text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems, cloud security controls and monitoring, data backup and recovery systems and 24x7 security operations center.


text: c. The Company's approach to managing cybersecurity and digital risk is led by our CIO and CISO. Our CIO is supported by the Company at the highest levels and regularly engages with cross-functional teams at the Company, including Legal, Audit, Finance, Human Resources and Enterprise Risk Management.

companyName: JELD-WEN Holding, Inc.

ticker: JELD

secItem: Item 1C


text: d. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. Such insurance may be insufficient to cover all losses or all types of claims that may arise.


text: e. Our cybersecurity team conducts routine cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct periodic simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.


text: f. Our cybersecurity incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, communicate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: g. Our cybersecurity team regularly conducts tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.


text: Additionally, our cybersecurity risk management processes include review and assessment by external, independent third parties, who assess the maturity of our cybersecurity program and identify areas for continued focus and improvement. Furthermore, our Legal Department advises the Board about best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. We also have a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.


text: As of the date of this Form 10-K, we do not believe any risk from any cybersecurity threats or incidents have had, or are reasonably likely to have, a material impact on us; however, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not have a material adverse impact on our business, results of operations and financial condition. Refer to Item 1A - Risk Factors of this Form 10-K for information on cybersecurity risks that may materially affect our business, results of operations and financial condition.


text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our CIO reports to the CEO, and the CISO reports to the CIO. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. Cybersecurity and data governance risks are aligned with our overall Enterprise Risk Management process to help ensure potential cyber threats are identified, assessed and mitigated. Our top risks, such as cybersecurity, identified sub-risks and current and proposed mitigation strategies are reviewed regularly by the Enterprise Risk Management Committee. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO and CISO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO and CISO provide a cybersecurity update to the full Board at least annually.


text: Our management recognizes the importance of implementing and maintaining robust cybersecurity measures designed to address cybersecurity threats that pose risks to our business and operations. Therefore, we have established a comprehensive framework to identify, protect against, detect, respond to, and recover from cybersecurity incidents ("Incidents"). Our cybersecurity measures are designed to provide a structured approach to managing cybersecurity risks for an effective, efficient, an orderly response to any Incident.

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.


text: Increased cybersecurity risk due to the diversification of our data across external service providers and cyber incidents may adversely affect our business by causing a disruption to our operations, compromise our confidential information and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our financial position, results of operations and/or business strategy. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future where we may be unable to implement effective preventative measures in a timely manner.


text: Further discussion of the potential impacts on our business from cyber intrusions is provided in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). Our Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: Valvoline is committed to protecting information that is valuable to customers and critical to business operations from unauthorized access and disclosure by devoting significant resources to protecting information systems and data through investing in people, technology, and processes to protect data and systems against evolving cybersecurity threats. A cybersecurity program has been designed and implemented that is believed to reasonably manage risks from cybersecurity threats and enable the Company to prevent, monitor, identify, detect, investigate, respond to, mitigate, and report on threats and incidents.

companyName: VALVOLINE INC

ticker: VVV


text: Cybersecurity governance Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Audit Committee reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Audit Committee receives reports and presentations from the Senior Vice President and Chief Technology Officer ("CTO") and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 25 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.


text: The CSIRT receives direction and guidance from various departments including operations, information technology, communications, legal, and human resources while being responsible for maintaining and operating incident response capabilities at Valvoline by collecting, aggregating, and analyzing detected alerts and events from computer systems across the enterprise. Valvoline's CSIRT meets at least quarterly, and more frequently as appropriate, to review and discuss the Company's cybersecurity program. The CSIRT has the authority and system entitlements to confiscate, isolate, or disconnect equipment; investigate suspicious activity; monitor usage; and disable system access in the proper execution of their duties. The CSIRT is responsible for declaring an incident and initiating escalation to the Incident Response Team ("IRT"). The IRT is responsible for coordinating incident response activities across functions and is comprised of cross-functional and multi-management level personnel including, but not limited to, the Senior Director of Information Security, CSIRT Manager, Chief Legal Officer, Chief Audit Executive, Privacy & Compliance Counsel, Chief Technology Officer, Head of Global Insurance, Director of Corporate Communications, Chief Financial Officer, Chief Operating Officer, Chief Human Resource Officer, and Head of Physical Security.


text: The IRT is also responsible for reporting incidents, following Valvoline's Information Security Incident Response Plan ("IRP"), in accordance with legal requirements, coordinating external communications, and setting information sharing restrictions. Other departments or individuals may be engaged according to the specific nature of the incident and will operate at the direction of the IRT. Valvoline's Senior Director of Information Security is responsible for the implementation of, and amendments to, the IRP and supporting procedures.


text: Risk management and strategy Valvoline has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of critical systems and information in addition to a cybersecurity incident response plan based on the National Institute of Standards ("NIST") Cybersecurity Framework ("CSF"). The program applies, where appropriate, to the Company's internal and external information systems, applications, networks, and operations which includes scanning, testing, and assessments designed to identify risks from cybersecurity threats. Management across various functional teams administer the enterprise risk management program, which is designed to identify, assess, and manage top enterprise risks, including risks arising from cybersecurity threats. Valvoline continually evaluates and makes updates to the Company's cybersecurity programs to align with regulatory requirements and industry best practices in order to keep company-wide training initiatives related to cybersecurity risks robust and up to date.


text: The IRP was designed to comprehensively leverage capabilities throughout the Company and to provide a standardized framework for responding to cybersecurity incidents by coordinating an approach to investigate, contain, mitigate, fix vulnerabilities, determine legally required responses or notifications, and document cybersecurity incidents including reporting and escalating findings as appropriate. The CSIRT, being responsible for incident response, assembles the IRT and assigns responsibilities based on the circumstances of the information security incident.


text: Valvoline employs a risk-based approach to secure access to networks, systems, and applications for business partners and vendors receiving access to the environments and data. Business partners and vendors with whom information is shared to conduct business are required to safeguard it by appropriate means, including elevated contractual commitments when appropriate. The Company provides cybersecurity training to team members during onboarding and regularly thereafter and deploy technologies to automate and enhance operational security capabilities. In addition, Valvoline also uses third-party managed security services to augment the cybersecurity team's capabilities.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term.


text: However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.


text: Cybersecurity governance Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Board of Directors reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Board of Directors receives reports and presentations from the Senior Vice President and Chief Technology and Cybersecurity Officer ("CTO") Vice President of IT Operations & Platforms, and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 30 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.


text: Risk management and strategy Valvoline has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. This program, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity and Privacy Frameworks, is an integrated part of the company's overall enterprise risk management process. The program applies, where appropriate, to Valvoline's internal and external information systems, applications, networks, and operations. It includes ongoing activities such as scanning, testing, and assessments intended to identify and manage risks arising from cybersecurity threats.


text: Management, including various functional teams, is responsible for assessing, identifying, and managing material risks from cybersecurity threats. Valvoline continually evaluates and updates its cybersecurity programs to align with regulatory requirements and industry best practices. This includes keeping company-wide training initiatives related to cybersecurity risks robust and up-to-date.


text: Valvoline's Executive Information Security and Privacy Committee provides crucial oversight for cybersecurity risk management. On a monthly basis, the committee reviews key metrics, evaluates risk tolerance, and approves strategic direction to ensure the program aligns with the company's business objectives.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.


text: Information security, which includes cybersecurity, is a significant operational risk facing our business. Cybersecurity risks include intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Information Security Officer is responsible for information security and cybersecurity risk management. He has over 40+ years of financial services related experience, including 10+ years of experience in cybersecurity program strategy, security architecture and security team leadership. Our Chief Technology Officer, who has over 25+ years of experience in financial services, including 15+ years in information technology, among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the Information Security Officer.


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively. On an annual basis, the Board of Directors reviews and approves our information security program and information security policy.


text: We use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks within our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing. Findings are tracked and reported to the Bank's Technology Committee, and the Audit Committee of the Board of Directors.


text: We have contracted with various service providers (vendors) who provide a broad range of services, including core banking, communications, collaboration and infrastructure services. We have established a vendor management policy to establish the principles, framework, and guidance for the effective review, engagement, monitoring, and oversight of vendors to ensure that we adequately manage operational, strategic, reputational, and other related risks inherent in outsourcing of services or operations. We manage the cybersecurity risks posed by our use of third-party service providers by conducting periodic risk assessments.


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes two cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive semi-annual training covering social engineering, phishing and current scam events, followed by periodic testing.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology Officer and members include two members from our Board of Directors, one independent Director and the President, the Information Security Officer, Chief Financial Officer, Chief Banking Officer, and officers of key business systems. The Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology & Information Security Officer is responsible for information security and cybersecurity risk management. He has over 25+ years of experience in financial services, including 15+ years in information technology, and among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring, and enforcement.


text: We currently use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool ("FFIEC CAT") to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks within our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing. Findings are tracked and reported to the Bank's Technology Committee, and the Audit Committee of the Board of Directors. The FFIEC CAT will sunset in Fall 2025. We are currently evaluating other assessment tools which will be implemented in 2026.


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive three training sessions annually covering social engineering, phishing and current scam events, followed by periodic testing.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology & Information Security Officer and members include two members from our Board of Directors, one independent Director and the President, Chief Financial Officer, Chief Banking Officer, IT Infrastructure & Security Manager, and officers of key business systems. The Chief Technology & Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Chief Technology & Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. We have an enterprise-wide cybersecurity program designed to protect against, detect, respond to and remediate cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that are designed to prevent, identify, escalate, investigate and remediate identified cybersecurity threats and incidents, including threats and incidents associated with third-party service providers, in a timely manner. These tools include, among others, internal detection tools to support the identification, monitoring and reporting of threats, vulnerabilities and incidents, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our platform and products before they are exploited by malicious threat actors. We maintain a variety of incident response plans that are utilized when cybersecurity incidents are detected. We require employees with access to information systems, including specified corporate and engineering employees, to undertake data protection and cybersecurity training. Further, we use various processes to identify, monitor, assess and manage material risks from cybersecurity threats associated with the use of third-party service providers, including engaging in security reviews of third-party service providers who may have access to, or integrate with, our information systems; however, we rely on these third parties to implement cybersecurity programs commensurate with their risk profile and our expectations, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Braze, Inc.

ticker: BRZE


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition to our bug bounty program, we also engage third parties to provide independent penetration testing, to support internal security audits and to provide external security audits. We also regularly report on the results of our assessments and security testing to our audit committee.


text: Our management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis by establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including through the audit committee of our board directors.


text: Our chief technology officer is responsible for our information security team which oversees and implements our cybersecurity program. Our chief technology officer has over a decade of industry experience, and is supported by a team of information security professionals who have relevant educational and industry experience, including holding similar positions at large technology companies. Our chief technology officer and information security team provide regular reports to senior management, other relevant teams and the audit committee of our board of directors on our cybersecurity program, material cybersecurity risks and mitigation strategies, and other cybersecurity developments. In addition to such regular reports, and as part of our incident response processes, our chief technology officer will provide updates on material cybersecurity threats and incidents to our audit committee and, as necessary, to the full board of directors, based on management's assessment of risk.


text: Our board of directors has ultimate oversight responsibility for our strategic and business risk management and delegates cybersecurity risk management oversight to its audit committee. Our audit committee receives reports on, generally, a quarterly basis from our chief technology officer on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our audit committee is responsible for overseeing the adequacy and effectiveness of our privacy and information security policies and practices and the internal controls regarding privacy and information security. Our audit committee or chief technology officer, as appropriate, also reports material cybersecurity risks to our full board of directors.


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers or vendors experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."


text: As a leader in business process solutions, we leverage cloud computing, artificial intelligence, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.

companyName: CONDUENT Inc

ticker: CNDT


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases and system software solutions. We also receive, process, transmit and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process and implement financial transactions and disburse funds on behalf of both commercial and government customers.


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. This program is integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring and management of risks.


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with Center for Internet Security Critical Security Controls ("CIS CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology's publication (NIST 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO") and, the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems and respond to cybersecurity incidents.


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we implement in the event of a cybersecurity incident.


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, assist with our PCI-DSS compliance assessments, assess our systems' alignment with the NIST Cybersecurity Framework, ensuring adherence to ISO audits.


text: CNDT 2023 Annual Report We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, maintain continuous monitoring during the engagement of the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.


text: Our Board of Directors (the "Board") maintains oversight responsibility for our ERM program. This oversight is facilitated primarily through the Risk Oversight Committee of the Board (the "Risk Committee"), which reviews the ERM program, related assessments and remediation activities for subsequent review by the Board. As part of its ERM oversight responsibilities, the Risk Committee is responsible for oversight of the Company's cybersecurity risk management, including the Company's material programs, policies and safeguards for information security, cybersecurity and data security. At least quarterly (and more frequently as required), the Risk Committee and Audit Committee meet with management, including the Chief Information Security Officer (the "CISO"), to discuss, assess and determine the allocation of resources to risk matters, including cybersecurity risks, which enables effective integration of risk practices into strategic planning and enterprise decision-making.


text: The Risk Committee works with the CISO and the Company's senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company's cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company's defenses and a cyber trend report, as well as management's progress in implementing the Company's cybersecurity strategic roadmap and compliance initiatives.


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership.


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of its business. We do not believe that any incidents that have occurred prior to the date of this report have had or will have a material adverse effect on our business strategy, results of operations, reputation or financial position. Future cybersecurity incidents could, however, materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.


text: As a leader in business process solutions, we leverage cloud computing, AI, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases, and system software solutions. We also receive, process, transmit, and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process, and implement financial transactions and disburse funds on behalf of both commercial and government customers.


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. These processes are integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring, and management of risks.


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with the Center for Internet Security ("CIS") Critical Security Controls ("CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), and the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems, and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends, and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, and which we implement in the event of a cybersecurity incident.


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, third parties who assist with our PCI-DSS compliance assessments, and auditors who audit our systems to ensure adherence to the relevant standard under evaluation.


text: We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing, and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership. In addition, the Company has implemented an Incident Response Materiality Assessment Committee ("IRMAC"), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team ("CSIRT"). Procedures exist to ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company. New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition. In addition, future cybersecurity incidents could materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.


text: Cybersecurity Risk Management and Strategy We depend on digital technologies to perform many of our services and process and record financial and operating data. At the same time, cyber incidents, including deliberate attacks or unintentional events, have increased. To assess and manage cybersecurity risks impacting our industry and our business, we have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate vulnerabilities in our systems and related infrastructure on a regular basis and monitor and mitigate the risk of data loss and other cybersecurity threats. As part of our cybersecurity risk management program, we have a designated in-house team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents or intrusions. We have also engaged third-party consultants to conduct penetration testing and risk assessments.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks.


text: Our cybersecurity governance program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration. In addition, our cybersecurity risk management program includes processes to assess cybersecurity risks related to third-party vendors and suppliers.


text: Cybersecurity Governance Our cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. Our in-house professionals and external threat analysts possess various cybersecurity certifications, including Security +, Network +, A + and Server + certifications.


text: Our internal cybersecurity governance program is led by Mammoth's Director of Information Technology, with support from the internal information technology department, who reports to our Chief Financial Officer. Our Director of Information Technology has over six years of technological leadership experience along with an extensive background in computer support and application support. The Director of Information Technology and her team are responsible for leading cybersecurity strategy, policy, standards, architecture, and processes within our organization. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents. This team continuously identifies potential cyber vulnerabilities and opportunities for improvement, including yearly security training for all employees. This team also continuously evaluates and implements technological enhancements as part of our cybersecurity systems. Progress and developments in our cybersecurity governance program are regularly communicated to our executive team. Our board of directors, as part of its oversight process, receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that have occurred.


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1.A, Risk Factors—"We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: In addition, our internal audit function, in conjunction with third-party experts, plays a key role in reviewing and assessing our cybersecurity technologies, controls and procedures. Our security programs and measures may not prevent all incidents or intrusions and our systems and insurance coverage for protecting against cyber security risks may not be sufficient. As cybersecurity risks continue to evolve, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents or intrusions. Laws and regulations governing cybersecurity, data privacy, and the unauthorized disclosure of confidential or protected information pose increasingly complex compliance challenges, and failure to comply with these laws could result in penalties and legal liability. Our insurance coverage for cyberattacks may not be sufficient to cover all the losses we may experience as a result of such cyberattacks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks. MAMMOTH ENERGY SERVICES, INC.


text: Our internal cybersecurity governance program is led by Mammoth's Director of Information Technology, with support from the internal information technology department, who reports to our Chief Financial Officer. Our Director of Information Technology has over seven years of technological leadership experience along with an extensive background in computer support and application support. The Director of Information Technology and her team are responsible for leading cybersecurity strategy, policy, standards, architecture, and processes within our organization. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents. This team continuously identifies potential cyber vulnerabilities and opportunities for improvement, including yearly security training for all employees. This team also continuously evaluates and implements technological enhancements as part of our cybersecurity systems. Progress and developments in our cybersecurity governance program are regularly communicated to our executive team. Our board of directors, as part of its oversight process, receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that have occurred.


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. "Risk Factors--We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Risk Management and Strategy We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct tabletop exercises to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight and identification of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, recently, we have been including provisions in our supplier contracts that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. We have added these requirements in new or amended contracts going forward. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.


text: While we have experienced threats to our data and systems, to date, we are not aware that we have experienced a cybersecurity incident that had, or is reasonably likely to have, a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.


text: Our cybersecurity program is managed by our Chief Information Security Officer ("CISO"), who reports to our Chief Information and Digital Officer ("CIDO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since June 2022 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles in all areas of information technology. Our CIDO joined the Company in July 2023 with over 25 years of experience leading digital and information technology teams, including leading all aspects of her prior company's global enterprise digital roadmap, including finance, supply chain, and commercial solutions as well as data and analytics, including automation and artificial intelligence.


text: Our CISO and CIDO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIDO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.


text: Risk Management and Strategy We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct exercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.


text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight, identification, and remediation or mitigation of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify potential risk to Company systems or data. If risks are identified, we implement measures to mitigate or remediate the risk and, in cases where we cannot do so effectively, we will not grant access to our data or systems to the supplier. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.


text: While we have experienced threats to our data and systems, to date, we are not aware of a cybersecurity incident being experienced by the Company that had, or is reasonably likely to have, a material impact on our business or operations; however, because of frequently changing attack techniques and the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which we manage as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.


text: Our cybersecurity program is managed by our interim Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since March 2025 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, governance, risk, and compliance roles, secure application development and implementation roles, cyber and threat experience, and various leadership roles in several areas of information technology. Our CIO joined the Company in May 2025 with 35 years of experience in information technology roles, including implementing new information security teams on a global scale and overseeing information technology teams in multiple industries, including wholesale distribution, retail, manufacturing, finance, and information technology services, leading new global software development, and establishing global information security standards for his previous company.


text: Our CISO and CIO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.


text: As an asset manager, our business is highly dependent on information technology networks and systems. In addition, we believe that our position as an investment manager in the digital infrastructure space makes the security of these systems even more important to our Company and various stakeholders. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have not experienced any material cybersecurity incidents to date.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Cybersecurity Risk Management and Strategy DigitalBridge's risk management program is headed by its Chief Information Officer, the Vice President of Cybersecurity and the Company's Cybersecurity Architect. They possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and they leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with the senior members of DigitalBridge Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's information technology environment, provide recommendations to strengthen the program, and update us on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related to DigitalBridge portfolio companies.


text: DigitalBridge assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risk and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based on this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and are approved by the Company's Data Protection Team ("DPT"), which consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.


text: Among the risks we assess is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the DigitalBridge cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our information technology networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to ask if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design, effectiveness and tests cyber controls, and annually as part of its SOX testing, performs a review of cybersecurity audit reports for the in-scope application vendors.


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including as to cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board ("Audit Committee") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management and independent and internal auditors.


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. Any incident that the IRT determines may be material to the Company is then escalated to the DPT, which is responsible for overseeing the investigation of and response to such incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that any notification and regulatory filings are made in a timely manner.


text: As an investment manager, our business is highly dependent on information technology networks and systems. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024, we have not experienced any material incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.


text: Cybersecurity Risk Management and Strategy The Company's risk management program is headed by its Chief Information Officer, Vice President of Cybersecurity and its Cybersecurity Architect. Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with senior members of the Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's IT environment, provide recommendations to strengthen the program, and provide updates on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related the portfolio companies of our funds.


text: The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based upon this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and approved by the Company's Data Protection Team ("DPT"). The DPT consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.


text: Among the risks assessed is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our IT networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to determine if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (" Audit Committee ") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management, internal auditors and independent auditors.


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. When the IRT determines a cybersecurity is significant, it is escalated to the DPT, who is responsible for overseeing the investigation of and response to such cybersecurity incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that notification and regulatory filings are made in a timely manner.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our board of directors, our audit and compliance committee ("Audit Committee"), and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: Coinbase Global, Inc.

ticker: COIN


text: Our cybersecurity risk management program includes: • physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance With oversight from our board of directors, the Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: The Audit Committee has established the Enterprise Risk Management Working Group ("ERMWG"), comprising members of our senior management team and other senior leaders, to provide executive oversight of our enterprise risk management program. Our Chief Security Officer ("CSO") is a member of the ERMWG, and together with our Chief Information Security Officer ("CISO") leads an ERMWG sub-working group related to cybersecurity, which meets periodically to review and discuss emerging and key risks relating to cybersecurity at the company, and to provide regular updates to the ERMWG.


text: The Audit Committee receives updates from the ERMWG and from members of management, including our CSO and CISO, on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly basis or more frequently as needed. The board of directors also receives updates from our CSO and CISO on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our board of directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our CSO and CISO as part of the continuing education of our board of directors on topics that impact public companies. Finally, our board of directors annually reviews and is required to approve our Global Information Security Program Policy and any changes recommended by our CSO.