text: In the event of a cybersecurity incident, our incident response team refers to the Company's Security Incident Response Plan. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed.


text: All Kestra team members participate in quarterly security awareness training, such as phishing tests as well as mandatory annual Security Awareness and HIPAA Covered Entity training to keep pace with industry standards, evolving challenges, and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the Company. With respect to artificial intelligence, the Company has identified the potential exposure of trade secrets and protected health information to open large language models as a risk, accordingly an Artificial Intelligence Acceptable Use Policy has been implemented, and all Kestra team members have been trained on its requirements.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS

secItem: Item 1C


text: As of the date of this Annual Report, the Company has not experienced any material cybersecurity incidents. Cybersecurity risks that are not currently known to the Company, or that are currently deemed immaterial, could materially affect the Company's business, operations, or financial condition in the future.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, unauthorized uses or disclosures, and other disruptions involving our systems, products or data could compromise sensitive information related to our business or patients, result in operational disruption, or prevent us from accessing critical information, exposing us to liability, and adversely affecting our business, financial condition, results of operation and prospects."


text: The Company's Chief Information Officer (CIO) has primary responsibility for the Company's cybersecurity program and manages the implementation of the cybersecurity risk management strategy, coordinating efforts across technical and operational functions. Our CIO has over 12 years of experience leading information security functions, including over seven years with the Company in roles of increasing seniority. Cybersecurity oversight is coordinated through the Security Council, which meets regularly and consists of cross-functional leaders. The Security Council is advised by the CIO and the Director of Information Security and Compliance on strategic cybersecurity initiatives, emerging threats, and risk posture. The Security Council formulates our cybersecurity policies and determines the priorities of our risk management plan. The information security team, led by the CIO, executes the plan, uses automated tools, follows procedures to monitor and respond to cyber threats, and subscribes to reports and services to stay current on the threat landscape. In addition to full time staff with cybersecurity responsibilities, we engage qualified third-party partners, including assessors, auditors, consultants and other entities to support our cybersecurity processes for security engineering, security monitoring, incident response, security assessments, and independent audits of cybersecurity controls. Third-party partners work under the direction of the CIO or their designee.


text: The Audit Committee of our Board of Directors is responsible for oversight of the Company's programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee receives regular briefings on cybersecurity matters from the CIO, including updates on material risks, cyber incidents, cyber program maturity, and ongoing improvements. The CIO prepares regular updates on Cybersecurity, which are integrated into the Board of Directors' broader oversight of enterprise risk management, and any material cyber risk is treated as part of overall business and risk management strategy.


text: Our cyber-security risk strategy includes policies and procedures for assessing, identifying and managing material cybersecurity threats. Our program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks. Our cybersecurity posture is risk based, focused on the areas of higher risk to the company and associates. Our cybersecurity policies, standards and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by the Board of Directors acting through the Audit Committee of the Board of Directors.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance coverage.


text: We conduct annual internal audits to test compliance with our technology policies, security procedures and controls. Our third-party information technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risks and mitigation measures, where applicable.


text: We continue to increase our cybersecurity investments and safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents continue to pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Cybersecurity threats, data privacy compliance, and use of artificial intelligence could have a negative impact on our business," in Item 1A of this Form 10-K.


text: While we have experienced cybersecurity incidents that have disrupted our operations in the past, to date, no cybersecurity incidents have had or are materially likely to have, a material impact on RPM.


text: Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field as well as over 15 years' experience in auditing information security, including previous roles in information security architecture, information technology and information security audit and governance. The Senior Director - Information Security has completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives reports on the status of our cybersecurity risks, incidents and mitigation efforts either from the Audit Committee or from the Senior Director – Information Security and other executives. We utilize a technology-based reporting system to identify and log data-related events.


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on the Company, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.


text: Risk Management and Strategy We utilize a combination of manual processes, specialized software and automated tools, and third-party assessments to assist with our cybersecurity efforts. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: HeartSciences Inc.

ticker: HSCS


text: Our third party service provider, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller reporting Company, we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: As of the date of this Annual Report on Form 10-K, we are no t aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our Company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. We engage third-party security experts for risk assessment and system enhancements. The Company delivers annual security awareness training to employees, augmented by periodic role-specific modules and recurring phishing simulation exercises to measure user susceptibility and inform further training.

companyName: Worthington Steel, Inc.

ticker: WS


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Management, including the CIO and our Director of Cybersecurity, regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk assessment program, vulnerability management, and on-going cybersecurity projects.


text: Our cybersecurity programs are under the direction of our Vice President and Chief Information Officer ("CIO") who receives regular reports from our Director of Cybersecurity. The Director of Cybersecurity, oversees our dedicated cybersecurity team comprised of 2 Senior Security Engineers and 2 Security Analysts and is augmented by a 24x7 managed security services who actively manage and execute our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. The Director of Cybersecurity has over 15 years of experience in cybersecurity, with demonstrated expertise in incident response, threat detection, vulnerability management, and third-party risk assessments. He holds advanced degrees in IT Project Management and Network Security and maintains industry certifications including CISSP (Certified Information Systems Security Professional) and GCIH (GIAC Certified Incident Handler). The two Senior Security Engineers have 16 and 10 years of experience, respectively. Their areas of specialization include network security architecture, endpoint protection technologies, and operational technology (OT) security integration. Both hold advanced certifications such as CISSP, GRID (GIAC Response and Industrial Defense), and GCIP (GIAC Critical Infrastructure Protection). The two Security Analysts bring 3 and 4 years of experience, respectively. Each holds a bachelor's degree in Computer Science and maintain industry certifications including CompTIA Security+ (SEC+). Their responsibilities include real-time security monitoring, phishing simulation campaigns, and user awareness support. Collectively, the cybersecurity team brings 48 years of combined experience and is actively engaged in ongoing professional development to remain current with emerging cyber threats, technologies, and regulatory requirements.


text: In fiscal 2025, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, see "Risk Factors – Risks Related to our Business" in Item 1A. of this Form 10-K.


text: We rely on several information systems throughout our company, as well as those of our third-party business partners, to provide access to our web-based products and services, keep financial records, analyze results of operations, process customer orders, manage inventory, process shipments to customers, store confidential or proprietary information, and operate other critical functions. Our information systems and our business partners' and suppliers' information systems may be vulnerable to attacks by hackers and other security breaches, including computer viruses and malware, through the internet, email attachments, and persons with access to these information systems, such as our employees or third parties with whom we do business. These risks have increased as information systems and the use of software and related applications become more cloud-based. We have implemented various programs, processes, and systems designed to mitigate these risks.

companyName: NEOGEN CORP

ticker: NEOG


text: Risk Management and Strategy We have a comprehensive cybersecurity risk assessment program designed to assess, identify, and manage material risks associated with cybersecurity threats and vulnerabilities and to mitigate the potential impact of any cybersecurity incidents on our operations and financial condition. We routinely review, modify, and update this program as necessary to address emerging risks. Our process for addressing risk is based on industry best practices outlined in CIS Critical Security Controls. Although this program is integrated within the Company's overall risk management system, the implementation of this program requires a unique and specialized level of expertise and experience, which has led us to create a cybersecurity team and various processes designed to address these specific risks, as discussed more below.


text: We regularly engage consultants and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.


text: Board of Directors Oversight The Governance and Sustainability Committee of our Board of Directors (the "Governance Committee") is responsible for providing oversight and policy direction on our risk management policies and programs, including those relating to cybersecurity. The Charter of the Governance Committee specifically requires the committee to periodically review the Company's enterprise cybersecurity strategy and framework, including the Company's assessment and management of cybersecurity threats and risks, data security programs, applicable laws and regulations, and the Company's management and mitigation of cybersecurity and information technology risks and potential breach incidents, including our incident response plan. The Governance Committee is also tasked with reviewing any significant cybersecurity incident that occurs.


text: The Governance Committee is required by its Charter to consist of not fewer than three independent directors, and the committee currently consists of five independent directors. The Governance Committee typically meets on a quarterly basis. At each meeting, a written cybersecurity brief from IT leadership is provided. These reports include a review of emerging cybersecurity risks and developments and updates to our cybersecurity risk assessment program. The Governance Committee provides regular reports to the full Board of Directors on its oversight of the Company's cybersecurity risks and risk management system.


text: Management's Role Our management team is primarily responsible for assessing and managing material risks to the Company from cybersecurity threats. We have a cross-functional cybersecurity team led by our cybersecurity manager and comprised of personnel from our information technology group, including the head of IT, and senior leadership. We have established a robust framework for preventing, identifying, evaluating, and mitigating cybersecurity risks.


text: Our cybersecurity manager is designated as the senior executive responsible for cybersecurity and reports directly to the head of IT. Our cybersecurity manager has a comprehensive information technology background and over ten years of service in managing or assisting in managing cybersecurity risks.


text: To support the head of IT and cybersecurity manager in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 30 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: We employ a comprehensive set of processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include: • Continuous monitoring of network traffic and information technology systems for signs of potential threats; • Regular vulnerability assessments and penetration testing to identify and address weaknesses; • Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption; • Employee training and awareness programs to educate all staff about cybersecurity risks and prevention measures; and • Incident response plans to ensure swift, effective, and adequate disclosure of cybersecurity incidents to the appropriate individuals within the Company.


text: These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats and any changes in our systems or business operations.


text: Our head of IT, cybersecurity manager, and other members of our cybersecurity team provide quarterly updates and reports to the Governance Committee of our Board of Directors on cybersecurity risks and our risk management systems. Our cybersecurity team is also required to provide senior management and the Governance Committee with more frequent updates on major developments regarding cybersecurity matters or as otherwise appropriate. As noted above, the Governance Committee provides regular updates to the Board on these matters so that the Board remains adequately informed about this important aspect of the Company's overall risk management.


text: We actively maintain an enterprise risk management program that includes information technology and cybersecurity risk management. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to address potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: We have developed a program for assessing, identifying and managing material risks from cybersecurity threats to our information and information systems. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations. We have a comprehensive cybersecurity program which includes risk management designed to protect the confidentiality, integrity and availability of our information systems and maintain compliance.


text: The Audit Committee has primary responsibility for oversight of cybersecurity matters. The Audit Committee receives quarterly updates on compliance and cybersecurity from the CIO and CISO. These updates, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and enhancements to our cybersecurity program.


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the CEO. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full-time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls reports. We have an AI governance council and approval process who key activity is to review, evaluate risk of AI technology.


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security, the National Institute of Standards and Technology and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.


text: During fiscal 2025, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.


text: RISK MANAGEMENT AND STRATEGY Microsoft plays a central role in the world's digital ecosystem. We have made it the top corporate priority to protect the computing environment used by our customers and employees and to support the resiliency of our cloud infrastructure and services, products, devices, and our internal corporate resources from determined adversaries. In response to the evolving cybersecurity threat landscape, we launched the Secure Future Initiative ("SFI") in November 2023 and expanded the scope of SFI in May 2024. The SFI focuses our business strategy and efforts on continual improvement in cybersecurity protection, and is aligned around three security principles: • Secure by Design: Security comes first when designing any product or service. • Secure by Default: Security protections are enabled and enforced by default, require no extra effort, and are not optional. • Secure Operations: Security controls and monitoring will continuously be improved to meet current and future threats.

companyName: MICROSOFT CORP

ticker: MSFT


text: We operate a cybersecurity program and governance framework designed to protect our computing environments against cybersecurity threats, and we have controls, policies, and procedures to identify, manage, and mitigate cybersecurity threats. Annually, we assess our cybersecurity program's alignment with the National Institute of Standards & Technology's Cyber Security Framework ("NIST") and other applicable industry standards. We also undertake integrated planning and preparedness activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including tabletop simulations and production environment tests, penetration and vulnerability tests, red team exercises, and other related activities. We conduct mandatory cybersecurity training, provide employees with tools to report suspected incidents and assess their own security posture, and conduct real-time simulated employee education exercises, such as phishing email campaigns designed to emulate real-world attacks. We also engage in robust cybersecurity assessments and remediation efforts for acquired companies.


text: Our computing environments, products, and services are reviewed by our internal audit teams as well as independent third-party assessors. We are committed to managing the most significant risks to our strategies and ambitions, including cybersecurity risks. The Enterprise Risk Management ("ERM") organization supports management in this commitment by facilitating the semiannual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on the Committee of Sponsoring Organization ("COSO") guidance on Enterprise Risk Management Integrating Strategy with Performance and it also aligns with the International Organization for Standardization 31000:2018 Risk Management Standard.


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from 84 trillion signals per day. We track over 1,500 unique threat actors, including more than 600 nation-state actors, 300 cybercriminal groups, 200 influence operation groups, and hundreds of others. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.


text: When appropriate, we utilize external service providers to assess, test, or otherwise assist our program. We also leverage third parties by working with external researchers, operating bug bounty programs, and managing coordinated vulnerability disclosure programs with security organizations. We maintain a systematic approach to assessing and controlling the cybersecurity risks presented by third-party service providers. We require third-party service providers to manage their cybersecurity risks in defined ways, undergo cybersecurity reviews, notify us of cyber events, and satisfy additional contractual requirements.


text: We seek to improve the entire cybersecurity ecosystem through multistakeholder diplomacy to set and uphold expectations for state behavior, advancement of government policy that strengthens cybersecurity and resiliency, disruption and deterrence of cybercrime, protection of national security interests, and disruption of digital threats to democracies. We also establish processes and innovate solutions for us and our customers to address the growing number and complexity of cybersecurity regulations.


text: When we experience a cybersecurity incident, we utilize our well-established incident response plans that operate both across the company and at the product and services level. Incidents are first triaged for severity, and then more deeply assessed to establish a plan of record and activate internal and external notification, disclosure, and communication plans, as applicable. Engineering and development resources are mobilized to resolve or remediate the incident. After the incident is resolved, a comprehensive post-incident review process is conducted.


text: We describe the risks from cybersecurity threats, including previous cybersecurity incidents, in section "Risk Factors" (Part I, Item 1A of this Form 10-K). As of the date of this Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, are under constant and increasing threat. As discussed above, our business strategy is tied to the SFI and we are committed to continuously monitoring cybersecurity threats, enhancing the security of our products, investing in our cybersecurity infrastructure, and collaborating with peers, customers, service providers, regulators, and governments to advance our and the entire digital ecosystem's cybersecurity defenses and resiliency.


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, our EVP of Cloud + AI, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Cloud + AI. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's computing environments, products, and services. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.


text: Risk Management and Strategy We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information. We have an established incident response plan ("IRP") to respond to cyber incidents.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: The Company follows the U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, we maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyber attacks.


text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by the IRP, which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.


text: The IRP is executed by an Incident Response Team ("IRT"), led by our Information Systems Director. The exact composition of the IRT varies depending on the severity and potential impact of an incident and will typically include internal IT professionals and stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, forensic accountants, and consultants who are on retainer contracts for expedited availability.


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective to date. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition in the past three fiscal years. Despite our cybersecurity policies and practices, we may not be successful in preventing or mitigating a cybersecurity incident resulting in a material adverse effect. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see the business and operational risk factor: We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incident and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. These updates include the following: • Recent cyber risks and cybersecurity developments • Cyber risk governance • Assessments by third-party experts • Key cyber risk metrics • Projects and initiatives The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program, include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – System security risks, data breaches, and cyberattacks could compromise our proprietary information, disrupt our internal operations, impact services to customers, and harm public perception of our products, which could materially adversely affect our business, financial condition, operating results, and future growth prospects".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from our Chief Information Security Officer ("CISO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Chief Information and Customer Officer ("CICO") and CISO periodically report to the full Board regarding cybersecurity risks and our cyber risk management program. Board members periodically receive presentations on cybersecurity topics from our CICO, our CISO, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CICO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CICO and CISO collectively have decades of IT and cybersecurity experience in technology companies, including significant experience in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications. Our CICO and CISO are assisted by a cross-functional Information Security Steering Committee.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Overview and Leadership The Company maintains a company-wide risk management system focused on detecting, identifying, defending against and mitigating the impact of cybersecurity risks in order to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors (the "Board") is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 39 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 26 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: The information security team undertakes or engages in the following practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats at each level of the organization; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for the testing of cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to the Company's systems and data; as well as the systems of third parties that could adversely impact our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multifactor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.


text: Use of Third Parties The Company has engaged, and intends to continue to engage, nationally recognized third parties to assist the Company in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: We have engaged in a tabletop exercise with a nationally recognized third party to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: Impact of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material impact on the Company's results of operations and financial condition. As described above under "Item 1A Risk Factors "Technology Disruptions, Failures or Breaches, Hacking Activity, Ransomware Attacks or Other Cybersecurity Events Could Materially and Adversely Affect Our Financial Condition and Results of Operations" a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial damage, in addition to litigation or remediation costs or penalties.


text: Governance Overview The Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from the information security team regarding the Company's cybersecurity environment, cybersecurity risks and threats, cybersecurity projects the Company has implemented and plans to implement and other cybersecurity developments, and such committee reports to the full Board after each meeting. In addition to these quarterly reports to the Audit Committee, the information security team provides a presentation to the Board at least annually regarding the same topics covered with the Audit Committee. In addition, members of the Company's internal audit team have certain responsibilities with respect to projects designed to test the Company's cybersecurity controls and improve the overall cybersecurity environment.


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and senior management discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.


text: Risk Management and Strategy The Company’s cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: 1. Cybersecurity Risk Management Program – The Company’s cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company’s cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).


text: The Company’s Information Security team is responsible for the Company’s cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.


text: 2. Third Party Support – In addition to the internal tests and recurring audits our Information Security team performs on our systems, the Company also engages external consultants and auditors. For example, the Company engages third party auditors to obtain SOC 2 Type II Certification. Furthermore, the Company regularly works with third party consultants to perform penetration tests. These third-party engagements supplement internal tests and audits as detailed in our Information Security policies.


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee’s or contractor’s level of data and system access.


text: 4. Third Party and Vendor Management – The Company’s Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user’s access of Company’s resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company’s Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company’s employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company’s cybersecurity environment.


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company’s business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company’s approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company’s overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see “Risks Related to our Business and Industry,” in Item 1A, “Risk Factors” in this Annual Report.


text: Cybersecurity Governance Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company’s cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.


text: The Company’s Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all areas of the business. The cybersecurity risk management program is designed to align with industry best practices and has adopted the framework and measurement practices developed by the National Institute of Standards and Technology (NIST). In addition, the Company has implemented a cross-functional cybersecurity steering team to facilitate coordination across key departments and assists in defining policies, procedures, and mitigation strategies, and will be called on to assist in risk assessment of any threat or incident.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: The Company has a written Emergency Action Plan that includes the handling of material cybersecurity incidents and business continuity if there is a disruption in operations. The Company utilizes a third-party cybersecurity partner to assist in monitoring our systems 24 hours a day, and to structure the technical handling of cybersecurity threats and incidents. In addition, the partner is utilized to regularly conduct formal penetration testing and tabletop exercises used to further prepare the organization. This partner also provides ongoing insights and advisory services in order to better align our program with current best practices. The Company uses a variety of processes to address risk associated with the use of third-party service providers. All employees, including anyone with access to Company-provided email accounts, must engage in quarterly cybersecurity awareness training and are tested internally on a regular basis. Additionally, we maintain cyber insurance coverage, including protection to further mitigate potential financial losses from cybersecurity incidents.


text: As of the date of this Annual Report on Form 10-K we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our best efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion.


text: The Board of Directors is responsible for the oversight of our cybersecurity risk management program. On a quarterly basis, our C hief Information Officer (CIO) provides a cybersecurity status report and update to the Board of Directors, which includes a scorecard of cybersecurity threats, updates on key initiatives, and any changes in trends that may impact the Company. The CIO reports directly to the President and Chief Executive Officer (CEO) and meets regularly with him, the Chief Financial Officer, and other members of the Executive Leadership Team. The CIO has over 25 years of experience in IT Operations and is supported by an internal Director of IT Security and a virtual Chief Information Security Officer (vCISO) service to ensure comprehensive focus on the program.


text: The Emergency Action Plan defines the handling of cyber related incidents with support of the cross-functional steering team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, and containment from such events. As the severity of events meet certain levels as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to the Board of Directors. Our Board of Directors is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.


text: The Company conducts regular assessments of cybersecurity risks both internally and with third party assistance Information Technology Director reports on the results of these assessments and corresponding recommendations to the full Board of Directors at least annually. We use the National Institute of Standards and Technology ("NIST") framework to regularly assess the threat landscape and support a cybersecurity strategy based on prevention, detection and mitigation. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving confidentiality, managing data security and availability and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company through investments in tools and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: The Company's Information Technology Director and Chief Financial Officer, along with cybersecurity personnel on their respective teams, are responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience.


text: Risk Management and Strategy Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform annual cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans. We employ a combination of methods to monitor for new or developing cybersecurity risks. Incidents, if any, are escalated to management and the Board according to our incident response policy. Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Risk Management and Strategy As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify, and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data security threats within our environment. In the event we identify a potential cybersecurity or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Board, other stakeholders and law enforcement when responding to such issues.

companyName: UNIFI INC

ticker: UFI


text: The Company's enterprise cybersecurity program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates and proactively scans for vulnerabilities. We regularly engage qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. The Company utilizes industry-standard technologies, processes, and capabilities designed to protect our systems and data and to detect potential suspicious activity. We provide cybersecurity training and user education on a regular basis for users with access to the Company's information technology systems. We conduct monthly social engineering tests to promote phishing awareness and security awareness. The Company monitors servers and endpoint devices across the organization to detect signs of a cyberattack. We maintain and practice a response and recovery plan to restore systems and data. We also maintain cyber liability insurance against cyber-attacks as part of our comprehensive insurance portfolio. Because we are aware of the risks related to third-party service providers, we have implemented processes to oversee, identify, and manage risks from cybersecurity threats associated with our most significant third-party service providers.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.


text: Day-to-day management of cybersecurity risk is performed by the Company's Information Technology Security Team with direct oversight from the Chief Information Officer (the "CIO"). The Company's incident response plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CIO, who further escalates critical or high severity events to the Company's Cyber Incident Steering Committee (the "CISC"), which consists of the CIO, the Chief Financial Officer, the General Counsel, and the Internal Audit Manager. Additional senior management from relevant business units are included as needed based on the nature of identified cybersecurity incidents. The CISC is responsible for providing support, guidance, and oversight of UNIFI's incident response, including making a determination of materiality to evaluate the need for escalation and disclosure. The materiality evaluation is made using the framework established in the federal securities laws, with a focus on the importance of the information to a reasonable investor.


text: The Board recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee, and vendor information, as well as non-public information about UNIFI. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of the Board has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 30 years.


text: Furthermore, UNIFI management prepares, and the Audit Committee reviews and discusses, a quarterly assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated quarterly and is designed to bring to the Audit Committee's attention our most critical risks for evaluation, including cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications or requirements, only that our information security team uses the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management, regarding phishing, malware and other cyber risks; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A. "Risk Factors - Risks Related to Our Business – Our business operations could be negatively impacted by an outage or breach of our information technology systems, network disruptions, or a cybersecurity event."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser potential impact. The Committee members also receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), who also serves as our Chief Information Technology Architect & Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our cybersecurity management team, lead by our CIO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and reports produced by security tools deployed in the IT environment. Our CIO reports to the Company's Chief Executive Officer, as well as to the Board and Audit Committee. The CIO has served as our CISO for four years and has more than 20 years of experience in various roles involving managing cybersecurity functions, developing strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CIO holds a bachelor's degree in computer science and various certifications which include Certified Ethical Hacker and Certified Chief Information Security Officer, and has 25-plus years of previous software and hardware systems engineering experience.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by and incorporates elements of recognized industry standards. Our cybersecurity risk management strategy is guided by both internal cybersecurity risk assessments and third-party information security audits.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We leverage the support of third-party information technology and security providers as part of our cybersecurity risk management program, including for penetration testing. Further, we have adopted written information security policies and procedures, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. Additionally, the Company's employees go through cybersecurity awareness training covering topics such as general cybersecurity best practices, phishing, data protection, password protection, and network security.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Financial Officer, Chief Legal Officer, VP of People, IT director, VP of Software Engineering, Senior Director of R&D, and VP of Global Marketing. The InfoSec Committee meets on a regular basis to review and discuss the direction of the Company's cybersecurity program. Our acting CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.


text: The Board engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.


text: Risk management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the company. We employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time: • monitoring emerging data protection laws and implementing responsive changes to our processes; • undertaking periodic reviews of our policies with customers, partners, and suppliers and statements related to cybersecurity; • conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conducting phishing email simulations for employees and contractors with access to corporate email systems; • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and • educating our teams on incident response, conducting tabletop exercises and using the findings to improve our processes and technologies.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: We maintain a cybersecurity incident response plan designed to secure the enterprise, mitigate the impact of an incident, restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. As part of the above process, we periodically engage with consultants and other third-parties, including annually having a third-party perform penetration testing and review our cybersecurity program to help identify areas for improvement and/or compliance. The Company's cybersecurity procedures have been developed based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. We also engage with a third-party security operation center to assist in monitoring our cybersecurity risk environment. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, see "Part I, Item 1A. Risk Factors -- A failure of, or a security breach in a key information technology system or process or other unusual events could compromise our information and expose us to liability, which could adversely affect our business; IT project delays and overruns are possible" which is incorporated by reference into this Item 1C.


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which are expected to be mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company believes it has contained the incident, which only affected certain systems, and it has restored operations and notified affected individuals. The Company has put in place remediation measures designed to help prevent future similar attacks and has proactively undertaken to implement certain other enhancements to its security system.


text: Oversight of cybersecurity risk is a joint responsibility of the Board of Directors and the Audit Committee. The Company's Chief Information Officer (the "CIO") provides quarterly updates to the Audit Committee and the chair of the Audit Committee regularly updates the Board of Directors on cybersecurity matters potentially impacting the Company. Additionally, the CIO briefs the Board of Directors on information security matters at least annually. In addition to oversight by the Audit Committee and the Board of Directors, our CIO chairs a Working Council that includes our Chief Financial Officer, Chief Human Resources and Communications Officer and our Chief Legal and Administrative Officer. Our IT organization also includes a Chief Information Security Officer who is responsible for establishing processes as well as management of all cyber security risks and programs to mature our NIST posture. Our CIO has served in this role since 2023 and has more than 30 years of experience in the aggregate in various IT leadership roles. His educational background includes a master's in business administration in Information Systems from The State University of New York at Albany, and a bachelor's degree in electrical engineering from Harcourt Butler Technological Institute, Kanpur, India.


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which was mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company contained the incident, notified affected individuals, and restored operations. The Company put in place remediation measures designed to help prevent future similar attacks and implemented certain other enhancements to its security system.


text: Risk Management and Strategy The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company uses NIST cybersecurity and risk management frameworks to assess its cybersecurity controls, risks, and overall program effectiveness. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.

companyName: NOVAVAX INC

ticker: NVAX


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For example, in 2020, several domestic and foreign security agencies announced that government actors or government-affiliated actors were specifically targeting organizations, like us, engaging in COVID-19 vaccine development and research. For more information, see Item 1A Risk Factors, "Security breaches and other disruptions to our information technology systems or those of the vendors on whom we rely could compromise our information and expose us to liability, reputational damage, or other costs."


text: The cybersecurity risk management program is led by the Company's Chief Information Officer ("CIO") who has over 20 years of experience in information systems, cybersecurity, and data protection. The CIO reports to the Company's Audit Committee at least annually, as well as to the Board of Directors, the Company's Chief Executive Officer, and other members of our senior management as appropriate. These reports may feature an overall assessment of the Company's compliance with the Company's cybersecurity policies and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board.


text: Risk Management and Strategy The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company's information security program is developed using industry standards as a guide, including the National Institute of Standards and Technology Cybersecurity Framework. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.


text: We recognize the critical importance of developing, implementing, and maintaining a robust cybersecurity risk management, strategy, and governance program in order to safeguard the confidentiality, integrity, and availability of our systems and information.

companyName: INSPERITY, INC.

ticker: NSP


text: Board Oversight of Cybersecurity Matters Our Board has established oversight mechanisms to help ensure effective governance in managing risks associated with cybersecurity threats. In addition to the updates that our Board receives on cybersecurity matters, the Board's Finance, Risk Management and Audit Committee (the "FRMA Committee") is tasked with overseeing enterprise risk management. The FRMA Committee reviews and discusses major risk exposures with management, including cybersecurity risks, and steps management has taken to monitor and control such exposures, including our guidelines and policies concerning risk assessment and management.


text: Management of and Reporting on Cybersecurity Matters Our management assumes responsibility for assessing, identifying, and managing cybersecurity risks, threats, and incidents.


text: In particular, our Senior Vice President of Innovative Technology Solutions ("SVP-ITS") is responsible for our overall technology strategy, including overseeing our information security function and plays a pivotal role in assessing and managing all cybersecurity risks, threats, and incidents. The SVP-ITS reports directly to our President and Chief Operating Officer ("President and COO") and maintains regular dialogue with our President and COO and other key members of our senior management to ensure these individuals are appropriately apprised of our latest cybersecurity posture and developments, such as new threats, incidents, risks, and risk management solutions. Our SVP-ITS prepares reports for each regular Board meeting regarding significant developments in these topics to support the Board in its efforts to have appropriate information to exercise oversight on critical cybersecurity issues. Our current SVP-ITS has decades of experience overseeing leading systems and software development efforts with critical cybersecurity components.


text: The SVP-ITS is supported by dedicated information technology and security personnel and resources, including team members that have numerous cybersecurity certifications. Collectively, these personnel and resources allow us to strategically integrate cybersecurity into our broader risk management framework and decision-making process.


text: We also have an Enterprise Risk Management Steering Committee (the "ERM Steering Committee"), which is responsible for formally identifying and evaluating risks that may affect our ability to execute our corporate strategy and fulfill our business objectives, including cybersecurity risks. The ERM Steering Committee is chaired by the Company's chief financial officer and includes the Company's SVP-ITS, general counsel, internal audit director, and other members of management. The ERM Steering Committee conducts an annual comprehensive risk review of our overall risk profile and analyzes any significant identified risks, including consideration of risks relating to cybersecurity matters, which the ERM Steering Committee then presents and discusses with the FRMA Committee and the entire Board. In addition to the formal annual review, members of the ERM Steering Committee review and provide periodic updates as appropriate regarding our overall risk profile and any significant identified risks to both the FRMA Committee and the entire Board.


text: We have processes in place that we believe are designed to allow our information security team and management to be informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include establishing a formal incident response team, penetration testing, system vulnerability scanning, phishing simulations, tabletop exercises, employee security and compliance training, disaster recovery planning, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Engagement of Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants and systems auditors, in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, threat and vulnerability assessments, incident response plan design and testing, penetration testing, and consultation on improving our defense-in-depth security posture.


text: Overseeing Third-Party Risk We have processes in place designed to help us identify and oversee cybersecurity risks associated with our use of vendors, service providers, business partners, and other third parties that process our data on our behalf or have access to our systems. These processes include a vendor management policy designed to identify and consider potential risks from third parties as part of the vendor section process, which considers vendor cybersecurity standards and other factors based on the nature of the services that the vendor will provide.


text: Impact on the Company We have experienced, and may continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. For further discussion, see Item 1A. "Risk Factors – Disruptions of our information technology systems could damage our reputation and materially disrupt our business operations " and Item 1A. "Risk Factors - We could be subject to reduced revenues, increased costs, liability claims, or harm to our competitive position as a result of data theft, cyberattacks or other security vulnerabilities."