text: Our current DVP, Information Security has led the information security program at TaskUs for eight years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.


text: We have also developed an incident response plan, designed to identify suspected or confirmed information security or cybersecurity events based on the expected risk an event presents, and expediently move such information through the appropriate personnel and channels. The plan details the sequence of steps and relevant personnel, roles, communication procedures, and incident response process flows to be used in the event of an applicable incident. Our Disclosure Committee, which is composed of certain of our senior management, legal and operations teammates, plays an integral role in this process, by supervising external reporting of cybersecurity incidents. Among other items, our procedures require calling an ad hoc committee meeting within 24 hours of incident identification for incident materiality assessment and determination.

companyName: TaskUs, Inc.

ticker: TASK

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We have developed a comprehensive cybersecurity program, modeled after the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), that forms a critical component of our overall risk management and business strategy and provides for a methodological approach to identifying, assessing and managing material risks from cybersecurity threats. Our risk assessment protocol considers both probability of occurrence and potential impact to our business and is predicated on the pillars of risk identification, analysis and mitigation. Execution of our cybersecurity program is coordinated by our management, dedicated cybersecurity employees and third-party providers. While no particular cybersecurity risk or incident has unilaterally influenced our strategy, we allocate a portion of our operational and capital budgets towards sustaining and improving our cybersecurity defense posture, in addition to maintaining tailored insurance coverage. We value the importance of safeguarding digital assets, ensuring trust, and operational continuity amidst evolving threats. By prioritizing cybersecurity, we endeavor to protect our interests and uphold our commitment to our stakeholders' security and privacy.


text: To evaluate the adequacy of our cybersecurity program, we apply various assessment techniques, such as continuous asset audit, vulnerability management, external attack surface management, source code review, a bug bounty program, threat hunting, red-team exercises, and direct engagement with functional leaders. We routinely examine our cybersecurity defenses through automated and manual vulnerability scanning to identify and correct critical vulnerabilities. In addition, we conduct regular testing to evaluate our security posture and the adequacy of our policy as a whole. We compare our cybersecurity program against industry standards and established frameworks, such as the NIST and Center for Internet Security. Further, we engage in cyber incident simulation exercises executed by senior management and IT/Information Security personnel, involving hypothetical cybersecurity incidents to test our cyber incident response processes. In addition to the foregoing internal review of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other things, these independent parties analyze the effectiveness of controls over information technology resources and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes for qualifications under recognized industry standards and for annual certification under Payment Card Industry Data Security Standard (PCI DSS), HITRUST, SOC 2 Type II, and ISO 27001. We memorialize our findings and review the results of these assessments with management and, where appropriate, our board of directors. Relevant modifications are incorporated into our cybersecurity framework to ensure that our systems functionally align with our cybersecurity strategies. Additionally, as the threat environment evolves, we have continued to refine our cybersecurity program in response to prior cyber incidents that have specifically impacted us, and that have more expansively impacted other companies; for example, we have recently instituted an incentive program for reporting of fraud threats and modified our employee training programs.


text: Furthermore, we engage third-party vendors to support our cybersecurity program. Prior to onboarding, we review the cybersecurity risk profile of third party vendors to ensure that they employ appropriate safeguards to comply with our internal standards and current industry regulations. We classify IT service providers according to their risk and independently audit their security controls on a recurring basis based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. Furthermore, in certain instances, we include contractual provisions in our agreements with such vendors to implement best practices with respect to data and cybersecurity, as well as to provide us with rights to assess, monitor, audit and test such vendors' cybersecurity programs and practices and to mandate notice requirements in the event of a breach. We also closely monitor and manage third-party access to our internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A. "Risk Factors – Unauthorized or improper disclosure of personal or other sensitive information, or security breaches and incidents, whether inadvertent or purposeful, including as the result of a cyber-attack, could result in liability and harm our reputation, each of which could adversely affect our business, financial condition, results of operations and prospects" in this Annual Report.


text: Cybersecurity Governance Our board of directors and management closely coordinate to execute on our cybersecurity strategy. Our board of directors oversees cybersecurity risk management as part of its oversight of our risk management framework, while the Audit Committee has primary responsibility for management of the risks facing our Company and oversight of the measures initiated by management to monitor and control such risks and reports to the board of directors. Our management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, and compliance. Our Division Vice President for Information Security (DVP, Information Security) reports to our Chief Information Officer (CIO) and has primary responsibility for the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security Management System. The CIO and DVP, Information Security meet regularly with the Audit Committee to review the company's management of information security risks, and the Audit Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CIO. Additionally, our Enterprise Risk Management Committee, which is composed of certain of our senior management, legal and operations teammates, provides senior management with sponsorship and guidance to ensure that overall risk management objectives are achieved and regularly reports to the board of directors on matters within its purview.


text: Our current DVP, Information Security has led the information security program at TaskUs for nine years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Since the completion of the Business Combination on February 14, 2024, management has been working to create a defined cybersecurity risk management program, through the addition of enhanced applications to identify and mitigate risks. During 2024 the Company engaged and managed an experienced third party vendor, specializing in cybersecurity, to conduct a Company wide cybersecurity risk assessment. The assessment included a multi-phase approach consisting of open-source intelligence gathering, network system penetration testing of the Company's internal, external, and wireless networks, and targeted social engineering through strategic phishing, vishing, and smishing campaigns. Action items and preventative recommendations were identified by management and are being incorporated into the Company's information security incident response plan, which is designed to follow the National Institute of Standards and Technology Cybersecurity Framework 2.0 standards and practices for identifying and mitigating cybersecurity incidents. Management will complete implementation of the action items during 2025, which we intend to test periodically for effectiveness.

companyName: Sable Offshore Corp.

ticker: SOC


text: No Previous Material Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences for the Company. While we intend to devote resources to our security measures to protect our systems and information during 2025, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight of Cybersecurity Risks The audit committee of our Board is responsible for the oversight of risks from cybersecurity threats. As part of its oversight, our audit committee and certain members of the Company's management will meet quarterly to discuss ongoing initiatives and to facilitate coordination between Company stakeholders. Annually, our Vice President of Information Technology will review the Company's cybersecurity risk management program with our audit committee and Board.


text: Management's Role in Assessing and Managing Cybersecurity Risks Our Vice President of Information Technology is primarily responsible for assessing and managing the Company's material cybersecurity risks, monitoring the effectiveness of our cybersecurity detection and response processes and providing updates on cybersecurity to our executive team. Our Vice President of Information Technology has more than 25 years of experience working in the field of information technology, including significant experience directing enterprise-level cybersecurity programs.


text: In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees and borrowers. In addition, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or borrower information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems, including those pertaining to third-party service providers, that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by dedicated information security teams, including technology risk, cybersecurity operations, cybersecurity engineering, and identity and access management, led by our Chief Information Security Officer ("CISO"). These teams collectively manage and monitor mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, access, or other security incidents or vulnerabilities affecting our data, digital assets and systems in furtherance of maintaining a secure information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on cyber and information security topics, phishing and simulations. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We also utilize a third party for cybersecurity incident monitoring and response.

companyName: loanDepot, Inc.

ticker: LDI


text: Our CISO, who reports to the Chief Information Officer and has over twenty years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. The CISO receives regular reports prepared by experienced information security officers on cybersecurity threats, based on data from the Information Security Department and, in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks. Certain risk topics, such as cybersecurity and compliance, are discussed at Enterprise Risk Management Committee (consisting of executive management) meetings, and are included in reports to the Board and Audit Committee.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, which the Company believes will have a material impact on the Company's first quarter 2024 results. As previously disclosed, among other things, the Company expects to record in the first quarter of 2024 approximately $12 to $17 million of expenses related to the Cybersecurity Incident, net of expected insurance recovery. In addition, the Company has been named as a defendant in several lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, the Company currently does not expect that the cybersecurity incident will have a material effect on its overall financial condition or on its ongoing results of operations. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs, which could adversely affect our business, financial condition and results of operations."


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives quarterly or as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.


text: In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees, borrowers and other customers and potential customers. In addition, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or customer information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems, including those pertaining to third-party service providers, that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by dedicated information security teams, including technology risk, cybersecurity operations, cybersecurity engineering, and identity and access management, led by our Chief Information Security Officer ("CISO"). These teams collectively manage and monitor mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, access, or other security incidents or vulnerabilities affecting our data, digital assets and systems in furtherance of maintaining a secure information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security topics, phishing and simulations. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We also utilize a third party for cybersecurity incident monitoring and response.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, and in subsequent filings with the SEC. We recognized $24.6 million of expenses related to the Cybersecurity Incident, net of insurance recoveries during fiscal 2024. In addition, we were named, and may still be named, as a defendant in lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. Further, we have engaged with and continue to engage with regulators related to the Cybersecurity Incident. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, we currently do not expect that the Cybersecurity Incident will have a material effect on our overall financial condition or on our ongoing results of operations beyond those amounts already accrued. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs."


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regularly scheduled and as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.


text: Risk Management and Strategy Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2023, we undertook an in-depth enterprise risk analysis and designed a program to address the most significant risks affecting our business. Our newly-developed enterprise risk program integrates cybersecurity.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.


text: Through our cybersecurity program, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats.


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under this assessment process, we gather information from certain third parties who contract with us and share or receive data, to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data. We assess the risks from cybersecurity threats that impact select third-party service providers with whom we share personal identifying and confidential information. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the services we procure from such third parties.


text: Our cybersecurity awareness program includes regular phishing simulations, and quarterly general cybersecurity awareness and data protection modules for all employees with network access, as well as more contextual and personalized modules for targeted users and roles. We complete annual internal security audits and vulnerability assessments of the Company's information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We have also purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: In 2023, we did not experience any material information security breach or incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—Failure to effectively utilize information technology systems or implement new technologies and the unauthorized disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Compromises, interruptions or shutdowns of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight over such risks and the steps our management has taken to monitor and control these exposures. Our data privacy and security program is overseen by our IT Director who has presented to the Board on an annual basis. Our Audit Committee also receives briefings on significant cybersecurity incidents.


text: Our IT Director leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.


text: Our IT Director is Joe Rogers. He has 35 years of experience in information technology and cybersecurity, having been at the Company in his role as IT Director since 2022.


text: Risk Management and Strategy Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2024, we continued the development of our enterprise risk program, which integrates cybersecurity.


text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implemented risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.


text: In 2024, we did not experience any material cybersecurity incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—The unauthorized access to our information technology systems or the disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Failure of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight of such risks and the steps our management has taken and takes to monitor and control these exposures. Our data privacy and security program is overseen by our Vice President of IT, who presents to the Board on an annual basis. Starting in 2024, our Board receives quarterly briefings on cybersecurity matters and the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity risks. Our Audit Committee also receives regular briefings on cybersecurity matters, including cybersecurity threats and receives details on any significant cybersecurity incidents.


text: Our Vice President of IT leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and information security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.


text: The IT team is led by Shoals' Vice President of IT, Gerald Jowers, who joined in 2024 with 30 years of technology experience.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to robots, employees or customers; violation of privacy or security laws and other litigation, legal and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: As part of these processes, and to ensure confidentiality, integrity and availability of critical data and systems, we have implemented various technologies that aid in the prevention, detection, investigation, response and remediation of vulnerabilities, cybersecurity incidents and risks. These technologies and processes include, but are not limited to, mobile device management, virtual private network security services, attack surface management services, cloud threat detection and response systems, cloud security posture management solutions, cloud-native security scanners and source code analysis tooling, continuous compliance monitoring and security awareness training solutions.


text: Evaluation and mitigation of Third-party risks are included within our broader overall risk assessment process. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors.." in Part I, Item 1A. Risk Factors in this report for more information.


text: The security and infrastructure teams are responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. As part of our risk management strategy, our cybersecurity team conducts routine vulnerability and risk assessments within our product operations and service environments. The results of these reviews and any incidents identified by security tooling are reported to senior management and the internal steering committee as part of the quarterly reporting process. As part of routine security assessments, if any deficiencies relating to internal technology controls over financial reporting are discovered, the VP of Security is required to report them directly to the executive management team and internal steering committee without delay.


text: In the last three fiscal years, we are not aware of and have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.


text: Cybersecurity Governance Our internal steering committee and board of directors oversees our risk management strategies and processes, regarding risk assessment and risk management as they relate to cybersecurity. Our security team is led by our VP of Security who has over 15 years of direct cybersecurity experience that includes incident response, security operations and management. The security and infrastructure teams are responsible for implementing and maintaining cybersecurity and data protection controls and practices for the protection of our robots, customer and company information, systems and data. The VP of Security in coordination with our internal steering committee, whose members include professionals from our executive team, general counsel, product and technology and finance teams, meet quarterly to review our Cybersecurity risk exposure, discuss internal and external threat actors and prioritize remediation strategies. The internal steering committee makes decisions on the avoidance, transference, acceptance and mitigation of our overall cybersecurity risk exposure.


text: Our steering committee, typically in joint session with the full board of directors, meets quarterly with Serve executive leadership to receive reports regarding our overall security posture. These reports include updates on the implementation of cybersecurity controls, data security, risk assessments, the status of internal cybersecurity projects, technology compliance, employee awareness training and any notable incidents and remediation that have occurred within the quarter.


text: Risk Management and Strategy Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) cybersecurity framework and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST Cyber Security Framework (CSF).


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process to manage cybersecurity risks related to the products and services we procure.


text: During the fiscal year ended June 30, 2024, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation" in Item 1A "Risk Factors" in this Annual Report.


text: While our full Board of Directors has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to the Board of Directors on cybersecurity matters quarterly, or more often as the need arises.


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.


text: Cole Naus is our CISO. Mr. Naus has over 10 years of experience in the cybersecurity industry. Mr. Naus holds a degree in Cybersecurity and Information Assurance and holds other cybersecurity certifications. Mr. Naus reports directly to Cara Babachicos, our CIO. Ms. Babachicos has over 20 years of experience in the cybersecurity industry, having previously worked as Chief Information Officer at other companies in the healthcare industry.


text: Risk Management and Strategy Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) Cybersecurity Framework (CSF) and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks, including those that may be exacerbated by artificial intelligence, and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST CSF.


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process which we periodically review to manage cybersecurity risks related to the products and services we procure.


text: During the fiscal year ended June 30, 2025, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation " in Item 1A "Risk Factors" in this Annual Report.


text: While our full Board has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to our Board on cybersecurity matters quarterly, or more often as the need arises.


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company, with its members having experience in public and private companies within the healthcare industry, as well as various cybersecurity certifications. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.


text: Risk Management and Strategy The Company has adopted policies, processes, procedures and standards and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Cybersecurity Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: N-able, Inc.

ticker: NABL


text: The Company's processes are integrated into its overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. The processes compliment the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Cybersecurity Committee. In designing these processes, the Company takes into account industry frameworks such as the National Institute of Standards and Technology (NIST), Committee of Sponsoring Organizations (COSO), and International Organization for Standardization (ISO) 27001, and other industry standards. To further improve the effectiveness of its cybersecurity risk management framework, the Company has in the past, and may continue to do so in the future, engage third party consultants, to assist in testing and evaluating our security program.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. The Company engages a third-party to perform 24/7 monitoring for threats and unauthorized access to our information security network.


text: We have a formalized incident response plan (IRP) and associated procedures based on cybersecurity best practices which are refined using the information gained through testing and to further improve our cybersecurity preparedness and response infrastructure. These plans and procedures set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually. Our information security management system has been independently certified as being in conformity with ISO/IEC 27001:2013.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. The Company works with such providers to recommend securities measures to be improved where possible, and generally requires those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our MSP partners', or their SME customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our MSP partners', or their SME customers' systems, the exploitation of vulnerabilities in our, our MSP partners', or their SME customers' environments, the theft or misappropriation of our, our MSP partners', or their SME customers' proprietary and confidential information, and interference with our, our MSP partners', or their SME customers' operations, exposure to legal and other liabilities, higher MSP partner and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, MSP partner and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors and the Cybersecurity Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management program, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Cybersecurity Committee of the Board, or the Cybersecurity Committee. The Cybersecurity Committee is responsible for overseeing our information technology systems and cybersecurity risks, including plans and programs relating to cyber and data security and legal and regulatory risks associated with our products and business operations. The Cybersecurity Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our cybersecurity and compliance program, critical cybersecurity risks, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CISO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: The CSO manages a team that is responsible for day-to-day tracking, assessing and management of threats. The N-able security team has a dedicated incident response team, with trained resources that are responsible for the various stages of our incident management strategy, including preparation, detection and analysis, containment, eradication, and recovery. Through ongoing communications with the team, the CSO and the SRC are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident or investigation, management will, in accordance with the Company's IRP and other policies in place, promptly report to the Cybersecurity Committee and the Board, as appropriate. This escalation is in addition to the regular reports by the CSO to the Cybersecurity Committee on at least an annual basis.


text: Our CSO has served as such since 2021, and has over 20 years of experience in various roles in information security, including serving as an IT security leader at AT&T/Warner Media, where he implemented an extensive security program managing complex incident response events. He holds a degree in Information Technology.


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our IT services provider customers', or their SMB and mid-market customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our IT services provider customers', or their SMB and mid-market customers' systems, the exploitation of vulnerabilities in our, our IT services provider customers', or their SMB and mid-market customers' environments, the theft or misappropriation of our, our IT services provider customers', or their SMB and mid-market customers' proprietary and confidential information, and interference with our, our IT services provider customers', or their SMB and mid-market customers' operations, exposure to legal and other liabilities, higher customer and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CSO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: Risk Management and Strategy We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.

companyName: MeridianLink, Inc.


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program leverages recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.


text: We also strategically partner with third-party cybersecurity consultants, assessors, and auditors in evaluating and testing our cybersecurity risk management processes and controls. These strategic partnerships are catalysts for the continuous improvement of our cybersecurity risk management posture. Through audits, threat assessments, and collaborative brainstorming sessions on cybersecurity enhancements, these collaborative partnerships help us bridge knowledge gaps, identify best practices and refine our cybersecurity strategies and processes. Further, we leverage these partnerships to identify cybersecurity vulnerabilities and weaknesses and improve our cybersecurity posture.


text: As part of our cybersecurity risk management program, we maintain processes to proactively manage potential risks posed by third-party vendors. This involves conducting cybersecurity assessments before onboarding any vendor that may have access to our systems, applications, or data, followed by ongoing monitoring by our GRC team and periodic assessments to evaluate these onboarded vendors' compliance with our cybersecurity standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, see the risk factors in Item 1A- Risk Factors.


text: Our board of directors is aware of the importance of managing the evolving and complex cybersecurity threat landscape, and has established oversight measures designed to manage associated cybersecurity risks. The Cybersecurity Committee is a decision-making body formed by our board that is tasked with advising and assisting the Chief Information Security Officer, or CISO, on cybersecurity matters and integrating major cybersecurity initiatives into our broader strategy. The Cybersecurity Committee is composed of board members whose backgrounds collectively include experience in risk management, technology, and finance.


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience designing and building cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, energy/utilities, legal and managed security services. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy, leading to improvement efforts. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.


text: Risk Management and Strategy We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, systems, and sensitive data from the risks of cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program is informed by recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program in an effort to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience assessing and improving cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, critical infrastructure, legal, and federal, state, and local government. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.


text: Coupang has a cyber risk management framework designed to assess, identify, and manage cyber related risks. Cyber related risks are identified through audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.

companyName: Coupang, Inc.

ticker: CPNG


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into technology projects based on severity and priority. The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to assess whether the cyber strategy is integrated across the organization. The CISO receives reports on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISMS-P and ISO 27001. We also periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We also employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: The executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major technology enhancements and projects. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity risks continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, including but not limited to spyware, viruses, phishing, and other spam emails, denial of service attacks, data theft, computer intrusions, outages, and similar events, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.


text: Coupang has a cyber risk management framework designed to identify, assess, and manage cyber related risks. Cyber related risks are identified through self-identification, audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into information security and technology projects based on severity and priority.


text: The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to integrate the cyber strategy across the organization. The CISO is updated on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Supporting the CISO, is the dedicated information security team, which comprises almost 200 individuals. In addition to full-time employees, external consultancy services provide us with certain information security services and specialized advice.


text: We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISO 27001, 27017, 27701, and ISMS-P. We periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, customer or otherwise implicating the third-party technology and systems we use. We also have a program of Cyber Tabletop exercises, run periodically, with key people in our business, to further enhance our capabilities to respond and recover to a cyber incident.


text: The Coupang executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major information security and technology enhancements and projects. As of the date of this 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity threats continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity in today's digital landscape. We are committed to safeguarding our information systems and data assets. This enables us to maintain the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in overseeing our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity processes are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our risk management program, we actively work to identify, prevent and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: Risk Management and Strategy We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate associated threats, reduce risk, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip the employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity; leveraging firewalls; intrusion detection and prevention systems; endpoint anti-virus and anti-malware solutions; and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.


text: We engage in the periodic assessment and testing of our processes that are designed to address cybersecurity threats and incidents, including with respect to third-party vendors. The results of such assessments are reported to management and the Board. Adjustments to our cybersecurity processes are made as necessary.


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls, and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.


text: Our Vice President, Information Technology, in coordination with management, works to implement our program to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of our cybersecurity risk management program, we have assigned dedicated resources, including our Vice President, Information Technology, and members of his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management, the Audit Committee and the Board on a regular basis and as needed in response to specific incidents.


text: Our Vice President, Information Technology, has served in various roles in information technology and information security for over 20 years, the majority of which has involved leading IT transformation, cybersecurity and compliance programs at public companies. He holds an undergraduate degree in industrial engineering and an MBA and has attained multiple cybersecurity-related certifications including the Certified Information Systems Security Professional.


text: Risk Management and Strategy We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate threats, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip our employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity, leveraging firewalls, intrusion detection and prevention systems, endpoint anti-virus and anti-malware solutions, and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.


text: Through these processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls; and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees. The Board and the Audit Committee of the Board (the "Audit Committee") are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: Risk Management and Strategy We design and assess our program based on the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • The utilization of Microsoft 365 services for email, data storage, Identity Provider ("IdP") for Single Sign-On ("SSO"), and other technical controls such as remote user and device management; • Microsoft 365 configurations which are aligned with security and industrial standards, including automatic risk management mechanisms and alert notifications for our Information Technology ("IT") team; • A zero trust approach to cybersecurity focused on preventing and limiting damage in the event that a malicious actor gains access to our network and operating on the principle "never trust, always verify," continuously authenticating and authorizing users and devices that seek to obtain access to our systems and data; • Privileged access management protocols that require user access requests to receive formal, documented approvals with specific business justifications and, following receipt of such approvals, the provision of only the minimum access necessary for the approved purpose; • Regular monitoring of our Microsoft security score, which serves as a benchmark for our security posture and guides our continuous improvement efforts; • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, including annual external assessments and vulnerability scanning; • A security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Regular security awareness training sessions for users, including simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training; • A disaster recovery program, including business continuity procedures in the event of a disaster, backup procedures, failover features with up-to-date SaaS services, and data recovery protocols; and • A third-party risk management ("TPRM") process to safeguard against risks posed by service providers, suppliers and vendors, based on our assessment of their respective criticality to our operations and respective risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, and categorization of third parties based on risk levels.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We did not experience any material IT security incidents during the fiscal year. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our IT Systems, or those of our CROs, CMOs, other contractors, vendors, consultants or collaborators, may fail or suffer system failures, security breaches or deficiencies in cybersecurity, which could results in a material disruption of our product development programs, compromise sensitive information related to our business or trigger contractual and legal obligations.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks, and our IT team directly reports to the Audit Committee on a periodic basis. In addition, management is obligated to update the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal staff as part of the Board's continuing education on topics that impact public companies.


text: Our Director of Information Technology, who reports to our principal financial officer, leads the operational oversight of Company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess, manage, and help prepare us and our directors and employees to address, cybersecurity risks. Specific cybersecurity related responsibilities of the Director of Information Technology include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Director of Information Technology has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors has delegated to the Audit Committee to be actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are in the process of being fully integrated into our ERM program and are based on recognized frameworks and applicable industry standards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information systems that we use and the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vizio Holding Corp.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Steering Committee and the Audit Committee, and we evaluate potential adjustments to our cybersecurity policies, standards, processes and practices as reasonably necessary based on the information provided by these assessments, audits and reviews. We also provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Risk Management Steering Committee includes our Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President, Operations and Technical Support ("SVP-Ops"), Senior Vice President, Engineering ("SVP-Engineering") and Group Vice President, Information Technology ("GVP-IT") and other business unit representatives and subject matter experts, who regularly interact with our ERM function. The Risk Management Steering Committee works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents.


text: The Audit Committee, in coordination with the Risk Management Steering Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee and the Risk Management Steering Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Risk Management Steering Committee promptly receives information regarding cybersecurity incidents and elevates information to the Audit Committee about incidents when appropriate, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee also receives routine executive reports on cybersecurity risk management from the GC, SVP-Ops and GVP-IT. On an annual basis, the Board of Directors discusses our approach to cybersecurity risk management with a representative of the Risk Management Steering Committee.