text: The Company's Board of Director oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ESG Inc.

ticker: ESGH

secItem: Item 1C


text: Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats is becoming more sophisticated and constantly changing. We recognize the importance of developing, implementing and maintaining strong cybersecurity policies and processes to protect our information systems and the confidentiality, integrity, and accessibility and availability of our data.

companyName: FingerMotion, Inc.

ticker: FNGR


text: We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management company wide. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is monitored and tracked by our Risk and Information Security Committee, as well as through a separate cybersecurity assessment of the China IT platform operated by our contractually controlled subsidiary, JiuGe Technology, which is required under PRC laws. The lead information technology manager (the "IT Manager")


text: of JiuGe Technology oversees this assessment, which is performed by a third party hired by JiuGe Technology and includes some government oversight, called the Multi-Level Protection Scheme ("MLPS"), the objective of which is to protect data and information systems from security threats. The assessment stratifies IT systems based on the risk and severity of potential security breaches related to the data handled and assesses the effectiveness of the systems in safeguarding against cyber threats. The MLPS includes attributes such as physical security, network security, host security, application security, and data security. The final MLPS report is submitted to the appropriate authorities, and the IT Manager also reviews this report with our CFO.


text: Our CFO and the IT Manager report directly to the Risk and Information Security Committee to review the Company's information security and cybersecurity risks, including but not limited to, the MLPS report. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or timely detect every incident.


text: Company currently engages third parties in connection with our China cybersecurity annual assessment overseen by our IT Manager, which is driven by risk ranking and assessment. Cybersecurity considerations for operations outside of China, which includes a small proportion of core functions as well as administrative functions, are incorporated in the Company's overall risk assessment and will be considered in the overall SOX/controls management testing going forward when appropriate. Recognizing the importance of cybersecurity from both an operational and disclosure perspective, as well as the complexity and evolving nature of cybersecurity threats, we plans to revisit the link between China cybersecurity testing and FingerMotion's consolidated cybersecurity risk assessment and consider potential enhancements. FingerMotion will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.


text: We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third-party service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.


text: We do not currently identify any major cybersecurity threats that have materially affected or are reasonably likely to materially affect us (including our business strategy, results of operations, or financial condition).


text: Our Board of Directors recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our customers, employee and vendor information, as well as non-public information about our Company. Although our full Board of Directors has ultimate responsibility with respect to risk management oversight, the Risk and Information Security Committee of our Board of Directors is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity risks.


text: The CFO and CEO play a pivotal role in informing the Risk and Information Security Committee on cybersecurity risks. The CFO will immediately notify the Risk and Information Security Committee and Board of Directors of any cybersecurity incident that is determined to be material. The CFO and CEO deliver focused updates to the Risk and Information Security Committee annually, or more frequently as needed, in response to specific incidents or emerging threats. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: As we progress in the assessment and enhancement of our cybersecurity program, we plan to consider the following areas for enhancement and incorporation into the cybersecurity risk management and governance program in the future:


text: Oversight of Third-Party cybersecurity risk Engaging/ outsourcing Risk management Personnel Monitoring system/ procedures for cybersecurity incidents Reporting to Board of Directors regarding cybersecurity risks and incidents


text: Risk Management Personnel and managing our cybersecurity risks rests with the CEO, Mr. Martin Shen, and the CFO, Mr. Yew Hon Lee, working in close coordination with Mr. ShenJian, the IT Manager of our China Operations. Messrs. Shen and Lee have experience in overseeing IT Functions, including cybersecurity. Mr. ShenJian (the IT Manager) has 24 years of experience in technical work since graduating from Jiaotong University in June 2000 with a major in technology. His expertise is critical in designing, implementing, and executing our cybersecurity strategies.


text: Our IT Manager oversees our governance programs in partnership with our CEO and CFO, oversees testing of our compliance with government standards in China, remediates known risks, and leads our employee training program around cybersecurity.


text: We do not maintain sensitive financial information or client data within our digital marketing tools or within our information technology platforms. We do not have a large or complex data environment or systems that process sensitive information and as such we maintain an information security and cybersecurity program and a cybersecurity governance framework that is appropriate for an operation of our size. As a digital marketing services provider, we utilize social media and other marketing platforms to build client marketing campaigns and direct marketing services. The vast majority of market data and analytical tools we use are developed and supported by large technology companies and as such rely on their infrastructure to ensure their web-based solutions have the appropriate cybersecurity protections to ensure our digital marketing services are secure. We leverage our proprietary digital analytical tools to develop more target marketing plans for our clients. We utilize PCI compliant merchant processors to ensure that client payments for services and ad spend are securely processed and cybersecurity risks minimized for us and our clients.

companyName: SPECIFICITY, INC.

ticker: SPTY


text: We maintain an information technology and security program appropriate for a company our size, taking into account our operations and risks. The Company recognizes the critical importance of maintaining the trust and confidence of our investors, employees, and vendors. The Company's cybersecurity policies and processes are integrated into the Company's enterprise risk management program and are informed by recognized frameworks established by the National Institute of Standards and Technology, and other applicable industry standards.

companyName: BIOVIE INC.

ticker: BIVI


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.


text: These processes are managed and monitored by an outside information technology vendor under the supervision of our Chief Financial Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with our outside information technology vendor on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incidents are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. The Company's Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Board receives updates from the Company's management on cybersecurity risks on at least an annual basis.


text: Aptiv has a risk-based cybersecurity program, dedicated to protecting our data, products and information technology systems as well as data belonging to our customers, suppliers and employees. Our ability to keep our business operating effectively depends on the functional and efficient operation of information technology capabilities, both internally and externally. Our capabilities, as well as those of our customers, suppliers, partners and service providers, are crucial to our operations and may contain confidential personal information, sensitive business-related information or intellectual property. These capabilities are also susceptible to interruptions (including those caused by systems failures, cyber-attacks and other natural or man-made incidents or disasters), which may be prolonged or go undetected.

companyName: Aptiv PLC

ticker: APTV


text: Risk Management and Strategy Our cross-functional cybersecurity teams are responsible for addressing both enterprise and product cybersecurity risks. These teams, which are comprised of experts both within the organization and externally, utilize a defensive cybersecurity strategy with multiple layers of cybersecurity controls to protect our data (and data of others in our possession), systems and products.


text: Enterprise and product cybersecurity are incorporated into the Company's overall risk management process. On a monthly basis, the Company's cross-functional Enterprise Risk Management Committee meets to discuss short-term and long-term enterprise-wide risks and necessary action plans to mitigate those risks. The Chief Information Security Officer (the "CISO") regularly presents to the Company's Enterprise Risk Management Committee on key cybersecurity risks, threats and developments, as well as the Company's strategies to mitigate those risks.


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity team, led by the Chief Information Officer ("CIO"), is responsible for identifying, assessing the severity of, managing and remediating cybersecurity risks to the Company's information technology infrastructure. Risks are identified through vulnerability hunting, infrastructure penetration testing, threat intelligence activities and other processes defined by the infrastructure Governance, Risk and Compliance ("GRC") assessment program utilized by the Company. Furthermore, this team seeks to reduce cybersecurity risks through a number of activities, including annual cybersecurity training for the majority of the Company's employees, phishing tests, compliance assessments, vulnerability and noncompliance remediation and the implementation and maintenance of new cybersecurity technology.


text: Third-party service providers are also utilized by the Enterprise Cybersecurity team to play a supporting role in incident response, threat intelligence, firewall management, vulnerability management and endpoint management and detection.


text: Aptiv is also exposed to cybersecurity risks at third-parties, such as suppliers, customers, service providers and consultants. Third-party risk to the Company is identified through an internal third-party risk management process, which involves analyzing third parties for cybersecurity risk at onboarding and throughout the duration of their relationship with the Company. For third-parties with a high cyber risk, we also utilize external firms to monitor such third-parties for threats and to provide remediation support as needed.


text: Product Cybersecurity The Company's Product Cybersecurity team, led by the Chief Technology Officer (the "CTO"), is responsible for assessing and managing the Company's cybersecurity risk as it relates to Aptiv's product portfolio. Risks are identified through threat intelligence, security testing, including penetration testing, audits and other processes defined by the Company's product cybersecurity GRC program. The processes by which the Product Cybersecurity team manages automotive product security risks have been audited, assessed and certified as compliant with various applicable international regulatory standards by independent third-party auditors.


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity Security Operation's Center ("SOC"), which is supervised by the CIO, is responsible for identifying, assessing and managing the Company's risks from cybersecurity threats, as well as for responding to cybersecurity incidents. The SOC management team carries a diverse array of applicable cybersecurity and information technology credentials and generally has over twenty years of experience in cybersecurity. When an infrastructure cybersecurity incident occurs, the SOC initiates communications to the appropriate groups within the Company, which may include various members of the Company's management, including the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Operating Officer.


text: Depending on the severity and the nature of the incident, an investigation and impact mitigation protocols may be triggered. External experts or agencies may also be engaged in accordance with the Company's policies and procedures. Upon conclusion of the active investigation of an incident, the SOC is required to identify the cause of the incident, formally report to Company leadership, and initiate changes to protect against a recurrence of the incident, among other procedures.


text: Table top exercises are also held annually and are designed to practice and validate existing incident response plans, as well as to identify the plans' respective strengths and weaknesses. These exercises test the response capabilities of both technical and executive level resources, including key vice presidents, senior company leaders and cross-functional capabilities, such as with the Product Cybersecurity team as well as with the Legal, Privacy and Sales teams.


text: Product Cybersecurity The Product Security Incident Response Team (the "PSIRT"), which is supervised by the CTO, is responsible for responding to product related cybersecurity incidents, which at times involve collaborating with the Enterprise Cybersecurity SOC. The PSIRT team regularly analyzes vulnerabilities reported by threat intelligence and public vulnerability reporting databases and determines whether any of those vulnerabilities are present in the Company's products. Vulnerabilities identified are reviewed by the Vice President of Product Security on a weekly basis with involvement from the CTO and the Company's legal staff as necessary. For all vulnerabilities identified, the PSIRT reviews whether adequate mitigations are already in place. In situations where adequate mitigations are not present, the PSIRT works with the customer to address the concern which may involve adding additional mitigations to the product.


text: Board of Directors Oversight The Company's Board of Directors (the "Board") takes an active role in risk oversight related to cybersecurity matters, primarily through the Audit Committee (the "AC"), which covers enterprise cybersecurity risk, and the Innovation and Technology Committee (the "ITC"), which covers product cybersecurity risk. The Board, individually and through the AC and ITC, regularly reviews relevant information technology and cybersecurity matters and receives periodic updates from information technology and cybersecurity subject matter experts as part of its risk assessment procedures, including analysis of existing and emerging risks, as well as plans and strategies to address those risks. In connection with the Board's risk management oversight responsibility, the entire Board receives a full briefing from management annually on cybersecurity matters, as well as periodic briefings based on specific requests or current events. On a regular basis, the Board also reviews the Company's enterprise risk management program, within which the Company's cybersecurity processes have been integrated, as described above.


text: The Board and AC regularly review the identification and management of enterprise cybersecurity risks and review regular reports from management on system vulnerabilities and security measures in effect to deter or mitigate breaches or hacking activities. The AC also reviews our guidelines and policies with respect to risk assessment and management of our major financial and information technology risk exposures, including enterprise cybersecurity, along with the monitoring and mitigation of identified exposures.


text: The Board and ITC regularly review the identification and management of product cybersecurity risks and review regular reports from management on risks and mitigation strategies in effect to reduce product cybersecurity risk. The ITC also reviews our guidelines and policies with respect to risk assessment and management of product security risks, including both our approach toward a secure systems development lifecycle and product security incident response.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."


text: Cybersecurity Risk Management and Strategy As an externally managed, closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. As such, we rely on the cybersecurity policies and procedures implemented by Prospect Capital Management for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of Prospect Capital Management's cybersecurity program that are relevant to us.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: Prospect Capital Management has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on, or through, our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping to identify areas for continued focus and improvement.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Adviser, or our Administrator are detected.


text: Prospect Capital Management conducts regular phishing tests in which educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure."


text: Board of Directors Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, manage our cybersecurity program. The CCO supervises our oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as our CCO for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure. "


text: Risk Management and Strategy Our cybersecurity program is led by our IT department and our Cybersecurity Steering Committee, which consists of IT leadership and certain of our senior management. The members of our IT leadership team have an average of over 25 years of experience in IT operations and over 10 years of experience in IT security, including cybersecurity risk identification and mitigation. Our IT department stays informed of current developments in cybersecurity threats and preventative measures and continuously updates our cybersecurity program based on this knowledge. Additionally, our Cybersecurity Steering Committee meets on a regular basis to assess, identify and manage material cyber risks. We also engage with a range of external specialists, including cybersecurity firms, consultants, and auditors in evaluating and testing our cybersecurity risk management systems, as well as specialized third-party companies that assist in monitoring our information systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. These partnerships enable us to access specialized knowledge and insights which we leverage to continuously improve and modernize our cybersecurity program. We use industry-leading security tools, regularly perform security risk assessments and tool reviews with independent third parties to evaluate program effectiveness, and regularly update our security roadmap. Our IT department monitors industry news and updates to stay aware of the cybersecurity landscape, including incidents or issues that may arise involving our third-party service providers. We perform cybersecurity diligence on certain of our third-party service providers, and for third-party service providers with access to our internal information systems, we require them to review and agree to our relevant cybersecurity policies. Our cybersecurity program is designed to align with the National Institute of Standards and Technology's five-phase Cybersecurity Framework (Identify-Protect-Detect-Respond-Recover). We have integrated cybersecurity risk management into our overall risk management system, ensuring that cybersecurity risks are taken into consideration when managing business objectives and operational needs.

companyName: USA Compression Partners, LP

ticker: USAC


text: We require all our employees to take monthly training and testing on cybersecurity threats, including how to recognize and properly respond to phishing and social engineering schemes. We have deployed a phishing detection system to report suspicious emails, which are flagged for further review. We install and regularly update antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems. We have an incident response plan in place in the event of a cybersecurity incident to guide our response and mitigation actions, which includes requiring our IT team to escalate incidents of a certain severity to the appropriate members of management.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. While we have designed our cybersecurity program with the purpose of minimizing risk and protecting our assets, no cybersecurity measures can eliminate all risks. Therefore, there remains a possibility that we could experience a cybersecurity incident that could have a material impact on our business, results of operations, and financial condition. For more information on this risk, read Part I, Item 1A "Risk Factors – General Risk Factors –Cybersecurity breaches and other disruptions of our information systems could compromise our information and operations and expose us to liability, which would cause our business and reputation to suffer."


text: Our IT leadership updates the Cybersecurity Steering Committee on cybersecurity risks and incidents, ensuring that management is kept aware of USAC's cybersecurity postures and risks. The Cybersecurity Steering Committee is overseen by, and management periodically provides an update to, the Audit Committee of our Board of Directors regarding our cybersecurity posture and risks, ensuring that the Audit Committee has knowledge and oversight of significant cybersecurity matters and can provide guidance on critical cybersecurity issues.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks The information and operational technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. In the normal course of business, we may collect and store certain sensitive information of the Partnership, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party and employee information, and certain personally identifiable information.


text: As part of the shared services integration with Energy Transfer, we are transitioning to a shared services cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. As we are in the midst of that transition, currently certain of our information systems are operating under the shared services cybersecurity program, while certain other information systems remain under our internal USAC cybersecurity program. We expect that once the shared services implementation is complete, all of our information systems will operate under the shared services cybersecurity program.


text: The shared services cybersecurity program is managed by a team of full-time Energy Transfer employees, overseen by its Chief Information Officer, that are tasked with conducting day-to-day information technology ("IT") operations (collectively, the "Energy Transfer IT team"). This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. In creating and implementing this cybersecurity program, the Energy Transfer IT team engages with the guidance of the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Transportation Security Administration (TSA) and the U.S. Coast Guard (USCG). The shared services cybersecurity program seeks to use a defense-in-depth approach for cybersecurity management, layers of technology, policies and training at all levels of the enterprise designed to keep our assets secure and operational. It uses various processes as part of its efforts to maintain the confidentiality, integrity and availability of our systems, including security threat intelligence, incident response, identity and access management, supply-chain security assessments, endpoint extended detection and response protection, network segmentation, data encryption, event monitoring and a Security Operations Center (SOC).


text: Our internal cybersecurity program is led by USAC's IT department. USAC's internal cybersecurity program is designed to align with the National Institute of Standards and Technology's Cybersecurity Framework. USAC's IT department stays informed of current developments in cybersecurity threats, including incidents or issues that may arise involving our third-party service providers, and preventative measures and continuously updates our cybersecurity program based on this knowledge. It utilizes industry-leading security tools and regularly performs security risk assessments and tool reviews with independent third parties to evaluate program effectiveness, and regularly updates our security roadmap. USAC's IT department monitors industry news and updates to stay aware of the cybersecurity landscape, including incidents or issues that may arise involving USAC's third-party service providers.


text: In an effort to validate the effectiveness of our cybersecurity programs and assess such program's compliance with legal and regulatory requirements, we engage third-party service providers to perform audits, assessments, and penetration tests. These partnerships enable us to access specialized knowledge and insights which we leverage to continuously improve and modernize our cybersecurity programs. We have integrated cybersecurity risk management into our overall risk management system, ensuring that cybersecurity risks are taken into consideration when managing business objectives and operational needs.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. All employees who have access to our systems are required to undergo cybersecurity training at least annually and, under the shared services cybersecurity program, our employees will be required to review and acknowledge our cybersecurity policies each year. User access controls have been implemented to limit unauthorized access to sensitive information and critical systems. Employees are required to use multifactor authentication and keep their passwords confidential, among other measures.


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, before contracting with certain technology services providers, when possible, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require these providers to adhere to our security standards and protocols.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report on Form 10-K, though the Partnership and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Partnership, either financially or operationally. Cybersecurity incident response is a component of both the Partnership's cybersecurity program and the Partnership's business continuity plans, which are designed to limit service interruptions and provide for continued business operation in the event of disaster, whether physical, environmental or cyber in nature. However, we recognize that cybersecurity threats are continually evolving, and there remains a risk that a cybersecurity incident could potentially negatively impact the Partnership. Despite the implementation of our cybersecurity processes, we cannot guarantee that a significant cybersecurity attack will not occur. A successful attack on our information system or operational technology system could have significant consequences to the business, including the interruption of key services that our customers depend on. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. For additional information on cybersecurity risks, see Part I, Item 1A "Risk Factors – General Risk Factors –Cybersecurity breaches and other disruptions of our information systems could compromise our information and operations and expose us to liability, which would cause our business and reputation to suffer."


text: Board of Directors' Oversight and Management's Role Under the shared services cybersecurity program, Energy Transfer's Chief Information Officer oversees the functions of IT, cybersecurity, infrastructure and IT governance (including the Energy Transfer IT team) and has more than 35 years of experience leading business technology functions. The members of the Energy Transfer IT team have over 50 years of combined experience in the field of IT, including 20 years dedicated to cybersecurity, and hold various certifications, including Global Industrial Cyber Security Professional (GICSP), Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH) certifications. Our internal cybersecurity program is led by USAC's IT department. The members of our IT leadership team have an average of over 25 years of experience in IT operations and over 10 years of experience in IT security, including cybersecurity risk identification and mitigation.


text: Our cyber incident response plan requires IT team members who detect suspicious activity in our IT environment to escalate that activity to a supervisor who then evaluates the threat. If necessary, the suspicious activity is reported to Energy Transfer's Chief Information Officer, if applicable. Management (including representatives from the legal, human resources and IT departments) is notified by the IT team whenever a discovered cybersecurity incident may potentially have a significant impact on us or our customers.


text: Our Audit Committee is ultimately responsible for assessing and managing the Partnership's material risks from cybersecurity threats. Our IT leadership provides periodic cybersecurity program updates to senior management and to the Audit Committee. Management also updates the Audit Committee as new risks are identified and the steps taken to mitigate such risk s.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third party consulting firm to evaluate and test the Company's risk management systems and to assess and remediate potential cybersecurity incidents as appropriate, which work is ongoing.

companyName: MARIMED INC.

ticker: MRMD


text: Board of Directors The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer and Vice President of Information Technology. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's board of directors at regular board meetings. The Vice President of Information Technology also provides updates annually or more frequently as appropriate to the Company's board of directors.


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Vice President of Information Technology is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Vice President of Information Technology has more than 20 years of experience with information technology and related systems security matters and processes.


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Financial Officer and Vice President of Information Technology, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.


text: During the year ended December 31, 2023, the Company experienced a cybersecurity incident that resulted in a $0.7 million term loan payment being initiated in error to an account provided in a fraudulent email the Company received. As a result of this incident, with the assistance of an outside independent consultant, the Company reviewed and strengthened its procedures in and around the approval of wire transfers of funds, and believe that these enhanced procedures will protect the Company against the reoccurrence of such incidences in future periods.


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third party consulting firm to evaluate and test the Company's risk management systems and to assess and remediate potential cybersecurity incidents as appropriate, which work is ongoing.


text: Board of Directors The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer and Vice President of Information Technology. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's Audit Committee, and the Audit Committee provides updates to the Company's Board of Directors at regular Board meetings. The Vice President of Information Technology also provides updates annually or more frequently as appropriate to the Company's Board of Directors.


text: Under the oversight of the Audit Committee of the Company's Board of Directors, and as directed by the Company's Chief Executive Officer, the Vice President of Information Technology is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Vice President of Information Technology has more than 20 years of experience with information technology and related systems security matters and processes.


text: The Audit Committee of the Company's Board of Directors, with the assistance of the Company's Chief Financial Officer and Vice President of Information Technology, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.


text: During the year ended December 31, 2023, the Company experienced a cybersecurity incident that resulted in a $0.7 million loss as a result of a term loan payment being initiated in error to an account provided in a fraudulent email the Company received. As a result of this incident, with the assistance of an outside independent consultant, the Company reviewed and strengthened its procedures in and around the approval of wire transfers of funds, and believe that these enhanced procedures will protect the Company against the reoccurrence of such incidences in future periods.


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Board of Directors Our Board is responsible for overseeing our processes for assessing and managing enterprise risk, including with respect to cybersecurity. The Board considers our risk profile when reviewing our annual business plan and incorporates risk assessment into its decisions.


text: Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee. The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security ("SVP-GIS") and our Executive Vice President and Chief Information Officer ("EVP-CIO"), and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents.


text: At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere and maintains several certifications, including Certified Information Systems Security Professional ("CISSP") from ISC Squared and Certified Information Security Manager ("CISM") from the Informations Systems Audit and Control Association ("ISACA"). Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS's direct reports include a number of experienced information security leaders responsible for various aspects of our security program, each of whom is supported by a team of experienced cybersecurity professionals.


text: The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and security testing; operation of protective security tools and systems; security monitoring, incident response, and digital forensics; security research and development and support for information technology and security functions.


text: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual security requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.


text: Risk Management and Strategy We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.


text: We require our associates to receive annual training on our information security policies. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written information security policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our information security program and cover topics such as acceptable use of information systems, security risk management, access management, audit and logging, patching, and security requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary and integrated into employee training programs and our contracting process. We are also subject to the Payment Card Industry Data Security Standard and we perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.


text: Incident Response We have adopted an Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. The IRP is practiced through walkthroughs and tabletop exercises on at least an annual basis.


text: The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the "DBRT"), which is led our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant security threats, incidents, and issues that involve data loss or operational impact to our business through a documented process. Potentially material cyber events are escalated by our EVP-CIO to executive management and reviewed with members of the Company's Disclosure Committee.


text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity threats to our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third-parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity threats, including as a result of such previous incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.


text: Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee. The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security ("SVP-GIS") and our Executive Vice President and Chief Information Officer ("EVP-CIO"), and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and cybersecurity considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.


text: At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 25 years of experience in government and industries including retail and manufacturing, and industry certifications including Certified Information Systems Security Professional ("CISSP") from ISC Squared and Global Information Assurance Certification ("GIAC") from SANS Institute. Our SVP-GIS also has experience in forensic investigations, strategic cyber risk management, and cybersecurity program development. Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS's direct reports include a number of experienced cybersecurity leaders responsible for various aspects of our cybersecurity program, each of whom is supported by a team of experienced cybersecurity professionals.


text: The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and cybersecurity testing; operation of protective cybersecurity tools and systems; cybersecurity monitoring, incident response, and digital forensics; cybersecurity research and development and support for information technology and cybersecurity functions.


text: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual cybersecurity requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.


text: Risk Management and Strategy We employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.


text: We require our associates to receive annual training on our cybersecurity policies and practices. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written cybersecurity policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our cybersecurity program and cover topics such as acceptable use of information systems, cybersecurity risk management, access management, audit and logging, patching, and cybersecurity requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary, and integrated into employee training programs and our technology procurement process. We are also subject to the Payment Card Industry Data Security Standard and perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.


text: Incident Response We have adopted an Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the "DBRT"), which is led by our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy, and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant cybersecurity threats, incidents, and issues through a documented process. Potentially material cybersecurity incidents are escalated by our EVP-CIO to executive management and reviewed with members of the Company's Disclosure Committee.


text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity incidents involving our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity incidents, including as a result of the June 2018 incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.


text: We have implemented a comprehensive cybersecurity program guided by recognized industry practices and frameworks and we continue to evolve the program in order to be able to assess, identify and manage risks from the continually evolving cybersecurity threat landscape. Our cybersecurity program encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Although we maintain a cybersecurity program that we believe is reasonably designed to protect the Company, cybersecurity threats may result in adverse effects on the confidentiality, integrity, and availability of our information systems or those of third parties on which we rely, and our connected products and services.

companyName: Xylem Inc.

ticker: XYL


text: Management and Internal Cybersecurity Team Our Chief Information Officer ("CIO"), who has over 30 years of relevant work experience in information technology, including cybersecurity, is responsible for the Company's information technology systems and cybersecurity and is an integral part of the Company's management of cybersecurity and related risks. The CIO reports to the Senior Vice President, Operations and Supply Chain, who reports directly to the Chief Executive Officer.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience and holds the Certified Information Systems Security Professional certification, reports to the CIO. The CISO is responsible for assessing, monitoring and advising the Company's businesses, management and the Board of Directors ("Board") on the Company's risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan.


text: The Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications, is led by the CISO. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program, including infrastructure, governance and incident response as detailed below. On a regular basis, the CISO receives reports from the Team on these cybersecurity program matters. In addition, the CISO also receives reports and updates on incident response and cybersecurity threats.


text: Risk Management and Strategy The CISO and Team manage a program for enterprise cybersecurity that is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations, and secure manufacturing operations. The CISO and Team also manage a program for connected products and services cybersecurity risk management that is guided by the ISA/IEC 62443 standard to enable protection and resiliency across products and services. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our risk management processes undergo at least quarterly review to identify potential gaps and areas for additional investment, resources and focus. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying, and managing cybersecurity risks. Our Enterprise Risk Management ("ERM") Program annually assesses and, on an ongoing basis, monitors the Company's key risks, including cybersecurity risk.


text: We maintain a suite of policies – the Cybersecurity Policy, the Product Cybersecurity Policy and the Acceptable Use of Information Technology Resources Policy – that apply globally to all of our employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection. Our policies are reviewed annually to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate. Our Code of Conduct, implemented by the Board, requires our employees' adherence with our policies and practices, including with respect to cybersecurity risk management.


text: Employees receive ongoing annual education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats. Through our internal social media channel, we provide cybersecurity alerts and education. In addition, our policies require the use of a cyber risk management process to onboard new suppliers and other third parties.


text: The Company's cybersecurity risk mitigation strategy includes the use of risk transfer via insurance that provides protection against certain potential losses arising from certain cybersecurity incidents.


text: Board of Directors Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, employees and shareholders. In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to the Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. As part of its independent oversight of the key risks facing the Company, the Board and Audit Committee devote considerable time and attention to the oversight of management's approach to cybersecurity and related risk mitigation, including strategy, controls. resources, policies, standards, processes and practices. At least semi-annually, the Audit Committee or full Board receive reports from the CIO and CISO. Such reports include updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape, and other relevant topics. We have protocols and processes by which certain cybersecurity incidents, as specified by our Cybersecurity Incident Response Plan, are escalated within the Company and, as appropriate, to the Audit Committee. These escalation protocols are periodically reviewed and updated, as needed.


text: The Board receives a report on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program, including ongoing monitoring of the Company's risks, as appropriate. The ERM Program has identified cybersecurity as one of the Company's primary risks.


text: Key Internal Governance Bodies Xylem has a number of committees to bolster business resilience, protect shareholder value and enable compliance with regulatory requirements. The Enterprise Risk Committee ("ERC"), a key component of the Company's ERM Program, is comprised of senior executives and is responsible for reviewing the Company's key risks as identified by the ERM Program, including cybersecurity, and overseeing the Company's identification, assessment, management, mitigation and ongoing monitoring of these risks. As such, the ERC periodically receives reports from the CISO on cybersecurity risk.


text: The Cyber Risk Committee ("CRC"), comprised of a cross-functional group of senior executives including the CIO, CISO, Chief Financial Officer and General Counsel, provides advice and governance regarding the Company's strategic management of cybersecurity across the Company, including cybersecurity risk posture, projects, issues, threat intelligence and escalations. The CRC meets at least quarterly and receives reports and presentations from the CISO or third parties on internal and external cybersecurity matters; and, as appropriate, briefings from the CISO on cybersecurity incidents, the Company's incident response, recovery and remediation, and actual or potential impacts.


text: Incident Response Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, where the Incident Response Team and relevant business and functions drill our response to a simulated cyber incident. The results of these drills are used to identify areas for improvement in our processes and technologies.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we have not experienced any material cybersecurity threats or incidents as of the date of this Report, our cybersecurity program might not be able to prevent or mitigate future successful attacks, threats or incidents.


text: As detailed elsewhere in this Report, we also rely on information technology and other third-party vendors and strategic joint venture partners to support our business and operations, including our secure processing of personal, confidential, financial, sensitive, proprietary and other types of information, and to enable our connected product and service offerings. Despite ongoing efforts to improve our and third parties' ability to protect against cyber threats, we may not be able to protect all information systems or connected products and services. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. For a more detailed discussion of these risks see the discussion set forth under "Item 1A. Risk Factors" in this Report.


text: Cybersecurity Risk Management and Strategy Cybersecurity risk management is integrated into our Enterprise Risk Management ("ERM") Program, which is our approach to identifying, assessing, prioritizing and mitigating risks to the Company, with mitigation efforts focused on the highest risks. Our ERM Program assesses risks, including those related to cybersecurity, annually, and monitors such risks on an ongoing basis.


text: We maintain a comprehensive cybersecurity program that encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Our enterprise cybersecurity program is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations and secure manufacturing operations. Our connected products and services cybersecurity program is guided by the ISA/IEC 62443 standard. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, resiliency, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks.


text: We maintain cybersecurity policies that apply to all employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection, and also require the use of certain cyber risk management processes to onboard new suppliers and other third parties. We periodically review our policies to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate.


text: Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, the results of which are used to identify areas for improvement in our processes and technologies. We have protocols and processes by which certain cybersecurity incidents, as specified by our IRP, are escalated within the Company and, as appropriate, to the Audit Committee of the Board of Directors.


text: Employees receive annual and ongoing education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats.


text: The Company maintains insurance as part of its cybersecurity risk mitigation strategy to provide protection against certain potential losses arising from certain cybersecurity incidents.


text: Cybersecurity Governance In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to its Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. At least semi-annually, the Audit Committee or full Board receive reports from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). Reports include topics such as updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape and other relevant topics. The Board also receives a report from management on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program and ongoing monitoring of the Company's risks, including cybersecurity risk, as appropriate.


text: The Company's Cyber Risk Committee ("CRC"), comprised of a cross-functional group of senior executives, provides advice and governance regarding the Company's strategic management of cybersecurity across the Company, including cybersecurity risk posture, projects, issues, threat intelligence and escalations. At its periodic meetings, the CRC receives reports and presentations from the CISO or third parties on internal and external cybersecurity matters, and, as appropriate, briefings from the CISO on cybersecurity incidents, the Company's incident response, recovery and remediation and actual or potential impacts.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience, and is a Certified Information Systems Security Professional, is responsible for assessing, monitoring and advising the Company's various business units, management and the Board on risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan. The CISO leads the Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program.


text: Material Cybersecurity Risks, Threats & Incidents Although we have experienced actual and attempted cybersecurity threats and incidents in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations or financial condition, or are reasonably likely to have such an effect. However, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. For a more detailed discussion of the risks we face see the discussion set forth under "Item 1A. Risk Factors" in this Report.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: U.S. SILICA HOLDINGS, INC.


text: Risk Management and Strategy Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: • Vigilance: We maintain a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide routine mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function, our Chief Information Officer, the Director of IT Security & Risk Management, other members of management and relevant management committees and councils, including the Information Security Governance Committee.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, penetration and vulnerability testing and other assessments and exercises focused on evaluating the effectiveness of our cybersecurity measures. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also are informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Information Officer.


text: Our Chief Information Officer and the Director of IT Security & Risk Management are the members of management that are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the company. The Chief Information Officer and the Director of IT Security & Risk Management work in coordination with the other members of the Information Security Governance Committee (the "ISGC"), which includes our Chief Financial Officer, General Counsel, Environmental Health & Safety Director, Vice President of Finance, Vice President of Information Technology, Executive Vice President of Industrial & Specialty Products, and the Director of Corporate Human Resources & Talent Management.


text: The ISGC was established by the Audit Committee and its primary responsibility is to provide oversight to the Information Systems Security Program ("ISSP") to align information systems security activities to business goals, effectively manage risk, and ensure compliance. The ISGC is chaired by the Director, IT Risk Management, with the Chief Information Officer as an alternate. The ISGC's responsibilities include developing policies and supporting frameworks, controls, and procedures to protect company, customer, and employee data from cybersecurity breaches; establishing organizational risk tolerance and developing information security policies to align with this tolerance level; and ensuring adequate security controls, as specified in policies or otherwise agreed upon, to manage risk and compliance. The ISGC has developed an ISSP scorecard to communicate cybersecurity incidents and activity and report program accomplishments and provides quarterly updates to the Audit Committee, including the ISSP scorecard, and at least annual updates to the Company's extended leadership team.


text: Our Chief Information Officer and the Director of IT Security & Risk Management, in coordination with the ISGC, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Director of IT Security & Risk Management, and the ISGC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and the Chief Information Officer reports such incidents to the Audit Committee when appropriate.


text: Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, including serving as Chief Information Officer for us for the past four and one-half years, as well as for another large public company, a private consulting firm providing technology and cybersecurity advisory services and a privately held fuel oil blending and distribution company. The Chief Information Officer holds an undergraduate degree in management and leadership from Northeastern University.


text: Our Director of IT Security & Risk Management holds an undergraduate degree in computer science and a master's degree in business administration from Texas Tech University and has served in various roles in information technology for over 20 years, including serving as an IT security consultant and performing IT audit work for PricewaterhouseCoopers, Deloitte, and Grant Thornton. He then returned to the industry to oversee the IT security program for classified systems at a publicly-traded defense contractor. He next joined a publicly-traded energy services company to lead the IT security program before joining us in 2019. Certifications he has held at various points throughout his career include the following – Certified Information Systems Auditor (CISA), Check Point Certified Security Administrator (CCSA), Check Point Certified Security Expert (CCSE), Cisco Certified Network Associate (CCNA), Cisco Certified Network Professional (CCNP), and Microsoft Certified Professional (MCP).


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See "Risk Factors—Operational Risks" for additional discussion of cybersecurity risks to our business.


text: The Trust has no directors or executive officers. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"). As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: Risk Management Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Risk Management oversight and governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.