text: The information security team is responsible for monitoring, managing, assessing and mitigating cybersecurity risks and threats on a day-to-day basis and is responsible for improving and strengthening our cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Financial Officer and a member of our Board who serves as the Board's primary contact on cybersecurity matters as a part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including to determine whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: The information security team undertakes or engages in these practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for testing cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data; and the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multi-factor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.

companyName: Simply Good Foods Co

ticker: SMPL

secItem: Item 1C


text: Use of Third Parties We have engaged, and intend to continue to engage, nationally recognized third parties to assist us in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: When risks or threats are identified to us by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: Effect of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material effect on our results of operations and financial condition. As described above under "Item 1A-Risk Factors - Any inadequacy, failure or interruption of our information technology systems may harm our ability to effectively operate our business, and our business is subject to online security risks, including security breaches and identity theft," a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial and/or reputational damage, in addition to litigation or remediation costs or penalties.


text: Governance Overview Our Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from our Chief Information Officer regarding our cybersecurity environment, cybersecurity risks and threats, cybersecurity projects we have implemented and plan to implement and other cybersecurity developments. The chair of the Audit Committee reports to the full Board after each meeting. In addition, our information security team regularly interacts and discusses cybersecurity matters with a member of the Board who serves as the Board's primary contact on cybersecurity matters as part of our company-wide risk management system. On a quarterly basis, the Board receives a Quarterly Enterprise Risk Assessment Update that typically includes content regarding Information Technology systems and cybersecurity.


text: Overview and Leadership Our enterprise risk management framework considers cybersecurity risk alongside other risks as part of our overall enterprise risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to evolve and maintain our cybersecurity program's maturity across the elements of NIST CSF.


text: Our information security program is focused on detecting, identifying, defending against and mitigating the effect of cybersecurity risks to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis regularly.


text: Our information security function and management team is led by our Chief Information Officer, who has approximately 26 years of experience in the information technology area and reports to our Chief Financial Officer and our Director of Infrastructure and Controls. Our Director of Infrastructure and Controls has approximately 20 years of experience in the information technology area.


text: We view cybersecurity as the prevention and timely detection and correction of any unauthorized occurrence or series of related unauthorized occurrences that are on or conducted through ADT's information systems and that jeopardizes the confidentiality, integrity, or availability of ADT's systems or any information residing therein. We believe that the safety, security, and privacy of our customers are fundamental to the services we provide. Our cybersecurity policies guide us as we strive to continuously enhance methods, best practices, and technologies to better monitor and protect customer data and inform and enable customers to make choices about their data privacy. We carefully consider data privacy when developing our own products and when incorporating products provided by our business partners.

companyName: ADT Inc.

ticker: ADT


text: Risk Management and Strategy As part of our Enterprise Risk Management program, ADT identifies, assesses, and develops risk mitigation plans for the company, including those relating to cybersecurity risks. The Company's Chief Information Security Officer ("CISO"), who is designated as a Certified Information Systems Security Professional ("CISSP"), is responsible for developing and implementing plans and strategies to mitigate these risks. The CISO also leads the Company's cybersecurity risk assessment, which includes security posture scoring, vulnerability assessments, process maturity, and tooling coverage. As part of this process, ADT uses the following tools and procedures: • utilizing "SecurityScorecard" (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology ("IT") risk management), which provides an independent external enterprise view of ADT's security posture with a focus on publicly exposed systems; • assessing, and continuously developing and executing on our preventative and detective controls aligned with the National Institute of Standards and Technology ("NIST") cybersecurity framework, including an annual audit of these internal controls; • conducting third-party penetration testing; • performing attack and breach simulations; and • working with our cybersecurity vendors to ensure tooling and processes are fully adopted to provide the highest levels of protection.


text: Cybersecurity Management Team and Board Oversight ADT's Board of Directors, through its Audit Committee, has primary responsibility for overseeing cybersecurity risk management and receives at least annual updates on the status of ADT's cybersecurity program from our CISO. This update is provided in a special Audit Committee session and includes reports on ADT's security posture and SecurityScorecard assessment (rating and benchmarking), incident response, and vulnerability management. The Audit Committee reviews and discusses with management the Company's cybersecurity threats, vulnerabilities, defenses, and planned responses. Additionally, the Audit Committee will receive and discuss reports from management with the purpose of identifying threats and vulnerabilities, and it will monitor the effectiveness and progress of the actions and initiatives undertaken to mitigate such threats. ADT's Cybersecurity Incident Response Plan has been approved by the Audit Committee. In addition, the Audit Committee participates in ADT's annual Cybersecurity Incident Tabletop exercises and event simulations.


text: Our cybersecurity management governance structure is led by a CISO (reporting into the Chief Information Officer) with the support of an established Information Security ("InfoSec") function that is responsible for maintaining and monitoring ADT's cybersecurity infrastructure. ADT also has a Data Privacy Officer (reporting into the Chief Legal Officer) whose role is to ensure ADT's processes and protections over sensitive data comply with applicable data protection rules and regulations. In addition to the activities described above under "Risk Management and Strategy," we have a cybersecurity council (composed of ADT management with expertise in IT security, compliance, and communications) that meets quarterly to review and discuss compliance, cybersecurity risk, and preventive programs.


text: ADT also conducts privacy impact assessments and empowers its employees to effectuate these privacy considerations on an ongoing basis. All ADT team members are required to complete and acknowledge annual training to raise awareness of current security risks and behavior and around our Information Security and Privacy policies. Additional education and training are also required for specific groups based on their roles within the organization.


text: Incident Response and Assessment Policies and Procedures ADT aligns with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we have a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan outlines communication responsibilities during incidents of all severity levels.


text: If a materiality assessment is required, the CISO will report such incident to the Chief Legal Officer who will then determine in consultation with other persons as appropriate, without unreasonable delay, whether the incident is material to the Company. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, on an individual basis and in the aggregate for multiple and/or a series of incidents. While ADT has not experienced a material direct data breach within its infrastructure, a material breach would likely be the result of external and/or internal threats and vulnerabilities to data, systems, websites, and/or products, including ransomware threats, email fraud, phishing attacks, data breaches, and customer product compromises including the theft of data and/or funds.


text: For additional information regarding how cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors—":


text: •"—Delays, costs, and disruptions that result from upgrading, integrating, and maintaining the security of our information and technology networks and systems could materially adversely affect us"


text: •"—If we do not effectively implement our plans to migrate our technology infrastructure to the cloud, we could experience significant disruptions in our operations, which could have a material adverse effect on our results of operations and financial condition"


text: •"—Cybersecurity breaches or threats or other unauthorized access or attempts to access to our systems could compromise the security of our systems and otherwise disrupt our normal operations which could have a material adverse effect on our business, results of operations and financial condition," and •"—Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology breaches, data security breaches, product liability, errors and omissions, and marketing compliance".


text: We view cybersecurity as the prevention and timely detection and correction of any unauthorized occurrence or series of related unauthorized occurrences that are on or conducted through our information systems and that jeopardizes the confidentiality, integrity, or availability of our systems or any information residing therein. We believe that the safety, security, and privacy of our customers and employees are fundamental to the services we provide. Our cybersecurity policies guide us as we strive to continuously enhance methods, best practices, and technologies to better monitor and protect customer data and inform and enable customers to make choices about their data privacy. We carefully consider data privacy when developing our own products and when incorporating products provided by our business partners.


text: Risk Management and Strategy We identify, assess, and manage cybersecurity risk as part of our company-wide enterprise risk management program. Our Chief Information Security Officer ("CISO"), Tim Rains, has more than 30 years of experience as an IT professional, with over 20 of those years spent in cybersecurity roles. Mr. Rains has held senior cybersecurity advisor roles at both Amazon Web Services and Microsoft. Mr. Rains has experience across multiple cybersecurity disciplines including vulnerability management, incident response, crisis communications, threat intelligence, cybersecurity architecture and operations, governance, risk, and compliance. Mr. Rains is designated as a Certified Information Systems Security Professional and is responsible for developing and implementing plans and strategies to mitigate cybersecurity risks. Our CISO also leads our cybersecurity risk assessment, which includes security posture scoring, vulnerability assessments, process maturity, and tooling coverage. We log cybersecurity risks into our cybersecurity risk register and track such risks for treatment. Management then discusses these cybersecurity risks for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third-party security experts as needed for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements, as appropriate.


text: As part of this process, we use the following tools and procedures: • utilizing "SecurityScorecard" (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology risk management), which provides an independent external enterprise view of our security posture with a focus on public-facing systems; • assessing, regularly developing, and executing on our preventative and detective controls, which we seek to align with current standards and best practices, including the incorporation of recommendations published by the National Institute of Standards and Technology in its cybersecurity framework, such as an annual audit of these internal controls; • performing attack and breach simulations; and • working with our cybersecurity vendors to adopt tooling and processes to provide high levels of protection.


text: Cybersecurity Management and Board Oversight Our Board of Directors, through its Audit Committee, has primary responsibility for overseeing cybersecurity risk management and receives updates on the status of our cybersecurity program from our CISO. These updates are provided at least once per year, and often multiple times per year, in a special Audit Committee session and includes reports on our security posture and SecurityScorecard assessment (rating and benchmarking), incident response, and vulnerability management. The Audit Committee reviews and discusses with management our cybersecurity threats, vulnerabilities, defenses, and planned responses, including updates to our cybersecurity incident response plan ("IRP"), which has been approved by the Audit Committee. Additionally, the Audit Committee receives and discusses reports from management with the purpose of identifying threats and vulnerabilities, and it monitors the effectiveness and progress of the actions and initiatives undertaken to mitigate such threats.


text: Our cybersecurity program team is led by our CISO (who ultimately reports to the Chief Operating Officer). The cybersecurity leadership team ("CSLT"), which is chaired by our Chief Operating Officer and includes our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, CISO, and Chief Privacy Officer, among others, collaborates with enterprise risk professionals and is supported by an established Information Security ("InfoSec") function responsible for certain aspects of maintaining and monitoring our cybersecurity infrastructure. In addition, our Chief Privacy Officer, who reports to our Chief Legal Officer, manages processes and protections around our sensitive data and facilitates compliance with applicable data protection laws, rules, and regulations.


text: Our Chief Privacy Officer has over 20 years of experience overseeing corporate data privacy and intellectual property policies and procedures. To maintain high levels of awareness and aptitude, all of our employees are required to complete annual trainings regarding current security risks and our InfoSec and privacy policies. Additional education and training are also required for specific groups based on their roles and access within the organization.


text: Incident Response Plan and Cybersecurity Incident Materiality Assessment Policy We seek to align with industry-standard cybersecurity frameworks designed to protect our information systems and both Company and customer data from unintentional disclosure, cybersecurity incidents, events, and other threats of varying severity levels. As part of our alignment efforts with these frameworks, we maintain the IRP, which outlines the actions to be taken after identifying an incident that affects or could potentially affect our information systems and the people responsible for managing and overseeing those actions.


text: Under the IRP, cybersecurity incidents are generally addressed by our Cybersecurity Incident Response Team ("CSIRT"), consisting of our CISO, deputy CISO, director of security operations, senior manager of incident response, and members of the security operations team. Incidents of higher severity are elevated to the CSLT. Under the IRP, if an incident requires the involvement of the CSLT, the CSIRT will regularly update the CSLT on the status of the incident response process. Members of the CSLT primarily, the Chief Operating Officer and CISO, will be responsible for updating the Chief Executive Officer, Audit Committee, and the lead independent director of our Board of Directors. Members of the CSIRT and CSLT, along with the Chief Executive Officer, Audit Committee, and the lead independent director of our Board of Directors regularly participate in cybersecurity incident tabletop exercises and event simulations.


text: If a materiality assessment is required, an assessment committee consisting of the Chief Financial Officer, Chief Operating Officer, Chief Legal Officer, CISO, and Chief Accounting Officer (and/or their designee) (collectively, the "Assessment Committee") will consult with the CSIRT and CSLT, as appropriate. The Assessment Committee is responsible for assessing, without unreasonable delay, the materiality of cybersecurity incidents reported to it, determining materiality and any necessary disclosures, and informing our disclosure committee of such determinations. In assessing materiality, the Assessment Committee will consult with internal and external advisors, as appropriate, and evaluate quantitative and qualitative factors to assess the impact and/or reasonably likely impacts of the cybersecurity incident.


text: •"—Delays, costs, and disruptions that result from upgrading, integrating, and maintaining the security of our information and technology networks and systems could materially adversely affect us,"


text: •"—If we do not effectively implement our plans to migrate our technology infrastructure to the cloud, we could experience significant disruptions in our operations, which could have a material adverse effect on our results of operations and financial condition,"


text: •"—Cybersecurity attacks or threats or other unauthorized access or attempts to access to our systems, or those of third parties, have in the past, and may in the future, compromise the security of our systems and otherwise disrupt our normal operations, which could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows," and •"—Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology and data security breaches, product liability, errors and omissions, and compliance with applicable laws and regulations."


text: Cybersecurity Risk Management and Strategy The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats. This program scores, ranks, and reports risks to Company management based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools. We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders. We regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of both internal and external resources.


text: The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers. This process includes, as appropriate, conducting assessments of third-party providers' cybersecurity capabilities and reviewing third party providers' processes for alignment with our internal cybersecurity requirements.


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, risks from cybersecurity threats. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board.


text: Management is responsible for the day-to-day management of risks we face, while our Board of Directors (Board), as a whole and through its committees, provides guidance on the oversight of risk management.


text: The Audit Committee reviews the effectiveness of the Company's governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management. The Audit Committee, at least annually, reviews and considers the results of our ERM process, including as it relates to risks from cybersecurity threats, and provides updates, as appropriate or required, to management and the Board.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our designed outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • a cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to "Risk Factors – Risks Related to our Company and Structure – Operational risks, including the risk of cyberattacks, may disrupt our business, resulting in loss or limited growth" in Item 1A of this Annual Report on Form 10-K for an additional description of our cybersecurity risk and the potential related impacts.


text: Governance Pursuant to its charter, the Audit Committee of our board of directors oversees our risk management program, which focuses on the most significant risks we face, including cybersecurity risks. Audit Committee meetings include discussions of specific risk areas, and our Chief Compliance Officer, or our CCO, regularly reports to the Audit Committee on cybersecurity risks we face, as well as the status of measures undertaken by the Company to manage those risks. Pursuant to our Incident Response Plan, the chair of the Audit Committee will be notified in the event of a cybersecurity incident meeting a specified severity level. In addition, all members of our board of directors, including members of the Audit Committee, participate in quarterly training on cybersecurity threats, including those facing the Company.


text: Our CCO and our Chief Financial Officer, or our CFO, work collaboratively with senior members of our outsourced technology firm to comprise our Cybersecurity Team. Our Cybersecurity Team has primary responsibility for overseeing, implementing and managing our processes and controls to assess, identify and manage material risks from cybersecurity threats, including those described above in Risk Management and Strategy.


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. Our Incident Response Team includes our Cybersecurity Team and our Chief Executive Officer, along with other Company personnel as appropriate based on the nature of the incident.


text: The members of our Cybersecurity Team have various levels of experience in information technology and cybersecurity matters. Our third-party technology firm is a global information technology and cybersecurity provider with a seasoned executive team possessing decades of experience and various cybersecurity certifications, such as Certified Information Systems Security Professional certification. Our CCO and CFO each has extensive experience managing risks at the Company, including risks arising from cybersecurity threats. Our CCO also holds a CERT Certificate in Cybersecurity Oversight issued from the CERT Division of the Software Engineering Institute at Carnegie Mellon University and the National Association of Corporate Directors.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • an Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. It includes our Cybersecurity Team, our Chief Executive Officer and other Company personnel as appropriate based on the nature of the incident.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Funko, Inc.

ticker: FNKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We perform an annual assessment to measure the maturity of our information security program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any specific technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to implement controls to combat and respond to cybersecurity risks.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A: Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of overall risk assessment and management, which includes cybersecurity and other information technology risks.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management and senior IT team, including our Interim Chief Executive Officer, Chief Financial Officer and Operating Officer, Chief Legal Officer, Sr. Director, IT Infrastructure and Operations, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team's experience includes over 40 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management and senior IT team, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Global Head of Technology, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global Head of Technology's experience includes over 20 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.


text: Risk Assessment and Management We have become increasingly dependent upon digital technologies, including information systems, infrastructure and cloud applications and services, to operate our businesses, process and record financial and operating data, communicate with our employees and business partners, analyze seismic and drilling information, estimate quantities of met coal reserves, as well as other activities related to our businesses. We own and operate some of these systems and applications while others are owned and operated by third-party service providers.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. This program, along with a robust information technology internal controls framework, helps to ensure the confidentiality, integrity and availability of our information systems. The program includes elements for identifying, assessing and managing material risks from cybersecurity threats. Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology Cybersecurity Framework.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. At least annually we conduct a third-party risk assessment to identify cybersecurity risks associated with third-party vendors and service providers. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity and vulnerability, considering both quantitative and qualitative factors. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical and physical controls and employee training, education and awareness initiatives.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. Our Information Systems and Technology Department (the "IT Department") monitors security alerts or indicators and initiates triage, verification and remediation actions when needed. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: In the event of a significant cybersecurity incident, we establish an incident response team that works in conjunction with the IT Department to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification and call center services and credit and identity monitoring if required.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed in an effort to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge and regulations change.


text: We separately operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: Incident Response We maintain an incident response policy and program focused upon detecting, managing, documenting and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we appoint a dedicated incident team, including a team leader, responsible for managing and coordinating incident response efforts. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. At least annually we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. Additionally, we employ a number of third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective and responsive measures. For additional discussion of our cybersecurity related risks, see "Item 1.A Risk Factors."


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: The Audit Committee. The Audit Committee reviews with our management team, including our Senior Vice President – Information Systems and Technology, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: In addition, we operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members who all have 12 to 26 years of professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: At Cannae, the board of directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. Senior leadership, including our Chief Information Security Officer ("CISO"), works diligently to identify, assess and manage material risks through our Enterprise Risk Management ("ERM") program. As part of that program, we conduct risk assessments to identify and assess our material business, operational and environmental risks and works with our management team to develop strategies and plans to mitigate and manage those risks, including cybersecurity risks related to the use of third-party service providers.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: Our ERM program is overseen by a group of proficient individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.


text: On an ongoing basis, management assesses the cybersecurity risks of Cannae and aligns its procedures and its audit plan with the identified and addressable risks. The underlying controls of the cyber risk management program are based on the recognized standards as outlined in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We utilize a third party to manage our IT network and processes and our ERM personnel work directly with the provider on all aspects of the Company's IT infrastructure and cybersecurity risks. Risks are evaluated over various timeframes; however, the focus of management's risk assessment is on risks to the long-term solvency and sustainability of the ongoing operations of Cannae. Risks with the potential for an adverse impact to the Company in the near term are prioritized to the extent they present a material risk to the financial viability of the Company.


text: We apply a comprehensive approach to the mitigation of identified security risks, including monitoring our third-party IT service provider and management of our unconsolidated affiliates. As a holding company with relatively low volumes of personnel and third-party data, we have established policies, procedures and controls, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of IT risk monitoring and risk mitigation techniques tailored to the unique nature of our business, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and business continuity management.


text: In the event of a cybersecurity incident, we have established protocols for management's response to incidents and we regularly test those protocols with appropriate management personnel. Such protocols include an incident response playbook with the assessment of cybersecurity risks and procedures and hierarchies for escalating and reporting incidents to executive management, the board of directors, investors, government agencies and the general public.


text: The employees at our consolidated companies are the strongest assets in protecting information and mitigating risk. We monitor the security practices of our employees, including training programs that focus on applicable privacy, security, legal, and regulatory requirements that provide ongoing enhancement of their respective security and risk cultures. Our employees participate in an annual Information Security Training.


text: The Board administers its risk oversight function directly and through committees and our Board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy are overseen by the audit committee. At each regular meeting of the audit committee of our Board, management provides reports relating to existing and emerging risk at our companies, including, as appropriate, cyber and data security risks, and any security incidents. At least annually (or more frequently in the event of material changes to the Company) the update to the audit committee includes a summary of management's complete reassessment of the Company's risk and control environment identified through our ERM program. Our audit committee chairman reports on these discussions to our Board on a quarterly basis.


text: See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity and IT.


text: Our ERM program is overseen by a group of highly-qualified individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology, cybersecurity and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.


text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our Audit Committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.

companyName: Angi Inc.

ticker: ANGI


text: Cybersecurity Risk Management and Strategy Overview. Our cybersecurity programs and related processes generally consist of the following key elements: (i) risk assessment and management efforts, (ii) technical safeguards and incident response and recovery efforts, (iii) third-party risk management efforts, (iv) education, training and preparedness efforts and (v) governance efforts.


text: Risk assessment and management efforts. We assess, identify and manage cybersecurity risks as part of a comprehensive information security program that is intended to align with standard industry frameworks, such as International Standard for Organization (ISO) 27000 and the National Institute of Standards and Technology (NIST) Cyber Security Framework.


text: As part of the ongoing refinement of our information security program, we engage (as appropriate) various third-party risk management services to assist with the identification of potential cybersecurity issues, such as those involving software vulnerabilities, configuration errors, data exposure and credential theft (among others), as well as consult with external legal counsel, third-party experts and other advisors to assist with incident response and recovery efforts, forensic investigations, extortion negotiations and crisis management or readiness for the same. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur.


text: In addition, as discussed in more detail below under the caption "Cybersecurity Governance," the assessment, identification and management of cybersecurity risks have been integrated into our overall enterprise risk management ("ERM") efforts.


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks. In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically participate in tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.


text: Cybersecurity Governance Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our Audit Committee, which pursuant to its charter, assists the Board with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our Audit Committee at least semi-annually and with our board of directors at least annually.


text: Our Chief Technology Officer ("CTO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CTO has over twenty years of experience leading the development, implementation, and oversight of information security programs. Other members of our information security team are generally seasoned professionals with broad cybersecurity experience and expertise, including with respect to cybersecurity threat assessment and detection, mitigation technologies, incident response, and training on such topics.


text: Our CTO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the Audit Committee on a quarterly basis. In addition, our CTO reports cybersecurity matters to Company senior management and the Audit Committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our Audit Committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Our CTO promptly informs Company management and our Audit Committee (and IAC management) of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding any such incidents until they have been resolved.


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time. While to our knowledge we have not, to date, experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party service provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity Program Our cybersecurity and information technology ("IT") program includes a number of safeguards, such as network segmentation, conditional analysis, external threat monitoring, access and authentication controls, incident response planning and testing of controls and procedures. We assess for internal and external vulnerabilities through the use of quarterly vulnerability scanning, annual third-party penetration testing and periodic cybersecurity maturity assessments. The results from these assessments are comprehensively addressed based on risk priority and are used to continually improve our cybersecurity risk posture.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors and annual due diligence with respect to key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.


text: Our employees receive regular cybersecurity training to address a broad range of key and emerging issues. In addition, we provide additional periodic training modules to address emerging threats or trends within the cybersecurity environment, perform regular simulated phishing exercises and require comprehensive cybersecurity training for all new employees.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and reports to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.


text: The CISO and his related team perform regular assessments and vulnerability tests and work with other third-party service providers to perform penetration testing and periodic cyber maturity assessments on our behalf through our Enterprise Risk Management ("ERM") framework. Our CISO and related team work with our VPAA and third-party managed service provider to manage IT troubleshooting and user experience. Additionally, along with our own relationships, we benefit from the extensive third-party service provider relationships of our CISO, which may be used to assist with cybersecurity containment and remediation efforts.


text: We perform specific cybersecurity risk assessments, which are informed by our ongoing vulnerability assessments, external penetration testing and cybersecurity maturity assessments, among other items. Additionally, cybersecurity and IT is also an element of the ERM assessment performed by management on an annual basis, with quarterly reassessments, under the supervision of the Audit Committee and Board of Directors.


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response programs specifically designed for common threats. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our Enterprise Risk Management framework, including oversight over our cybersecurity and information technology policies and programs.


text: The CISO and VPAA meet with our IT Executive Committee, comprised of all of our executive officers, on at least a quarterly basis to oversee our cybersecurity and IT framework and more frequently in the event of significant cybersecurity developments. Our management team, including our CISO, updates the Audit Committee and Board of Directors at least twice a year with respect to key developments and updates relating to our cybersecurity and IT infrastructure and the overall threat environment, including recent and emerging trends. With respect to any significant cybersecurity events or incidents, the VPAA, along with the IT Executive Committee, reports to the Board of Directors promptly in accordance with our escalation protocols, as appropriate, depending on the nature of the events.


text: Cybersecurity Risks To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors."


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and report to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response playbooks specifically designed to address our areas of higher risk. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We also maintain cybersecurity insurance coverage; for more information regarding cybersecurity insurance, see " Item 1A. Risk Factors ".


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our ERM framework, including oversight over our cybersecurity and information technology policies and programs.


text: Cybersecurity Risks To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors ".


text: Cybersecurity Risks We rely on information technology systems and networks to process, transmit, and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers, and employees. We use various information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information, and personal information of our customers, suppliers, and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: urban-gro, Inc.

ticker: UGRO


text: Despite our security measures, our information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyberattacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position, and additional costs to remediate the issue.


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including employee training, monitoring of our systems and networks, maintenance of backup and protective systems, and use of modern endpoint detection and response tools which are integrated into urban-gro's risk management systems and processes. We also operate in a fully cloud-based environment, which enhances our scalability, flexibility, and resilience and utilize 3rd parties to perform early internal and external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection, and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.


text: Cybersecurity Leadership Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors receives quarterly updates on our cybersecurity posture, threats, and incidents from our Senior Vice President of Technology. Our Board of Directors also delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls, and audit results. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Senior Vice President of Technology, who has over 20 years of experience in the field of cybersecurity. He is responsible for developing and implementing our cybersecurity strategy, policies, standards, and practices. He also oversees our cybersecurity team, which includes a staff member who recently completed his master's degree in cybersecurity. Our cybersecurity team monitors, detects, responds, and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.


text: urban-gro adheres to the NIST Cybersecurity Framework 2.0, which provides a set of standards, guidelines, and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities, and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted over 12 internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy, and our password policy. We regularly conduct phishing simulations, vulnerability scans, penetration tests, and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. We have experienced, and may continue to experience, cybersecurity incidents that could have a material adverse effect on our business, financial condition, results of operations, and prospects. For example, in 2019, we were a victim of a wire fraud scheme, in which a fraudulent party compromised the email account of one of our employees and sent a fraudulent wire transfer request to our bank. We believe the bank did not follow its verification procedures and executed the wire transfer without our authorization. Please see Legal Proceedings section for more information. After this incident, we implemented multi-factor authentication (MFA) across all our systems and email accounts, to prevent unauthorized access and impersonation. We also enhanced our internal controls and training to prevent and detect wire fraud and other cyber risks.


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend considerable resources on cybersecurity risk management, strategy, and governance.

companyName: Elastic N.V.

ticker: ESTC


text: Risk Management and Strategy We integrate our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats into our enterprise risk management program based on recognized frameworks and applicable standards. Our cybersecurity program encompasses the key elements described below:


text: Collaboration. We employ a cross-functional, risk-based approach to identify and address anticipated and real-time threats to our cybersecurity. Our internal security, risk, and compliance personnel meet regularly to develop strategies for preserving the confidentiality, integrity and availability of corporate, customer, and other third-party information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents, if applicable, can be made in a timely manner.


text: Risk Assessment. At least annually, we conduct a cybersecurity risk assessment that takes into account information from our internal security, risk, and compliance functions, known information security vulnerabilities, and information from external sources, including reported security incidents that have affected other companies, industry trends, and evaluations by third parties and consultants. We also conduct risk-based cybersecurity tabletop exercises periodically to test our internal readiness and response planning.


text: Incident Response and Recovery Planning. Our cybersecurity program includes a dedicated cybersecurity function led by our Chief Information Security Officer ("CISO"). As part of our cybersecurity function, our Distributed Security Incident Response Team ("DSRT") administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The DSRT provides threat intelligence information from internal and external resources to our CISO, broader security and resiliency organization, and relevant business units and functional areas as one source within our risk assessment process. Our cybersecurity function partners closely with our Data Privacy organization, led by the Business Integrity Officer, and others within the Legal organization to ensure prompt response on data breach and any other regulatory notification requirements. We have incident response and recovery plans that we test and evaluate for effectiveness in accordance with industry standards.


text: Third-Party Risk Management. We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of certain third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in the risk assessments, including information supplied by providers and third parties. In addition, we require these providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers.


text: External Assessments. Our cybersecurity program is regularly assessed by consultants and third-party auditors. These assessments include information security maturity evaluations, audits, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, our board of directors, and our Audit Committee. We adjust our cybersecurity processes based on these results. We have obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us. Information about such certifications can be found on our website.


text: Board Oversight. Our board of directors oversees the Company's risk management process. It has delegated to our Audit Committee the primary responsibility for executing oversight of our cybersecurity risk management processes. In performing this role, the Audit Committee receives regular reports from our CISO and other members of management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. The Audit Committee also considers regular updates from management on our cybersecurity risk profile based on risk assessments, progress of risk reduction initiatives, third-party auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The Audit Committee reports quarterly to our board of directors regarding the Audit Committee's activities in overseeing cybersecurity risk management.


text: Management's Role. Our cybersecurity program efforts are directed by our CISO who, with the support of the chief operating officer, the chief product officer, and the chief legal officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 27 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.


text: Although our "Risk Factors" section in this report presents information about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. Notwithstanding our investment in cybersecurity, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition. Although we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. For a discussion of cybersecurity risks affecting our business, see "Item 1A—Risk Factors—Risks Related to our Business and Industry—If we experience a security incident, or unauthorized access to or other unauthorized processing of confidential information, including personal data, otherwise occurs, our software may be perceived as not being secure, customers may reduce the use of or stop using our products, and we may incur significant liabilities."


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend corresponding resources on cybersecurity risk management, strategy, and governance.


text: Management's Role. Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 28 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Ecovyst Inc.

ticker: ECVT


text: Our cybersecurity program is managed by the Cyber Incident Response Team (the "CIRT"), which is led by the Global IT Director, System Infrastructure Manager and the Network Infrastructure Manager, each with over 20 years of experience in IT. The CIRT serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The CIRT is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The CIRT classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.


text: In the event of a potential cybersecurity incident, the CIRT will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The CIRT will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from information technology, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.


text: On a quarterly basis, our employees, contractors, and other users of the Company's systems and networks are required to take cybersecurity training. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. These trainings are administered through a collaboration with third-party services and systems and address various topics, including how to handle sensitive and personal information, physical security of intellectual property, how to identify phishing attempts, reducing our risk to being phished and how to improve cybersecurity intelligence while working from home.


text: As of December 31, 2023, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for Ecovyst's management and Board of Directors. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the CIRT, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.


text: The CIRT meets with the CEO and other members of our senior management on a quarterly basis and meets with the Audit Committee at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.