chief Risk Officer, Cyber Information Security Officer, and cybersecurity team provide regular reports to the Board regarding cybersecurity risks, as well as a review of the processes described above. In particular, our Chief Risk Officer provides reports at every regularly scheduled Board meeting regarding our most material risks and the degree of exposure to these risks. Our management personnel are also required to provide more frequent updates to the Enterprise Risk Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: With regard to cybersecurity specifically, we have a Chief Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Chief Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Chief Information Security Officer delivers an annual report to our Board of Directors.


text: Our current Chief Information Security Officer has a comprehensive information security background with over 20 years of experience in managing or assisting in managing cybersecurity risks across multiple industries with the majority of that experience at community banking institutions. Our Chief Information Security Officer holds multiple industry certifications from groups such as ISC2 and GIAC.


text: To support the Chief Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Chief Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.


text: As noted above, our Chief Risk Officer, Chief Information Security Officer, and cybersecurity team provide regular reports to the Board regarding cybersecurity risks, as well as a review of the processes described above. In particular, our Chief Risk Officer provides reports at every regularly scheduled Board meeting regarding our most material risks and the degree of exposure to these risks. Our management personnel are also required to provide more frequent updates to the Enterprise Risk Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen at a high level by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. TEGNA's internal Cybersecurity Council conducts quarterly meetings to discuss risks, processes, controls, strategy, and response. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.


text: We maintain third-party vendor policies and practices to identify, prioritize, and mitigate and remediate third party risk. Third-party access is narrowly limited in scope, granting access only to necessary systems with the lowest level of privileges required. Third-party access is monitored, and accounts are reviewed and attested to on a quarterly basis. TEGNA relies on third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: TEGNA has documented and tested incident response plans, which outline the steps to be followed from incident detection to containment, recovery, and notification, including notifying functional areas, as well as senior leadership and the Board, as appropriate. With assistance from third-party cybersecurity experts, TEGNA regularly conducts cybersecurity tabletop exercises with leadership and technical teams. TEGNA conducts compliance reviews of all cybersecurity policies and procedures at least annually and utilizes an outside cybersecurity firm to evaluate the overall program. Business units are required to attest to applicable TEGNA security controls monthly.


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have from time to time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see the risk factor entitled "Our efforts to minimize the likelihood and impact of adverse cybersecurity incidents and to protect our technology and confidential information may not be successful and our business could be negatively affected" in Item 1A. "Risk Factors".


text: Risk Management and Strategy Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management ("ERM") processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls and information systems.

companyName: GAP INC

ticker: GAP


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management and members of our Information Security, Information Technology and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plans and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain incident response plans to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.


text: Our cybersecurity risk management processes are based on industry-recognized standards. We partner with leading cybersecurity companies to leverage third-party technology and expertise, and we engage with these partners to support monitoring and maintaining the performance and effectiveness of controls implemented in our environment.


text: To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Data Privacy and Cybersecurity" in Item 1A, Risk Factors, of this Form 10-K.


text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Digital & Technology Officer ("CDTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, CDTO, and members of the Information Security, Information Technology and Privacy teams have broad experience and expertise in selecting, deploying and operating cybersecurity technologies, initiatives and processes around the world. Information about our executive officers' work experience, including our CDTO, is included in "Information about our Executive Officers" in Item 1, Business, of this Form 10-K.


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO and/or CDTO provide a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.


text: Our Internal Audit department facilitates an annual ERM assessment that is designed to gather information regarding key enterprise risks, emerging risks, critical risk events, and key third-party dependencies that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology and Privacy teams to gather information about risks related to cybersecurity threats. The ERM assessment is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan and any updates to the Company's enterprise risk profile, including identified cybersecurity risks.


text: Risk Management and Strategy Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors, and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management and business continuity planning processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls, and information systems.


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management, our Board and members of our Information Security, Information Technology, and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plan and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain an incident response plan to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.


text: To date, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Information Security and Technology" in Item 1A, Risk Factors, of this Form 10-K.


text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Technology Officer ("CTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO, CTO, and members of the Information Security, Information Technology, and Privacy teams have broad experience and expertise in selecting, deploying, and operating cybersecurity technologies, initiatives and processes around the world. Our CISO has nearly 25 years of experience in the information security and information technology fields. Our CTO has nearly 35 years of experience in these fields, including in technology leadership roles for large companies across multiple industries.


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO provides a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.


text: Our Internal Audit department facilitates an annual enterprise risk assessment ("ERA") that is designed to gather information regarding key enterprise risks, emerging risks, and critical risk events that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology, and Privacy teams to gather information about risks related to cybersecurity threats. The ERA is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan. The Audit and Finance Committee also reviews updates to the Company's enterprise risk profile, including identified cybersecurity risks, throughout the year. Additionally, key third-party dependencies are monitored as part of our overall business continuity planning, with the Audit and Finance Committee receiving periodic updates.


text: The Company's Board of Directors ("Board") recognizes the critical importance of maintaining the trust and confidence of our employees, customers, shareholders and other stakeholders. Among other areas of responsibility, the Board has oversight responsibilities in relation to the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies and practices are integrated into the Company's ERM program and our risk goals are guided by internationally recognized standards and frameworks that help us to identify, assess, and manage risks relevant to our business. In general, the Company manages our cybersecurity risk using an evidence- and risk-based approach designed to reduce risks and thereby protect the Company's mission, business, and stakeholders, rather than focusing upon meeting any specific technical specifications.

companyName: GATX CORP

ticker: GATX


text: Risk Management and Strategy The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.


text: We have not identified risks from known cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition.


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security.


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The Global Head of IT Security has served in various roles in information technology and information security for over 15 years, and holds undergraduate and graduate degrees in information security, as well as multiple certifications in cybersecurity and information technology.


text: Risk Management and Strategy The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. The incident response plan also includes consideration of disclosure requirements and communication to appropriate parties within the Company. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to senior management and the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security, who reports to the CIO and has responsibility for assessing and managing material risks from cybersecurity threats.


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The CIO has over 25 years of experience in information technology, including over 17 years managing the cybersecurity function and resources. The Global Head of IT Security has over 15 years of experience in information technology and information security, including 10 years of leadership roles within the information security domain, and holds certifications in cybersecurity and risk management.


text: We face various cybersecurity threats. The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: Under our comprehensive risk management program, the board of directors (Board) of the company maintains oversight of the most significant risks facing the company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, the Board receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.


text: Our companywide Cyber Council, comprised of information technology and cybersecurity executives from our business units, shares information and cybersecurity practices throughout the company, recommends policy and procedure updates and tracks emerging trends. The chair of the Cyber Council reports directly to the company's chief executive officer.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.


text: See Item 1A—Risk Factors above for additional discussion of various risks related to cybersecurity that are reasonably likely to have a material impact on our company, including our business strategy, results of operations or financial condition.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 15 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and information security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third party evaluations to our CIDO, who provides regular updates to our Audit Committee, Chief Executive Officer, and other members of our executive team. The Audit Committee receives regular updates specific to the Company's cyber security program and IT security risk, including descriptions of mitigation and incident response plans, projects to continually enhance our information security systems, overviews of awareness and training programs and the emerging threat landscape. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk & compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: GENUINE PARTS CO

ticker: GPC


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events are assessed using a variety of methods, and our incident response plan is enacted as needed. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security events. Security awareness training is also key component of our information security program and involves required training for all our teammates.


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company's cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events is assessed based on criticality, and mitigation and remediation actions are taken in accordance with our incident response plan. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises. Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."


text: Cybersecurity Risk Management and Strategy We operate in the engineered materials manufacturing sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws; and other litigation, legal and reputational risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive incident response plan and procedure that is tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, threat intelligence feeds, and penetration tests by an independent third party. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. The incident response team, which includes senior IT subject matter experts and security analysts, determines the apparent severity of reported potential incidents, and operationalizes the appropriate incident response plan. In addition, we continue to provide training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide feedback (and, if necessary, additional training or remedial action) to employees. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures should they occur.

companyName: Magnera Corp

ticker: MAGN


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, administrative functions, customer service, product development, and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Cybersecurity Governance The Company has increased its investment into combating cybersecurity risks which include increased Board Audit Committee oversight of IT's security risk reporting, formation of the Cybersecurity Steering Committee to directly govern IT cybersecurity strategies and strengthening the IT security management team which deploys resources to address cybersecurity risks on a day-to-day basis. Our internal cross-functional Cybersecurity Committee meets quarterly to discuss any issues and regulatory updates. The Board's Audit Committee exercises its oversight role and provides the Board with reports and findings from its annual cybersecurity meeting with management, including the Vice President of Global Information Technology and the Senior IT Director over Cybersecurity. Our Senior IT Director over Cybersecurity holds a Certified Information Systems Security Professional (CISSP) certification and has more than 25 years of experience in cybersecurity. Our Board also reviews our cybersecurity budget on an annual basis.


text: Our Chief Information Officer (CIO) has over 30 years of experience in cybersecurity and has primary management oversight of the Company's cybersecurity and cyber risk management activities. The CIO administers our cyber risk assessments, oversees ongoing risk management processes, and regularly reports to the Audit Committee. During fiscal 2025, the Audit Committee received regular briefings from the CIO on cybersecurity matters, including updates on current and emerging threats, progress on information security initiatives, assessments of the Company's cybersecurity program, and the results of internal and third-party evaluations.


text: Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks are addressed through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cyber security threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Assessments We engage third parties to perform assessments of our cybersecurity programs, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. (See Item 1A. Risk Factors).


text: Our cybersecurity program seeks to identify, assess and monitor material cybersecurity and other information technology risks and threats that may affect our information systems, networks and operations, including those systems and networks managed by third parties. We regularly assess potential risks and execute a layered cybersecurity strategy based on prevention, detection, mitigation, and remediation. The Company's cybersecurity risks are evaluated at least annually through our enterprise risk management program, which is a company-wide effort to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.

companyName: GRACO INC

ticker: GGG


text: To manage our cybersecurity program, we have established a cross-functional cybersecurity oversight committee and cybersecurity team, both led by our Chief Information Officer ("CIO"). Our cybersecurity oversight committee and cybersecurity team, with the support of external cyber-specialist resources, include technical experts in cybersecurity risk management, incident response and security operations with extensive experience in the operations of networks, network security and infrastructure management. In addition, members of our cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. Our CIO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity management team and through the use of technological tools and software.


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide training to our employees to help identify potential cybersecurity threats and attacks through an annual cybersecurity awareness month and targeted phishing campaigns. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risks and strategy. Management provides regular updates to the Audit Committee on cybersecurity risks facing the Company, the systems management has in place to mitigate and manage those risks, the status of key cybersecurity initiatives through a review of the Company's cybersecurity strategic roadmap and whether any material cybersecurity incidents have occurred. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes an update of the cybersecurity threat landscape, discussion of management's actions to identify and detect threats, and a review of assessments, penetration tests and other audits performed by internal and external parties. In addition, management periodically arranges for outside experts to present to the Audit Committee on cyber governance frameworks, regulatory developments, industry practices and risk management.


text: None of the cybersecurity risks, including as a result of any prior incidents we have experienced, have had a material adverse impact on our operations, business or financial condition.


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We periodically enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide annual cybersecurity awareness training to our employees and contractors to help identify potential cybersecurity threats and attacks, perform targeted phishing campaigns, use multifactor authentication for secure access to our systems and networks and tabletop exercises to simulate and prepare for potential incidents. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.


text: Risk Management and Strategy We recognize the importance of effective cybersecurity risk management to our operations and interests. Our cybersecurity program is designed to protect our employees, our customers and our assets through the effective identification and mitigation of cyber risks. The program, led by the Senior Director, Global Information Technology ("IT") Security under the oversight of the Chief Information and Digital Officer ("CIDO"), encompasses a broad range of preventative, detective and responsive measures relevant to our business needs and designed to reduce our specific risks.

companyName: GREIF, INC

ticker: GEF


text: The cybersecurity program is modeled after and assessed against the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF is not a certification program and our use does not imply compliance with specific, related standards – the NIST CSF is used as a guide for designing and managing cybersecurity programs.


text: Risks and exposures associated with our cybersecurity program are integrated into our overall enterprise risk management program and share common methodologies, reporting channels and governance processes. These processes and the governance for identifying and managing risks apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Core elements of our cyber program include, but are not limited to: • Risk assessments to identify cybersecurity risks that may impact us in material ways, including risks associated with our use of third-party service providers; • Cybersecurity awareness training for our employees and ongoing technical training for cybersecurity personnel; • Procedural and technical security controls implemented and managed by cross-functional teams; • An incident response plan that includes procedures for responding to cybersecurity events, including those arising from our use of third-party service providers or partners; • Periodic evaluation of security controls through system assessments and vulnerability scanning; • Partnerships with external providers where appropriate to supplement our internal expertise, perform security assessments and penetration testing, consult on best-practices and support incident response activities with forensic analysis.


text: As of October 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.


text: While our Board has responsibility for oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit Committee of our Board of Directors has responsibility for oversight of our cybersecurity risk management program. Full responsibilities of the Audit Committee are set forth in the publicly available Audit Committee Charter on our website. The Committee receives quarterly cybersecurity updates covering risks, mitigation plans, and cybersecurity incidents. The full Board of Directors is provided with periodic cybersecurity updates from the CIDO or the Senior Director, Global IT Security, or both.


text: In the event of an urgent cybersecurity incident where full Audit Committee or Board involvement is not practical or timely, the Chairperson of the Board of Directors, the Chairperson of the Audit Committee, and the Chief Executive Officer have been appointed as an incident oversight group.


text: Management Oversight The Senior Director, Global IT Security has primary responsibility for the management of ongoing cyber risks under the oversight of the CIDO. The Senior Director holds a Certified Information Systems Security Professional certification and has nearly 30 years of experience in technology, including over 10 years in software development and enterprise architecture and over 15 years implementing, maturing and leading cybersecurity programs. The CIDO is responsible for global IT strategy and operations and has nearly 30 years of experience leading enterprise technology organizations. The CIDO and Senior Director, together with others on their teams, are informed about the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management policies, processes and operations discussed above.


text: The Company's management team has designated a Cybersecurity Advisory Council (the "Council"), which consists of members of management, including the Senior Director, Global IT Security and a cross-section of Company leaders. The Council ensures strong alignment within the Company with the objectives of the cyber program, providing input on policy and risk decisions. The Council receives periodic briefings on security status, incidents, and mitigation plans.


text: The Company relies upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. Accordingly, the Company places an emphasis on managing cybersecurity risks by means of a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to the Company's business.

companyName: ENVIRI Corp

ticker: NVRI


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect the Company's information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned or managed by the Company. The Company places special weight on protecting sensitive information, such as personal information of the Company's customers and employees, and confidential business information that could be leveraged by a competitor or a malicious actor.


text: The Company's cybersecurity program comprises several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices; engaging third-party service providers to conduct security assessments and penetration testing; and performing periodic internal audits of the Company's cybersecurity protocols. The Company employs a risk-based process designed to manage cybersecurity risk presented by third-party vendors that may have access to the Company's sensitive information and/or information technology ("IT") systems. This process may consider the nature of the services provided, the sensitivity and quantity of information processed, the criticality of any potentially impacted IT systems, and/or the strength of the vendor's cybersecurity practices.


text: The Company monitors potential cybersecurity risks through an enterprise risk "heatmap" that tracks key cybersecurity risks at divisional and enterprise levels. These key risks are characterized by various factors such as the likelihood of the Company experiencing a particular type of cybersecurity incident, the speed at which each type of cybersecurity incident could impact the Company, and management's assessment of the Company's ability to respond quickly and efficiently.


text: An incident response plan ("Incident Response Plan") aligned with best practices articulated by the National Institute of Standards and Technology ("NIST") governs the Company's response to cybersecurity incidents. This Incident Response Plan outlines how the Company detects, analyzes, contains, eradicates, recovers, and performs post-incident activities in the event of a cybersecurity incident. It also contains an internal, risk-based escalation framework designed to ensure that all relevant individuals are promptly informed of any cybersecurity incident and dictates procedures for determining whether a cybersecurity incident is material without unreasonable delay.


text: MATERIAL EFFECTS FROM RISKS OF CYBERSECURITY THREATS While the Company experiences minor data and cybersecurity incidents from time to time, to the Company's knowledge, the risks posed by cybersecurity threats (including from such prior incidents) have not materially affected and are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. A successful cybersecurity attack may expose the Company and the Company's employees, customers, dealers, and suppliers to misuse of information or systems, the compromising of confidential information, manipulation or destruction of data, production downtimes, and operations disruptions. For example, the Company frequently operates in potentially dangerous environments with heavy machinery, such as steel mills, where a cybersecurity incident could cause a machinery malfunction that results in disruptions to operations or serious injury to employees. For more information, see risk factor related to the imposed risks from increased information technology security threats and computer crime under Strategic and Operational Risks in Part I. Item 1A. Risk Factors.


text: Role of Management The Company's Vice President, Chief Information Security Officer and Corporate IT, Giles Tipler, oversees the Company's IT security department and is responsible for assessing and managing cybersecurity risks and for leading the Company's response to cybersecurity incidents. Mr. Tipler has over 25 years of experience in information security, risk management, compliance, and information technology, with significant experience building cybersecurity programs across multiple countries in the Americas, Europe, the Middle East, Africa, and the Asia-Pacific regions. Mr. Tipler played an instrumental role in the development of the Company's Incident Response Plan and reports to the Company's Chief Financial Officer, Mr. Tom Vadaketh. Mr. Tipler is also responsible for providing quarterly updates to the Company's Audit Committee and Board of Directors regarding enterprise level risks, the effectiveness of the Company's cybersecurity program, and any material cybersecurity incidents that may arise.


text: Role of the Board of Directors The Board has delegated responsibility for overseeing the Company's cybersecurity and information technology processes to the Audit Committee. The Audit Committee is responsible for overseeing the implementation and effectiveness of the Company's processes and risk management protocols regarding cybersecurity and information technology, including risks from cybersecurity incidents and vulnerabilities and third-party service providers, and the steps taken by Mr. Tipler and the IT security department to inform themselves about and monitor the prevention, detection, mitigation, and remediation of such risks. Mr. Tipler reports to the Audit Committee regarding material cybersecurity incidents and any remediation efforts and is also responsible for providing quarterly updates regarding the overall effectiveness of the Company's cybersecurity program.


text: We rely on our technology infrastructure and information systems to interact with our clients, our employees, to sell our services, to utilize our data, to support and grow our client base, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors that we contract with, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems, and which may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include governmental actors or other actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: HARTE HANKS INC

ticker: HHS


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. Our Board of Directors, our internal Risk Steering Committee, in conjunction with our Chief Security Officer ("CSO"), have direct oversight of our management of cybersecurity risks.


text: Our CSO and the Risk Steering Committee ("RSC") oversees our enterprise risk management process. Under the direction and supervision of our CSO, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks, and an analysis of cybersecurity threats and incidents across the industry. The CSO and RSC review the results of the enterprise risk assessment in detail with management on a regular basis and reports its findings, as needed, to the Board of Directors.


text: Our CSO, reporting to our Interim Chief Operations Officer, and in conjunction with our IT Department, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our CSO has 3 decades of information technology and cybersecurity experience with the last 7 years leading the cybersecurity activities at Harte Hanks, as well as participating in numerous cyber readiness exercises with U.S. Government agencies, and has specialized training in cybersecurity risk management, cloud security and holds a CISSP certification offered by ISC2. Our CSO is also responsible for the operation of our cybersecurity program, and management of our cybersecurity incident response team.


text: As mentioned above, in response to the increasing threats presented by cyber incidents, in 2020 we established the RSC, which meets regularly. This committee is comprised of our Chief Security Officer, our Interim Chief Operations Officer, our General Counsel / Privacy Officer, our Head of Human Resources, each Director of Operations of each of our business units, and our Chief Financial Officer, as well as other key leaders. The RSC (in conjunction with the CSO), oversees activities related to monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The RSC, along with our CSO, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, and receives regular updates on cybersecurity-related matters.


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory yearly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our RSC also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The RSC escalates events, including the Interim Chief Operating Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Cybersecurity and Data Privacy Committee of the Board(the "Cybersecurity Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the Enterprise Risk Management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: HASBRO, INC.

ticker: HAS