text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks. We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including personal information, intellectual property and proprietary information. • Cybersecurity incident responses plan and testing. We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a Managed Security Service Provider, or MSSP, that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training. We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Our third-party assessments. We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.


text: We also consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We have not identified cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial position.

companyName: NorthStar Healthcare Income, Inc.

secItem: Item 1C


text: The audit committee of the board of directors is responsible for board-level oversight of cybersecurity risk, and the audit committee reports back to the board of directors about this and other areas within its responsibility. As part of its oversight role, the audit committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our CFO and through our MSSP.


text: Risk Management and Strategy We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001, or ISO 27001, Framework, although we do not comply with all technical standards, specifications or requirements under NIST or ISO 27001.


text: Our Audit Committee is responsible for board-level oversight of cybersecurity risk and reports back to our Board about this and other areas within its responsibility. As part of its oversight role, our Audit Committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Financial Officer, and through our MSSP. Our Chief Financial Officer is principally responsible for overseeing our cybersecurity risk management program and incident reporting. In the event there is a material cybersecurity breach or incident, our Chief Financial Officer works in coordination with our MSSP to assess and respond, including by reporting the breach or incident to our Board and/or applicable regulatory authorities, as necessary or required. Our Chief Financial Officer has a high level of exposure to cybersecurity oversight through his current work overseeing our cybersecurity risk management and MSSP and has over 10 years of experience with managing risks in environments similar to ours, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We are committed to maintaining robust governance, oversight and management of cybersecurity risks. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, access and identity management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.

companyName: BankUnited, Inc.

ticker: BKU


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents or technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. SLAs are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems KRIs in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity attacks and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and we believe with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third party service provider's technology and information security posture.


text: The Company has developed a training program to educate employees about its cybersecurity policies and standards, best practices, and potential threats to instill a culture of cybersecurity awareness and compliance throughout the organization. The training program includes, but is not limited to, ongoing and targeted training on topics such as social engineering, mobile security, data handling and protection, password security and incident reporting. All employees are required to participate in the training.


text: In 2022, Clarium Managed Services, LLC ("Clarium") conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 4.8 on a scale of 0 to 5. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. No specific cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a discussion of our cybersecurity risks.


text: Cybersecurity Governance The Risk Committee of the Board of Directors is ultimately responsible for oversight of risks from cybersecurity threats, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information systems security including physical, cyber, and IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CIO, but also provides reporting directly to and has access to the Risk Committee of the Board of Directors. The CIO has over 30 years of experience in financial services information technology.


text: The Company has designated the MAT to assess and oversee the management and reporting of identified potentially material cybersecurity threats or incidents. The MAT convenes when a qualifying cybersecurity threat is identified by the CIO, the CISO, or their designees in accordance with established processes and procedures. The MAT has the responsibility to determine whether a cybersecurity threat or incident is material and oversee appropriate reporting. The MAT is also responsible for communicating to the Risk Committee any material cybersecurity threats or incidents.


text: The CISO, CIO, CRO, CFO, CAO, and General Counsel comprise the MAT. Other SMEs or technical experts may advise, consult with and provide information to the MAT as needed. In addition to the specific subject matter expertise and experience of the CISO and CIO, these executives have broad financial, legal, risk management, industry, regulatory and SEC compliance, and general leadership experience, which enable the MAT to effectively carry out its responsibilities.


text: Cybersecurity Risk Management and Strategy We are committed to maintaining robust governance, oversight and management of cybersecurity risk. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, identity and access management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents, technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. Response and resolution times (commonly known as SLAs) are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems metrics in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity threats and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third-party service provider's technology and information security posture.


text: In 2022, Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 4.8 on a scale of 0 to 5. The next independent evaluation is planned for 2025. In the last three fiscal years, the Company has not identified any material cybersecurity incidents. No specific identified cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a further discussion of our cybersecurity risks.


text: Cybersecurity Governance The Risk Committee of the Board of Directors is ultimately responsible for oversight of cybersecurity risk, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information security including physical, cyber, IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CRO and provides reporting directly to the Risk Committee of the Board of Directors.


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clearwater Paper Corp

ticker: CLW


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall ERM process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board of Directors, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board of Directors. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: During 2024, we did not experience any cybersecurity threats that had a material impact or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. Please see our "Risk Factors" in item 1A in this report for more information.


text: Cybersecurity Governance and Strategy Our cybersecurity program is designed to provide logical and physical security protection of our infrastructure, systems and data from theft and destruction that could impact our operations, reputation, and regulatory compliance. To safeguard us from a cyber event, specific mitigating cybersecurity controls, systems and incident procedures exist based upon the United States Department of Commerce National Institute of Standards and Framework ("NIST") Cybersecurity Framework, which is an industry recognized security framework for private and public sectors. Our commitment to cybersecurity is reflected in our extensive program and related technology investments for continual cybersecurity posture enhancements.

companyName: NGL Energy Partners LP

ticker: NGL


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring, detection and response, network protection and segmentation, layered security methods, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.


text: Cybersecurity Risk and Threat Management Our Enterprise Cybersecurity Risk Management program is a continuous life cycle approach with a formal annual risk assessment followed by internal and third-party risk assessments throughout the year. Annually, an independent security expert vendor is engaged to conduct a cybersecurity risk assessment based upon industry and technology standards. The assessment results are prioritized then tracked within our Governance, Risk and Control system which derives the specific risk likelihood and impact mitigated risk score. Cybersecurity projects, controls and practices are then developed to mitigate the identified risks. Monthly, the Compliance and Security Steering Committee meets to review risk register, current threat assessments and related mitigation efforts for risk management tracking. Additionally, on a quarterly basis, our Chief Information Officer ("CIO") presents the risk score and mitigation updates to the board of directors of our GP for risk oversight.


text: Event management of a cyber incident follows our Cybersecurity Policy Incident Response Procedure ("Incident Response Policy") which is based upon the NIST framework. The procedure includes incident identification, isolation and containment, investigation, impact analysis, communication, materiality assessment including in aggregate with previous events, and reporting steps and associated ownership. Annually, the Incident Response Policy is tested with the key owners to validate the procedure and for training purposes.


text: Impact of Risks from Cybersecurity Threats While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future due to the increasing global cyberattack volume, frequency, and sophistication. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures even with our various cybersecurity protection and resilience protocols.


text: Management's Cyber Expertise Our cybersecurity program is led by our CIO who is also our Chief Information Security Officer. Our CIO has been with us since 2014 and has over 30 years of information technology and compliance experience. Our CIO has a Bachelor of Science in Management Information Systems and holds the Certified Information Systems Audit security certification as well. Our security members are comprised of various industry technology skilled resources in cybersecurity, business continuity and system recovery, event management, system administration, network engineering, and regulatory compliance with a collective 100 plus years of experience. Security operations partners are also leveraged for 24x7x365 managed detection and response support plus provide expert cybersecurity resources as an extension of our team.


text: Board of Director's Cyber Oversight For cybersecurity oversight, the board of directors of our GP training program is designed to inform members of the current cyber threat tactics and provide relevant, periodic educational security technology information. The cybersecurity training program includes: • An annual presentation overview of our cyber controls and related systems for a comprehensive understanding of our cybersecurity protection and resilience; • Quarterly cybersecurity training on topics such as ransomware, phishing, impersonation, social engineering, third-party security risks, and business email compromise to reinforce general security knowledge; and • Monthly cybersecurity newsletter distribution for current threat tactics and general security awareness.


text: Additionally, the CIO presents a quarterly cyber update to the board of directors of our GP for an overview of cyber program key metrics and trends, cyber event executive summaries (based upon occurrence), fiscal year security goals and tracking progression, risk register scoring, and status updates on cyber related projects.


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring and behavior analytics, detection and response, network protection and segmentation, layered security methods for defense-in-depth, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.


text: Board of Director's Cyber Oversight For cybersecurity oversight, the board of directors of our GP training program is designed to inform members of the current cyber threat tactics and provide relevant, periodic educational security technology information. The cybersecurity training program includes: • An annual presentation overview of our cyber controls and related systems for a comprehensive understanding of our cybersecurity protection and resilience; • Quarterly cybersecurity training on topics such as ransomware, phishing, impersonation, social engineering, third-party security risks, business email compromise, and artificial intelligence to reinforce general security knowledge; and • Monthly cybersecurity newsletter distribution for current threat tactics and general security awareness.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Warby Parker Inc.

ticker: WRBY


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework 1.1 (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security protocols and controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security protocols and controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for assessing and responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Related to Our Business and Industry—We rely heavily on our information technology systems, as well as those of our third-party vendors, business partners, and service providers, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption, or cybersecurity incident could adversely affect our business, financial condition, and operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives reports from management on our cybersecurity risks on at least a quarterly basis, and more frequently as needed. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer and the Senior Director of Information Security.


text: Our management team, including our Chief Technology Officer ("CTO") and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer ("CTO") and the Senior Director of Information Security.


text: Our management team, including our CTO and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company maintains a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our customers expect us to protect their data and the impact of not doing so has financial, reputational, and regulatory implications. Disruptions caused by cyberattacks, data breaches, or system compromises can impact our business operations and financial performance. The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with established plans.

companyName: Upland Software, Inc.

ticker: UPLD


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the "Board") where that oversight and review takes place at a regular cadence. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.


text: Risk Management and Strategy A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, the Board, and, if needed, the Company adjusts its cybersecurity policies, standards, processes and practices based on the information provided by the assessments, audits and reviews.


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.


text: In addition, the Company has established a Security Incident Response Team ("SIRT") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.


text: The Company's CSO is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. Our CSO has held leadership positions in information security for over 30 years, including serving as Chief Security Officer of large public and private organizations, with a high focus on data security. Team members that support the CSO and our information security program have relevant educational and industry experience, including holding Certified Information Systems Security Professional certifications.


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the " Board ") where that oversight and review takes place at a regular cadence through quarterly reports. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.


text: In addition, the Company has established a Security Incident Response, Disaster Recover, and Business Continuity Team ("SIRT/DR/BCP") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT/DR/BCP team convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: Cybersecurity Risk Management and Strategy The Company's risk management program for cybersecurity is integrated into our risk management and general compliance programs and processes. Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. Our Information Security Officer ("ISO") is responsible for the day-to-day management of the Company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The information security team also develops training for employees to support adherence to the Company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: The Company leverages the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework ("the NIST Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The Company's ISO works with independent, third-party consultants to assess the maturity of the Company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the Company's program commensurate with the Company's business objectives.


text: As part of the Company's information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, we maintain a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to our system, facilities, and/or confidential or proprietary data.


text: Cybersecurity incidents may create risk to the Company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most corporations, the Company is the target of industrial espionage, including cyberattacks, from time to time. The Company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, the Company has not experienced any known cybersecurity incidents that have materially affected the Company, including the Company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that the Company has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that the Company will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.


text: Cybersecurity Governance The Audit Committee and Technology Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Technology Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Technology Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.


text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's ISO reports to the Chief Risk and Operations Officer and oversees the Company's information security programs. The Company's ISO possesses over 20 years of Information Security and Technology experience. The ISO holds a Bachelor of Science in Computer Systems Engineering, an MBA, and a Master of Science in Information Security and Assurance, as well as multiple industry certifications including CISSP, CISM, CISA, CRISC, CDPSE, PMP, among others.


text: Our Risk Management Steering Committee, which includes the Company's Chief Risk and Operations Officer (Chair), CIO and ISO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.


text: Both the CIO and ISO regularly report to the Technology Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the Company's cybersecurity program and maturity assessment, while the Technology Committee and Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and ISO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Technology Committee and Audit Committee would be immediately notified and briefed.


text: Cybersecurity Governance The Audit Committee and Risk Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Risk Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Risk Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.


text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including ten years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's Chief Security Officer ("CSO") reports to the Chief Risk Officer and oversees the Company's information security programs. The CSO possesses over 20 years of Information Security and Technology experience.


text: Our Risk Management Committee, which includes the Company's Chief Risk Officer (Chair), Director of Risk Management and CSO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.


text: Both the CIO and CSO regularly report to the Board's Risk Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Risk Committee reviewed the Company's cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CSO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Risk Committee would be immediately notified and briefed.


text: In January 2025, the Company hired a Chief Technology Officer ("CTO"), who oversees the Company's information technology programs and investments. The CTO now encompasses the responsibilities previously held by the Chief Information Officer.


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: PINTEREST, INC.

ticker: PINS


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence prior to engagement on and ongoing risk-based periodic audits of our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."


text: Cybersecurity Risk Management and Strategy We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our management team has engaged third-party experts to provide guidance related to management of supply chain cybersecurity risks. Our strategy includes both short- and long-term initiatives to increase the security surrounding our assets and is supplemented using third-party threat monitoring, rigorous security protocols, and government partnerships. We perform cybersecurity assessments with respect to third parties who provide critical services or who have access to or store critical confidential data.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key information technology (IT) or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.


text: Measures We Take to Monitor and our Procedures for Responding to Data Breaches or Cyberattacks We have made investments to address data and cybersecurity risks. These investments include our use of continuous third-party security monitoring of our network perimeters, advanced persistent threat group monitoring to keep us informed of emerging serious threats, standardization of our network security architecture which separates business and supervisory control and data acquisition (SCADA) networks, and security information and event management software systems.


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhances the security of these systems. Our security systems correlate security events and aggregate security-related incident data, such as malware activity and other possible malicious activities. This system sends alerts if the data analysis shows that an activity could be a potential security issue. Security functionality is continuously monitored by our network operations center, and our network traffic is analyzed for signs of malicious activity through the CyberSentry program, which is managed by DHS's Cybersecurity and Infrastructure Security Agency and a third-party security operations center, which operates continuously. We maintain a dedicated SCADA group within our IT department to evaluate and respond to significant events and incidents that may impact our operations. Anti-virus solutions are deployed on the SCADA systems and workstations in our data centers and control centers.


text: Our processes and cybersecurity plans are part of our overall emergency response plans, and we conduct simulated exercise drills, including with multiple U.S. government agencies and peer companies, to enhance our preparedness and provide for continual process improvement.


text: If data and network defenses are bypassed, processes detailed in our Cyber Incident Response Plan would help identify, contain and eradicate threats and bring our systems back online if needed. Additionally, the plan requires that the appropriate level of our management be made aware of incidents and be updated as the situation warrants.


text: Vulnerability Assessments and Penetration Testing We hire an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.


text: Government and Industry Group Engagement We engage with a wide variety of government agencies and industry groups to enable cross-sharing of information and to identify opportunities to improve our security, including active participation in IT Sector Coordinating Councils and attendance at classified briefings and security architecture reviews hosted by the U.S. Department of Energy, the U.S. Federal Bureau of Investigation and DHS. Partnership with these agencies provides us with intelligence on a wide range of critical infrastructure protection and cybersecurity issues as well as an opportunity to exchange best practices.


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested on this training and cybersecurity performance is considered in annual employee performance reviews.


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Executive Officer, General Counsel and our Chief Information Officer have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 120 years of combined cybersecurity experience as of year-end 2023, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.


text: The Board's Role in Cybersecurity Risk Oversight The Audit Committee of our Board has oversight responsibility related to cybersecurity risk and is briefed quarterly by our Chief Information Officer on cybersecurity risk, our cybersecurity management program and initiatives, and, if applicable, notable cybersecurity events. In the event of a significant cybersecurity incident, our Chief Executive Officer will notify the Chairman of the Board or, in that person's absence, the lead independent director of the Board.


text: Cybersecurity Risk Management and Strategy We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is consistent with the security directives issued by TSA where required and aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key IT or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested regularly on cybersecurity, and cybersecurity performance is considered in annual employee performance reviews.


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Information Officer and, occasionally, our Chief Executive Officer and our General Counsel have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 100 years of combined cybersecurity experience as of year-end 2024, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our General Counsel to review cybersecurity risks, and evaluate their nature and severity, as well as identify potential mitigation and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: We maintain a system of data protection and cybersecurity resources, technology, and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements. We also perform annual and ongoing cybersecurity awareness training, which includes regular simulated phishing campaigns. We also run tabletop exercises, including with external advisors, to simulate a response to a cybersecurity incident, and we use the findings to improve our practices, procedures, incident response plan, and technologies. In the event of a cybersecurity incident, we have worked with external advisors to develop an incident response plan, which provides guidelines for responding to an incident and facilitates coordination across multiple parts of our Company. The incident response plan includes a procedure for notifying the CISO and CIO of any incident as well as a procedure for reporting any material incidents to the Audit Committee of our Board (the "Audit Committee") and Board as appropriate.


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protect, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO and our CISO, in consultation with our CIO and General Counsel, use the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity, regularly. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Our CISO, CIO, and General Counsel collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors— Risks Related to our Business—If our efforts to protect the privacy and security of information related to our customers, us, our associates, our suppliers and other third parties are not successful, we could become subject to litigation, investigations, liability and negative publicity that could significantly harm our reputation and relationships with our customers and adversely affect our business, financial condition, and operating results." and "Risk Factors— Risks Related to our Business—A material disruption in our information systems, including our website or call center, could adversely affect our business or operating results and lead to reduced net sales and reputational damage." in Part 1 of this Annual Report.


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our Chief Legal Officer ("CLO") to review cybersecurity risks and evaluate their nature and severity, as well as identify potential mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO, and our CISO, in consultation with our CIO and CLO, uses the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported periodically to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Our CISO, CIO, and CLO collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.


text: During fiscal years 2024, 2023, and 2022, we did not experience a material information security breach incident, and the expenses we have incurred from information security breach incidents have been immaterial. We are not currently aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats that are reasonably likely to materially affect us, refer to Item 1A, "Risk Factors" in Part I of this Annual Report.


text: Information Security Program The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. The information security organization is overseen by the Information Security Advisory Team (the "ISAT"), further detailed under the caption "Cybersecurity Governance" below.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Cybersecurity Risk Management and Strategy Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the CryptoCurrency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.


text: Our cybersecurity risk management program includes: • Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology ("IT") environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and • Ensuring risk is addressed and tracking any necessary remediation through an action plan.


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the ISAT in an effort to continuously improve our cybersecurity risk posture. Examples of third-party actions include risk assessments and penetration testing of our systems.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other IT risks to the Board's Risk and Audit Committee. As part of this oversight, we created the ISAT. The ISAT is comprised of cybersecurity consultants and senior managers and executives from multiple functions within MARA, including IT, finance, legal, internal audit and operations. Members of the ISAT have extensive professional experience in cybersecurity, software engineering and information technology and hold industry-recognized certifications, including Certified Information Systems Security Professional (CISSP) and Systems Security Certified Practitioner (SSCP). The ISAT oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The ISAT meets at least semi-annually to discuss matters involving cybersecurity risks.


text: The ISAT ultimately provides information to our Risk and Audit Committee regarding its activities, including those related to cybersecurity risks. The Risk and Audit Committee also receives a briefing and continuing education from a member of the ISAT relating to our cybersecurity risk management program at least annually. The ISAT is responsible for notifying the Risk and Audit Committee of material cybersecurity incidents.


text: We consider cybersecurity risk to be an important potential risk to our business. Our Audit Committee maintains oversight of cybersecurity and other information technology risks affecting us. As such, on a quarterly basis, or as frequently as required, management provides reports regarding cybersecurity and other information technology risks to the Audit Committee, which, pursuant to its charter, is generally responsible for the oversight of many of our broader risk assessment and risk management policies. These management updates are designed to inform the Audit Committee of any potential risks relating to information security or data privacy and may outline any relevant mitigation or remediation tactics being implemented.

companyName: CIVITAS RESOURCES, INC.


text: Our Vice President of Information Technology, Jerry Vigil, leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. Mr. Vigil is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. Mr. Vigil has over 25 years of information technology management experience and has served as our Vice President of Information Technology since January 2024. Mr. Vigil served in the same role at HighPoint Resources Corporation from May 2014 until its merger with us in April 2021. Mr. Vigil served as our Director of Information Technology from April 2021 through December 2023. Mr. Vigil has a Bachelor of Science in Business Technology Management and Computer Science from Regis University.


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys both commercially available solutions and proprietary systems to manage threats to our information technology environment actively and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.


text: We also employ a cybersecurity awareness program, which incorporates external expertise and guidance in all aspects of our cybersecurity program, that includes an extensive onboarding training requirement and monthly ongoing training on protecting corporate data and digital assets. We complete annual internal security audits and vulnerability assessments of our information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We continually enhance our information security capabilities in order to protect against emerging threats, while also increasing our ability to detect and respond to cyber incidents and maximize our resilience to recover from potential cyber-attacks. We have a robust incident response plan in place that provides a documented runbook for responding to cybersecurity incidents and facilitates coordination across multiple parts of our entity. Additionally, we have purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. Our insurance covers situations arising from, among other things, cyber-related breaches and interruptions in the business continuity of our computing environment. These policies are annually reviewed by industry underwriters at which time our security practices, programs, processes, and procedures are thoroughly disclosed, reviewed, and evaluated for purposes of determining our insurability.


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, please refer to "Item 1A. Risk Factors - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss.".


text: Our Vice President of Information Technology ("VP-IT") leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. The VP-IT is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. The VP-IT has over 25 years of information technology management experience and has served as our VP-IT since January 2024.


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys third-party cybersecurity solutions to actively manage threats to our information technology environment and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, refer to "Item 1A. Risk Factors - Risks Related to Our Business and Operations - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss."


text: Risk Management and Strategy We have processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide us on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in our centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in our ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: Marathon Petroleum Corp

ticker: MPC


text: We apply an enterprise risk management ("ERM") methodology as established and led by our executive leadership team to identify, assess and manage enterprise-level risks. Our cybersecurity risk program directly integrates and is intended to align with our governing ERM program.