text: We strive to align with the National Institute of Standards and Technology (NIST) cybersecurity maturity framework and leverage a range of tools, including artificial intelligence, software programs, logs, and data analyses, to detect anomalous activity and identify risks across our systems. Threat simulations, such as penetration testing, are conducted periodically to assess vulnerabilities, analyze results, and implement remediations. Additionally, we employ third-party services for monitoring risks posed by cyber-attackers, employees, and third-party vendors accessing or contributing to our systems. Our oversight of such vendors includes requiring them to undergo cybersecurity analyses through risk assessments, scorecards, and audits.


text: Depending on the services performed, we require certain vendor agreements to contain security and privacy addenda and require vendors to report to us cybersecurity breaches on their systems and/or impacts to our data.

companyName: WERNER ENTERPRISES INC

ticker: WERN

secItem: Item 1C


text: We place high importance on conducting tabletop exercises to test and enhance our readiness for cybersecurity incidents. These exercises involve our Crisis Management Team, which includes representatives from executive management, legal, information technology, finance, operations, and marketing. The Crisis Management Team focuses on analyzing the scope, impact, and root cause of simulated incidents, while the marketing and legal departments, along with a team of executives, plan the messaging to customers, employees and other stakeholders deemed necessary or advisable in the circumstances. For compliance readiness, we monitor the legal and regulatory landscape associated with cybersecurity incidents. These exercises and activities provide valuable insights to improve transparency, messaging, response protocols, stakeholder confidence and organizational resilience in the event of a cyber crisis.


text: To manage material risks and enhance preparedness, we maintain a cyber insurance program integrated into our overall risk management framework. During insurance renewals, we collaborate with brokers and cyber experts to assess our program and align coverages with identified risks. In the event of a cybersecurity incident, our crisis management plan is triggered, mobilizing the Crisis Management Team to assess the situation and oversee critical decisions related to abatement, mitigation, and response. Responsive steps, each as deemed necessary or advisable and in addition to other elements of the plan, include engaging third-party forensic and other experts, coordinating communications with stakeholders, contacting law enforcement, and reporting incidents to the Board or Audit Committee. In a post-incident review, lessons learned are analyzed for incorporation into future protocols.


text: We foster a culture of cybersecurity awareness through regular phishing simulations, enterprise-wide security training, employee education on safe technology practices, and information security policies. We continue to evaluate cybersecurity risks and enhance our strategy to safeguard our operations and data as part of our commitment to operational resilience and innovation.


text: Risk Management and Strategy The Company has implemented policies and procedures that are intended to manage and reduce cybersecurity risks. Material risks from cybersecurity threats are managed across HDMC, HDFS, LiveWire and third-party suppliers and vendors. Cybersecurity risks and threats are monitored by the Company's Corporate Information Security Office and routinely discussed with senior management across the Company. Cybersecurity risks are identified and assessed through third-party assessments, IT security assessments, audits conducted by Internal Audit and risk and compliance reviews. Additionally, as part of the Company's cybersecurity risk management process, tabletop exercises are conducted at the technical and management levels. During these tabletop exercises, cybersecurity incidents are simulated, aimed at ensuring the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cybersecurity program.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The Company takes measures to regularly update and continuously improve its cybersecurity program, including conducting independent program assessments, performing penetration testing and scanning the Company's systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies and monitoring emerging laws and regulations related to information security. The Company also periodically engages third-party consultants to assist in assessing and enhancing its cybersecurity program. The Company has implemented risk-based controls to protect its information, customer information, third-party information, its information systems and its business operations. The Company follows the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has adopted security-control principles based on NIST, other industry-recognized standards and contractual requirements, as required.


text: With respect to third parties, the Company's cybersecurity program includes a cybersecurity supply chain risk management component aimed at identifying and mitigating risks from vendors, suppliers, and other third-parties. The supply chain risk management program is integrated into the Company's procurement workflow and includes conducting due diligence on select suppliers, vendors and other third parties. The cybersecurity risks of the vendor, supplier or other third party are evaluated by the Corporate Information Security Office when assessing the engagement and determining the appropriate oversight of the vendor, supplier or other third party. The Company also contractually requires suppliers, vendors and other third parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law. To oversee the risks associated with these service providers, the Company works with suppliers, vendors and other third parties to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of the Company's systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect the Company.


text: The Company's cybersecurity program also includes a cybersecurity training component. All employees are required to complete annual cybersecurity training focused on helping the workforce recognize cyber threats and scams, avoid falling victim to threats and scams, and report potential threats and scams. In addition, periodic cybersecurity awareness messages are posted on the Company portal.


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. For additional information, refer to "A significant cybersecurity incident or data privacy breach may adversely affect the Company's reputation, revenue and earnings," in Item 1A. Risk Factors.


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's information security and technology risks, including cybersecurity. On December 15, 2023, the CISO announced his retirement from the Company, and since that time, our Chief Digital and Operations Officer is serving as our acting CISO, executing all of the responsibilities of the CISO, while the Company conducts a search to fill the position. The Company's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: At the management level, the Company has established an incident review committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Vice President of Communications and Corporate Relations, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security and Privacy Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's data privacy function and information security and technology risks, including cybersecurity. The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over 10 of those years. The CISO reports to our Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: At the management level, the Company has established a Cyber Incident Review Committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Chief Communications Officer, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.


text: Risk management and strategy As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on our owned and leased networks to conduct our operations, (ii) our transmission of large amounts of data over our systems and (iii) our processing and storage of sensitive customer data. Cyber-attacks on our systems may stem from a variety of sources, including fraud, malice or sabotage on the part of foreign nations, third parties, vendors, or employees and attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.

companyName: Level 3 Parent, LLC


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.


text: Our privacy and cybersecurity policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our Information Technology, Privacy, Product, and Operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed privacy and cybersecurity laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also share and receive threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: As noted elsewhere in this annual report, we are materially reliant on a variety of third-party service providers to operate our business, which exposes us to the risk of cyber incidents impacting those providers' systems. We have a vendor risk management program that assesses, manages and oversees risks associated with third-party service providers who have access to our data and systems. We maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on our operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of the Board of Directors. These escalation provisions, together with Lumen's Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: The Cyber Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has worked in the public and private sectors in information security since 1997 and has been a chief security officer since 2017. His technical and process certifications include CISSP, ITIL Foundation, Six Sigma Certified, CISCO CCNP, and CCNA, and he oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen also has management level committees and response teams who support our processes to assess and manage cybersecurity risk as follows: • The Risk Oversight Committee ("ROC"), whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and General Counsel, is responsible for making risk management decisions to ensure consideration of all relevant factors and alignment with our overall risk mitigation strategy. The ROC also oversees key risk management activity to help ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board and senior management. • The Technology Security and Privacy Council, co-chaired by the CSO, Chief Information Officer, and Chief Privacy Officer, brings together IT, legal and internal audit personnel, and other function leads. The Security and Privacy Council provides a forum for these cross-functional members of management to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.


text: At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen also periodically holds employee trainings on our privacy, cybersecurity and information management policies, conduct phishing tests and generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: Risk Management and Strategy As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the General Data Protections Regulations ("GDPR"), as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of its Board of Directors. These escalation provisions, together with Lumen's Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: Our Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: Our Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including oversight by Lumen's Board of Directors, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board of Directors to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen's cybersecurity organization includes a response team and management-level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board of Directors and senior leadership team. Some of the more significant risks discussed by the ROC are also reported to Lumen's Security Committee at least quarterly.


text: Risk Management and Strategy Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework (NIST-CSF), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; and (v) managing third-party risks. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: Under the oversight of the Chief Information Officer (CIO), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.


text: To ensure the effectiveness of our existing cybersecurity controls and processes, and identify areas for improvement based on the latest industry best practices, we regularly engage third-party consulting services to conduct independent audits and assessments. Additionally, we leverage external expertise to evaluate our cybersecurity and risk management strategy, review policies and procedures to address emerging risks, and maintain ongoing compliance with evolving legal and regulatory requirements.


text: Security Controls: Our approach to cybersecurity employs a multi-layered strategy, implementing a range of technical administrative and physical controls to safeguard critical systems and data. These controls encompass (i) firewalls, intrusion detection, and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activities, and protect network infrastructure; (ii) encryption, including secure protocols and multi-factor authentication, to secure information in transit and at rest; and (iii) a secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to mitigate emerging cyber threats proactively.


text: Incident Response: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board of Directors (the "Board") cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.


text: Employee Awareness and Training: Our employees play a pivotal role in maintaining a strong cybersecurity posture. Our Information Security Policy Framework outlines the requirements for employee conduct concerning company information and company-managed devices, encompassing relevant privacy, data security, and data retention policies. We believe our Information Security Policy Framework aligns with industry best practices and applicable legal and regulatory requirements. Complementing our Information Security Policy Framework, we conduct regular cybersecurity training campaigns that emphasize the importance of cybersecurity awareness. These campaigns address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness, and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness and testing exercises.


text: Third-Party Risk Management: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we have implemented a comprehensive third-party risk management program designed to identify and oversee such risks. This program relies on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.


text: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CIO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.


text: While our Board and Audit Committee oversees cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board semi-annually on our enterprise risk management processes, ensuring transparency and accountability.


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CIO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Senior Director of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. The Cybersecurity Steering Committee meets and receives bi-monthly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.


text: Through this robust governance structure, involving Board oversight, senior management leadership, and a cross-functional committee, we maintain a proactive and comprehensive approach to managing cybersecurity risks across the organization.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors.


text: Risk Management and Strategy Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST-CSF"), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; (v) managing third-party risks; and (vi) providing governance aligning with business objectives and ensuring senior leadership accountability for cyber security risk management. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: Under the oversight of the Vice President of Information Security who operates as our Chief Information Security Officer ("CISO"), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.


text: Incident Response: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from internal cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.


text: Third-Party Risk Management: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we are implementing a comprehensive third-party risk management program designed to identify and oversee such risks. This program will rely on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We will utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.


text: Governance: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CISO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board annually on our enterprise risk management processes, ensuring transparency and accountability.


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CISO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Vice President of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. Our CISO has over 25 years of cybersecurity and corporate risk management experience. The Cybersecurity Steering Committee meets and receives quarterly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. "Risk Factors".


text: Risk Management and Strategy. We have policies and procedures for identifying, assessing and managing material risks associated with cybersecurity threats. To help protect our IT resources, we have instituted administrative, physical and technical controls and processes and commissioned third-party assessments. The technical defense measures we have implemented are designed to address vulnerabilities that may arise, including from a security control failure. These measures currently involve a combination of artificial intelligence; machine learning computer network monitoring; malware and antivirus resources; firewall systems; endpoint detection and response; cloud service defenses; Internet address and content filtering monitoring software intended to secure against known malicious websites and potential data exfiltration; and a variety of cyber intelligence and threat monitoring sources, which provide ongoing updates, all provided by third parties that we believe are capable of performing the service for which they have been engaged or governmental agencies. When engaging a third party for these types of services and resources, we typically conduct a security review involving, as relevant to the service or resource, discussions with the firm's security personnel, evaluation of auditor reports, and other requested information and documentation.

companyName: KB HOME

ticker: KBH


text: We evaluate, and adjust as determined appropriate, our cybersecurity strategies and measures based on the above-noted threat monitoring sources, learnings from periodic incident response tabletop exercises in which members of senior management participate; penetration tests and scanning exercises; and an annual cybersecurity and/or cloud security risk assessment conducted with help from outside experts informed by the National Institute of Standards and Technology Cybersecurity framework. Our IT function also undertakes a specific risk review, assisted in part by independent consultants and other third parties, that is integrated into the overall annual enterprise risk management assessment the board of directors' audit and compliance committee oversees. Our internal audit department incorporates the results from this risk review, and cybersecurity-related enhancements identified through the review, in designing and conducting its IT function audits, in some cases with a third-party firm's assistance.


text: To support the ongoing identification and management of cybersecurity issues, all employees are required to complete cybersecurity awareness training, including social engineering, password best practices, data classification and phishing awareness, with additional training for handling of customer personal information. We also publish a monthly security awareness newsletter along with performing ongoing internal phishing assessments.


text: We also consider and evaluate cybersecurity risks associated with KBHS and third-party service providers that we have identified as having the greatest potential to expose us to cybersecurity threats. We have established due diligence procedures with KBHS and such third-party service providers, as well as communication channels as part of their breach and incident response processes. We also review annually the System and Organization Controls reports of third-party vendors hosting our data to ensure they maintain adequate access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures and periodic independent testing of the vendor capabilities. We depend on our third-party service providers, KBHS and outside service providers to our customers with whom we share some personal identifying and confidential information to secure the information they receive from us.


text: Our business strategy, results of operations, or financial condition may be materially affected if our IT resources are compromised, whether by an intentional attack, natural or man-made disaster, electricity blackout, IT/cybersecurity failure, systems misconfiguration, denial-of-service attacks, service provider error, mismanaged user access protocols, personnel action, or otherwise, as we may be severely limited in conducting operations for an extended period, experience internal control failures, be cut off from assets or funds, face reputational damage, lose customers and related revenues and/or have private party or governmental legal proceedings instituted against us, and incur significant expenses to resolve any such issues. Similar impacts may result from a substantial disruption, or security incident or breach KBHS or an outside service provider to our customers suffers, which could also result in sensitive personal information being publicly disclosed or misused.


text: Governance. Our management is responsible for the ongoing assessment of, and for developing and implementing our strategies and measures to address, material cybersecurity risks. Our board of directors through its audit and compliance committee oversees management's cybersecurity assessment activities and protective strategies and measures. This includes engaging in periodic reviews with management covering, among other things, our cybersecurity practices and risks. Our chief information officer ("CIO") periodically provides this review to the audit and compliance committee, with the most recent review conducted in January 2025. The CIO, who has more than 34 years of experience in IT and cybersecurity, is supported by a chief information security officer and various employees and dedicated contract personnel experienced with IT and cybersecurity matters who are responsible for procuring, using, maintaining, updating and evaluating the cybersecurity measures detailed above. These individuals also hold numerous cloud, security and privacy certifications.


text: Our IT function, which is led by the CIO, maintains and is initially responsible for executing on a cybersecurity incident response plan and specific runbooks, which describe processes for evaluating and escalating, depending on severity, within the enterprise and up to our senior executive management and board of directors the cybersecurity threats and incidents, or potential threats or incidents, identified through our cybersecurity measures, as well as making public disclosures thereof. This team also maintains other policies and procedures concerning cybersecurity matters, such as encryption standards, antivirus protection, remote access, multifactor authentication, data classification, confidential information and the use of the internet, social media, email and wireless devices. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio.


text: Our IT systems have faced a variety of phishing, denial-of-service and other attacks. Although we have not identified any cybersecurity incidents during the fiscal years covered by this report that have materially affected or are reasonably likely to materially affect our business strategy, consolidated results of operations or consolidated financial condition, we can provide no assurance that our security measures will be successful and therefore we may experience a cybersecurity incident that materially affects our business strategy, consolidated results of operations, consolidated financial condition or reputation, including, but not limited to those described above. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors.


text: Risk Management and Strategy Adobe has certain security processes, infrastructure, systems, policies and practices for assessing, identifying and managing risks from cybersecurity threats. We maintain an information security risk management framework for managing cybersecurity risks, priorities and projects for our products, services, infrastructure and corporate resources. As part of our framework, a cybersecurity risk steering committee meets regularly to review newly identified risks and progress on remediating existing risks.

companyName: ADOBE INC.

ticker: ADBE


text: We conduct regular security reviews, simulations and testing, including internal and external penetration testing, vulnerability assessments and regular scans on our hosts and network devices. We review available threat intelligence, including information from industry groups and our security vendor. We consult with third parties, including cybersecurity consultants, as part of our cybersecurity threat and risk management strategy.


text: Depending on the environment, our risk mitigation strategies include a variety of technical, physical and operational measures designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We require employees annually to complete a general security awareness training, and additional engineering and security specific training may also be required for certain positions. Further, we maintain a vendor security review program, which is designed to provide an assessment of the security practices of those third-party vendors that process Adobe non-public data or connect to our networks. We maintain an information security incident response plan designed to monitor, analyze, address, escalate and report cybersecurity incidents, and escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Security Officer ("CSO"), Chief Cybersecurity Legal and Privacy Officer ("CCPO"), Chief Financial Officer, Chief People Officer, President of Digital Media, President of Digital Experience, General Counsel and Chief Executive Officer.


text: For a description of the risks from cybersecurity threats that may materially affect us, see the risks described in the section titled "Risk Factors" contained in Part I, Item IA of this report, including under the headings "Security incidents, improper access to or disclosure of our customers' data or other cybersecurity incidents may harm our reputation and materially and adversely affect our business."


text: Our Board of Directors (the "Board") addresses cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") has oversight of enterprise risks, including risks related to cybersecurity. In this regard, the Audit Committee reviews and discusses with management the adequacy and effectiveness of our information security, technology and privacy policies and the internal controls regarding these areas. Our Audit Committee receives regular cybersecurity updates about general cybersecurity risks from our CSO and updates about the prevention, detection, mitigation and remediation of cybersecurity incidents from our CSO and CCPO. Cybersecurity updates presented to the Audit Committee are reported to the Board by the Audit Committee Chair. We also have a Cyber Disclosure Committee, comprised of cross-functional leaders including finance, risk, operations and investor relations and led by the CSO and CCPO, that meets to assess certain incidents and makes determinations regarding materiality. Additionally, our CSO and CCPO identify certain cybersecurity risks that are reviewed as part of the enterprise risk management framework and presented to the Board and the Audit Committee on an annual basis.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including our CSO and CCPO, whom each has extensive cybersecurity experience in their respective areas of responsibility and expertise. Our CSO, who reports to the Chief Financial Officer, has primary responsibility for hiring appropriate information security personnel and managing workloads of information security personnel, engaging and overseeing third-party cybersecurity consultants, approving budgets and cybersecurity processes, preparing for incident response, reviewing security assessments and other security-related reports, communicating key priorities to relevant personnel, including the security incident response team, assessing and managing Adobe's overall cybersecurity strategy, standards, risk management (in consultation with the cybersecurity risk steering committee) and processes. Our CCPO, who reports to the General Counsel, has primary responsibility for the legal aspects of the cybersecurity program, including assessing and providing advice on our cybersecurity strategy, standards, risk management, policies, processes and legal obligations. Our CSO and CCPO are supported by a cybersecurity team comprised of cybersecurity, information security, information technology, operations and legal executives and professionals.


text: RISK MANAGEMENT AND STRATEGY Occidental has implemented and maintains processes for assessing, identifying and managing material risks from potential unauthorized occurrences on or through its IT and ICS networks that may result in material adverse effects on the confidentiality, integrity and availability of Occidental's systems and the information residing in those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting Occidental's systems and the data it collects, processes, stores and transmits as part of its businesses.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Occidental has developed a robust cybersecurity program which is reviewed by senior leadership including its Chief Information Officer (CIO) and other stakeholders as part of its standard general IT controls. Business network and ICS cybersecurity risks are handled by separate and dedicated Occidental teams and are incorporated into Occidental's enterprise risk management program.


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. The Company conducts internal security audits, including audits conducted by third parties, and other assessments. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.


text: Occidental has implemented and maintains a cybersecurity incident response plan that provides the organizational and operational protocol for the Company to effectively and timely respond to cybersecurity incidents. In the event of a material cybersecurity incident, Occidental's CIO will receive regular updates and monitor detection, mitigation and remediation through reports from a team of experienced cybersecurity leaders responsible for actioning the Company's cybersecurity incident response plan. As a material cybersecurity incident is handled by the team, the CIO will maintain communication and information flow to senior leadership as well as the Audit Committee and/or the Board, as appropriate.


text: Cybersecurity risks and associated mitigation strategies and efforts are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board. Additional information on cybersecurity risks Occidental faces is discussed in Item 1A of Part I, "Risk Factors," under the heading "Occidental is exposed to cyber-related risks," which should be read in conjunction with the foregoing information.


text: Occidental's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but Occidental cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on Occidental's cybersecurity related risks, see Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board oversees the Company's IT security programs, including cybersecurity, which includes review of possible external threats and potential mitigations. The Board also reviews the Company's cybersecurity program at least annually. In this review, the CIO briefs the full Board on cybersecurity and data protection matters, including analysis and review of the measures implemented by the Company to identify and mitigate cybersecurity risks. Occidental also has protocols by which material cybersecurity incidents are to be reported to the Audit Committee and/or the Board, as appropriate.


text: Occidental's CIO, who has over 20 years of IT and cybersecurity experience at the Company and elsewhere, heads the team responsible for implementing and maintaining cybersecurity and data protection practices across Occidental's businesses and reports directly to the President and CEO. Occidental has a centrally coordinated team, led by its CIO, responsible for implementing and maintaining cybersecurity and data protection practices across the Company. Occidental's CIO regularly reviews risk management measures and the overall cyber risk strategy implemented and maintained by the Company. The CIO receives regular updates on Occidental's cybersecurity program and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through reports from the Company's cybersecurity leaders, each of whom is supported by a team of trained cybersecurity professionals. In addition to Occidental's extensive in-house cybersecurity capabilities, Occidental also engages assessors, consultants, auditors or other third parties when necessary to assist with assessing, identifying and managing cybersecurity risks.


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. Occidental has invested in broad cybersecurity awareness and mandatory training to educate those with access to company networks on Occidental's cybersecurity policies and best practices. Occidental conducts regular phishing tests to educate, train and assess the workforce's ability to identify malicious emails. The Company also conducts internal security audits and other readiness tests, including audits conducted by third parties and tabletop exercises, to assess and improve preparedness and promote communication and monitoring across the organization. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.


text: The Audit Committee of the Board oversees the Company's IT security programs, including cybersecurity, which includes review of possible external threats and potential mitigations. The Board also reviews the Company's cybersecurity program at least annually. In this review, the CIO briefs the full Board on cybersecurity and data protection matters, including analysis and review of the measures implemented by the Company to identify and mitigate cybersecurity risks. Occidental also has protocols by which material cybersecurity incidents are to be reported to the Audit Committee and/or the Board.


text: Enterprise Risk Management We maintain an enterprise risk management ("ERM") program designed to systematically identify and manage risk including risk from cybersecurity threats. The risk committee of the board of directors oversees our ERM program and it is reviewed annually by both the risk and audit committees of the board of directors. The risk committee also monitors and reports to the board regarding issues arising with respect to the risk governance structure and performance of the risk management function. The board, as a whole and through its committees, regularly engages with the Chief Risk Officer, management and outside advisors to identify, assess and manage risks of the company and to ensure the risk management function has the appropriate resources and authority to fulfill its responsibilities. An executive risk committee, comprised of senior leaders of our lines of business and corporate functions, provides executive level accountability for the ERM program.

companyName: FISERV INC

ticker: FISV


text: On an ongoing basis, we identify, categorize, assess, monitor and respond to business risks. We consider the various ways in which risks may affect our business by measuring the impact of those risks against a consistent set of criteria, which include the potential impact to our operations, financial performance, clients, technology, reputation, business strategy and regulatory environment. The risk committee of the board of directors reviews and approves a list of top enterprise risks and the risk appetite relating to such risks. Among the top risks included in our ERM program is cybersecurity risk. Response plans are developed, tracked and implemented for residual risks that are above the acceptable tolerance level.


text: Management's Role in Cybersecurity Our global cybersecurity services team is responsible for assessing our technology environment, identifying emerging cybersecurity threats and evolving cybersecurity threat capabilities, and implementing business processes and technical defenses to safeguard our technology environment and services. Our management has established a cybersecurity and technology risk committee focused on managing cybersecurity and technology risk and implementing cybersecurity and technology plans, strategies and objectives. The committee is chaired by the Deputy Chief Information Security Officer, who reports to the Chief Operating Officer through our Chief Information Security Officer, and is comprised of senior business, cybersecurity, and technology leaders responsible for delivering our products and services. Our cybersecurity program is designed to enable us to detect and respond to cybersecurity incidents, continually improve the effectiveness of our cybersecurity controls, and dynamically respond to the evolving threat landscape.


text: Our cybersecurity operation center monitors our environment to detect cybersecurity incidents, identifies suspicious activities or unusual behaviors, and responds with the objective of minimizing potential impact to operations. We use various security technologies and controls and modern analytics designed to detect, prevent and respond to cybersecurity threats. Our global cybersecurity services team collects intelligence from the private and public sector related to cybersecurity threats, emerging adversarial campaigns and vulnerabilities. The global cybersecurity services team uses this information, along with internal intelligence and analytics, to evaluate the potential cybersecurity threats and develop security strategies to reduce risk and improve response.


text: We maintain a global cybersecurity policy that incorporates recognized industry standards from the National Institute of Standards and Technology including the Cybersecurity Framework and Special Publication 800-53 Security and Privacy Controls for Information Systems and Organizations as well as various security certifications.


text: Our employees play a vital role in protecting our and our clients' data. We provide regular, mandatory training for our employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. The traditional requirement for associate cybersecurity training is complemented by frequent security education and awareness campaigns. Each month, we feature a different security topic such as data loss prevention, phishing and ransomware. We also maintain a third-party risk management program to identify, assess, mitigate and monitor risks associated with third parties' software and services that we utilize.


text: Our Chief Information Security Officer has served in various senior roles in information technology and information security, in both the public and private sector, for over two decades and maintains a Certified Chief Information Security Officer professional certification. Similarly, the other members of our global cybersecurity services team have cybersecurity training and experience in both the public, including military and law enforcement, and private sectors and maintain various certifications in relevant subjects.


text: The board of directors maintains primary oversight of the company's strategic, operational and financial risks, including cybersecurity risks. The risk committee of the board of directors assists the board in its oversight of such risks and is primarily responsible for oversight of cybersecurity risks. The risk committee regularly reviews and discusses with management the current cybersecurity threat landscape, emerging trends and developments, and the company's guidelines, policies and processes for monitoring, managing, and mitigating cybersecurity risks.


text: The board and the risk committee receive regular presentations and reports from management as well as outside experts on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. On an annual basis, the board and the risk committee discuss our approach to cybersecurity risk management with our Chief Risk Officer, Chief Compliance Officer and Chief Information Officer, among others. The board and the risk committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources to maintain and enhance our information security and controls or to investigate and mitigate security vulnerabilities. As a result, cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes. Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Enterprise Risk Management At the core of our business, we host, collect, process, use and retain significant amounts of financial, personal and other sensitive data across our own technology environment and the third-party information systems of our vendors, service providers and partners. In order to keep this data secure, we maintain an enterprise risk management ("ERM") program designed to systematically identify and manage risk including risk from cybersecurity threats. The risk committee of the board of directors oversees our ERM program and it is reviewed annually by both the risk and audit committees of the board of directors. The risk committee also monitors and reports to the board regarding issues arising with respect to the risk governance structure and performance of the risk management function. The board, as a whole and through its committees, regularly engages with the Chief Risk Officer, management and outside advisors to identify, assess and manage risks of the company and to ensure the risk management function has the appropriate resources and authority to fulfill its responsibilities. An executive risk committee, comprised of senior leaders of our lines of business and corporate functions, provides executive level accountability for the ERM program.


text: Management's Role in Cybersecurity Our global cybersecurity services team is responsible for assessing our technology environment, identifying emerging cybersecurity threats and evolving cybersecurity threat capabilities, and implementing business processes and technical defenses to safeguard our technology environment and services. Our management has established a cybersecurity and technology risk committee focused on managing cybersecurity and technology risk and implementing cybersecurity and technology plans, strategies and objectives. The committee is chaired by the Deputy Chief Information Security Officer, who reports to the Chief Operating Officer through our Chief Information Security Officer ("CISO"), and is comprised of senior business, cybersecurity, and technology leaders responsible for delivering our products and services. Our cybersecurity program is designed to enable us to detect and respond to cybersecurity incidents, continually improve the effectiveness of our cybersecurity controls, and dynamically respond to the evolving threat landscape.


text: We maintain a global cybersecurity policy that incorporates recognized industry standards and best practices from the National Institute of Standards and Technology as well as various security certifications.


text: Our employees play a vital role in protecting our and our clients' data. We provide regular, mandatory training for our employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also maintain a third-party risk management program to identify, assess, mitigate and monitor risks associated with third parties' software and services that we utilize.


text: Our CISO has served in various senior roles in information technology and information security, in both the public and private sector, for over two decades and maintains a Certified Chief Information Security Officer professional certification. Similarly, the other members of our global cybersecurity services team have a broad range of cybersecurity training and experience in both the public, including military and law enforcement, and private sectors and maintain various certifications in relevant subjects.


text: The board and the risk committee receive regular presentations and reports from management as well as outside experts on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. On an annual basis, the board and the risk committee discuss our approach to cybersecurity risk management with our Chief Risk Officer, Chief Compliance Officer and Chief Information Officer, among others. At each regular board meeting, the risk committee reviews and reports to the board on key cybersecurity risks. The board and the risk committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources, including maintaining cybersecurity insurance coverage, to sustain and enhance our information security and controls or to investigate and mitigate security vulnerabilities. As a result, cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes. Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Additional information on the impact of cybersecurity threats applicable to our business can be found in the Risk Factors section of this report under the heading "Operational and Security Risks".


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: CENTERSPACE

ticker: CSR


text: Our Board of Trustees oversees management's process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Senior Vice President of Information Technology (the "SVP of IT"), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives. This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.


text: Our SVP of IT leads a team that is responsible for assessing and managing our cybersecurity risks. The SVP of IT has a B.S. in Management Information Systems, spent more than a decade with Microsoft before joining the Company, and is an active member of North Dakota State and Local Intelligence Center (NDSLIC), an affiliate of National Fusion Center Association (NFCA) and United States Homeland Security (DHS). Senior management, including the SVP of IT, conducts regular meetings to discuss technology initiatives and cybersecurity risks and strategies.


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.


text: We engage third party experts to monitor for and identify cyber threats. Both management and the third party provider receive alerts regarding cyber threats. The third party provider has the ability to act on our behalf to respond to any threats it identifies. We also use, among other things, endpoint monitoring, anti-virus software, multi-factor authentication, and data encryption to assist with managing cyber risks and identifying cyber threats. In addition, we engage a cybersecurity consultant to regularly assess cyber risks and threats and provide recommendations and plans to mitigate those risks.


text: We utilize third-party service providers for a variety of functions. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. We look for reliable and reputable service providers that maintain cybersecurity programs based on industry standards. Depending on the nature of the services provided and the sensitivity of information processed, our vendor management process may include contractually imposed obligations on the provider and reviewing the cybersecurity practices of such provider.


text: In 2021, we suffered a ransomware attack on our information technology systems. This incident did not have a material impact on our business, operations, or financial condition; however, as a result, we began work on certain information technology initiatives earlier than originally planned.


text: A security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Our Board of Trustees oversees management's process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Board of Trustees has also delegated authority to its Audit Committee to review our internal controls relating to information technology, data privacy, including data protection and cybersecurity, including network security and cloud security. Senior leadership, including our Senior Vice President of Information Technology (the "SVP of IT"), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives. This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.


text: We have not suffered any cyber incident that had a material impact on our business, operations, or financial condition. However, a security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the "Three Lines Model") to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO led by our Chief Information Security Officer (the "CISO"), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information & Operations Officer ("CIOO"), who reports directly to our Chief Executive Officer. As a part of the ECSO, Enterprise Incident Management ("EIM") maintains incident response playbooks (i.e., standard operating procedures) to identify, respond, classify, and analyze incidents and events in accordance with BancShares' Enterprise Severity Matrix, and our Security Operation Center identifies, assesses, manages, and monitors potential cybersecurity events with EIM. In addition, BancShares maintains a third-party risk management team tasked with evaluating, identifying, and managing risk from all third-party engagements, including from cybersecurity threats.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework that is designed to require that the cybersecurity organization appropriately document the current risk landscape and the activities undertaken to mitigate risk that falls outside of the enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls.


text: We maintain processes for escalation from each line, including processes to report information to management, management-level committees and to committees of the Board and the Board as a whole, as appropriate. For example, Risk Appetite Statements, top risks, and issues are reported to the Management Committees and the Risk Committee of the Board to monitor progress, identify trends, and escalate issues.


text: BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry standards, including the National Institute of Standards and Technology Cybersecurity Framework, and are enforced through the firm's preventive and detective controls.


text: Additionally, BancShares has implemented a threat awareness program that includes cross-organizational information sharing capability for threat intelligence and membership and engagement with intelligence communities including the Financial Services Information Sharing and Analysis Center, Federal Bureau of Investigation, United States Department of Homeland Security, and others. BancShares also utilizes external experts and third-party assessors to maximize its risk intelligence coverage and management ability.


text: BancShares engages internal auditors, external assessors, and consultants to benchmark, scale, manage, and identify cybersecurity threats. Consultants also assess BancShares' cybersecurity systems and complete vulnerability testing. These groups assist the ECSO with cybersecurity risk management and identification.


text: The BancShares information security program continues to operate under heightened awareness due to industry threats and recent acquisitions. For more information regarding the risks we face from cybersecurity threats, refer to Item 1A. Risk Factors. Thus far, there have been no cybersecurity incidents that we have determined to have materially affected or to be reasonably likely to materially affect us, including with respect to our business, results of operations, or financial condition. The focus continues to be on monitoring the threat landscape and integration of entities.


text: The Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity threats, subject to the committee delegation described below. The Board conducts oversight of management through its subcommittees, presentations from senior leadership, and routine board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements.


text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee further oversees cybersecurity and other risks through a subcommittee, the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's current business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.


text: In addition, the Audit Committee of the Board (the "Audit Committee") monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, from cybersecurity or other risks, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with Audit Committee for review of information security matters, as needed.


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics. For example, our Board recently established and authorized a Task Force on Technology (the "Task Force") to assist and support the Board in a strategic review of the role of technology in our operations, our current and future investments in technology resources, and the current board oversight of risk, governance, and controls surrounding technology and cybersecurity. The Task Force is comprised of members of the Board, working closely with management, including the CIOO.


text: The CISO is responsible for assessing and managing material cyber risks. His expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. He, the CIOO, and others report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.


text: The Risk Committee receives information on cybersecurity risk, including risk appetite utilization, breaches and emerging risks, and the control environment, directly or indirectly, from various sources, including each of the CISO, the EROC, Management Committees, the Task Force, the TSRC and the ORC. Additionally, the Risk Committee reviews BancShares' information security policies and program with a focus on whether they are appropriate to protect data, records, and proprietary information of BancShares as well as that of its customers and employees.