text: Our Chief Privacy Officer and Data Protection Officers oversee our focus on the proper processing of personal information in alignment with our privacy policy and applicable privacy laws and regulations.


text: The Audit Committees are responsible for oversight of our risk management with respect to information technology operations and cybersecurity while the Compliance Committees oversee risk management in the area of data privacy and the HESS Committees oversee risk management related to our maritime operational technologies. The Audit Committees receive updates from the CISO on our information technology operations, including cybersecurity developments and risks, three times a year, and our Board of Directors receive updates from the CISO on an annual basis.

companyName: CARNIVAL PLC

ticker: CUK

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: FASTENAL CO

ticker: FAST


text: Our information technology (IT) security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes: • Enterprise security framework and cyber security standards; • Cyber security awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our IT security department maintains a playbook to respond to potential cybersecurity threats. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. Any identified risks are included in our overall risk management program, and internal and external auditors validate our IT controls on a regular basis.


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to all of our employees, which is tracked and recorded throughout the year. Results and progress are shared with Executive Leadership, the Audit Committee, and the Board. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training.


text: We have implemented an IT vendor risk management policy that provides guidance in managing risks associated with IT vendors and business partners. We have also established a third-party risk management program and conduct pre-onboarding security assessments and annual re-assessments of our service providers to collect, track, and manage third-party security controls based upon the risk presented to the business. Any issues identified during assessment are tracked through to remediation.


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, Information Technology, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and Enterprise Risk Management teams.


text: We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. The Information Security Risk Council, Executive Leadership, the Audit Committee, and the Board are notified of any material cybersecurity incidents through an established escalation process. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 28 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: Cybersecurity Risk Management and Strategy We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission.


text: Our IT security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our ISMS to support and promote resilient programs. This includes: • Enterprise security framework and cybersecurity standards; • Cybersecurity awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our Board and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, IT, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and ERM teams.


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 29 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, and the use of artificial intelligence by threat actors engaged in these activities, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. For additional information regarding cybersecurity threats, see 'Item 1A. Risk Factors' of this Form 10-K.


text: Risk Management and Strategy Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Enterprise Risk Management. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our Enterprise Risk Management ("ERM") program. Our ERM program, which is coordinated through our Enterprise Risk and Internal Audit function ("ERAS team"), includes the identification of risks relevant to Teradata's business, including material risks from cybersecurity threats; assigning personnel responsible for such risks; the development of strategies and plans to monitor, assess, and mitigate such risks; and oversight of the identified risks through regular reporting and risk evaluations with management, our Board, and/or relevant Board committee. Our ERAS team works closely with the Information Security function, including our Chief Information Security Officer ("CISO"), in the cybersecurity risk management process that informs the ERM program.


text: Cybersecurity Processes. The processes in place for managing cybersecurity threats, including threats associated with our use of third-party service providers, include identifying potential cybersecurity threats; defining the roles and responsibilities of our personnel pursuant to our Cybersecurity Incident Response Plan ("CIRP"); continuous testing and training of our employees on cybersecurity risks and security hygiene; communication and escalation protocols; and tools and technologies for incident detection and responses. We continuously assess risks and changes in the cybersecurity environment and adjust our processes and cybersecurity investments as appropriate.


text: • Our information security processes are built upon a foundation of advanced security technology, a trained team of security experts, and operations based on various global practices, standards, and frameworks, including the International Organization for Standardization, International Electrotechnical Commission, and National Institute of Standards and Technology Cybersecurity Framework. • We maintain policies, procedures, and controls that are designed to identify, protect, detect, respond to, and recover from information security and cybersecurity threats and incidents. Such items are reviewed, approved, and maintained by our CISO on an ongoing basis. In addition, we engage external advisors periodically to review and assess our policies, procedures, and controls. • Our CIRP provides a documented framework for handling cybersecurity incidents. The CIRP addresses cybersecurity incident detection, containment, analysis, eradication, recovery, escalation protocols, and coordination across multiple functions of the organization. • We have processes to manage cybersecurity risks associated with third-party service providers. Such providers are subject to information security assessments at the time of onboarding and at certain other times during their engagement with us. We require our providers to meet appropriate security requirements, controls, and responsibilities and comply with certain cybersecurity and data security standards that we have. We monitor compliance with these standards and investigate security incidents to take appropriate actions as necessary. However, despite the controls that we have in place, we also rely on our third-parties to implement security programs and we cannot ensure in all circumstances that their efforts will be successful. • We maintain an annual cybersecurity training plan including employee training on cybersecurity risks, requirements, and incident reporting. As part of our training plan, we regularly perform phishing tests of our employees. In addition, our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices. On an annual basis, our employees must complete cybersecurity awareness training. • We perform simulations and drills to review and test our information security program, including tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. • We maintain insurance to provide coverage for certain losses from cybersecurity threats and incidents. • We have developed business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and the loss of data and services from the effects of natural or man-made disasters to Teradata systems.


text: Cybersecurity Incidents. To protect our information systems from cybersecurity incidents and threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding materiality of the incident and any necessary public disclosure and reporting of such incidents can be made in a timely manner. In the last three fiscal years, we have not experienced any material cybersecurity incident and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted our results of operations and financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.


text: Cybersecurity Risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. See "Risk Factors — A cybersecurity incident, disruption, or failure of our information systems or those of our third-party providers could adversely impact our reputation, business, and financial results."


text: Board Oversight of Cybersecurity Risk. Our Board's role is to engage in informed oversight of enterprise-wide risks as managed through our ERM program, including cybersecurity. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee.


text: The Audit Committee is responsible for reviewing the adequacy and effectiveness of the Company's information security policies, the internal controls regarding information security and cybersecurity, and risks related to such exposures and actions taken to monitor and/or mitigate such risks. The Audit Committee receives quarterly reports as part of its meeting materials prepared by our CISO regarding the assessment of the status, adequacy, and effectiveness of our processes related to assessing, identifying, and managing cybersecurity risks and related mitigation plans. In addition, at least twice per year, the Audit Committee meeting agenda includes a presentation by the CISO to review and discuss the CISO's report on cybersecurity risks, mitigation plans and the steps the security team has taken to monitor and control related exposures. The Audit Committee reports to the Board on cybersecurity matters discussed at its meetings and the CISO's quarterly reports are provided to the Board as part of their meeting materials for their information as well.


text: Executive Oversight of Cybersecurity. Management is responsible for the Company's planning, identification, assessment, and mitigation of risks from cybersecurity threats. Our CISO, Chief Legal Officer, and Chief Financial Officer comprise our Core Cybersecurity Management Team (the "CCMT"). The CCMT has oversight of Teradata's CIRP and is informed and consulted on the response and resolution process for cybersecurity incidents. The CCMT is responsible for determining communications to inform relevant stakeholders of cybersecurity incidents as applicable, relevant, and/or required, including the Board; Audit Committee; the executive leadership team; investors; customers; employees; law enforcement; and regulators.


text: Depending on the nature and/or severity of the incident, additional stakeholders within the broader enterprise-wide management team may be included in the assessment, response, and resolution of an incident by the CCMT. The broader management team for this purpose may include, but is not limited to, executive and senior leaders in our Product, Customer, People, Information Technology, and Law functions, as well as others that may be considered necessary (collectively referred to as the "ECMT"). The ECMT provides oversight, perspective, and support from their respective areas of expertise to assist in analyzing the cybersecurity incident, materiality of the incident, and remediation considerations.


text: CISO and Cybersecurity Team. Our Information Security function is led by our CISO and is responsible for executing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: • The Information Security function consists of qualified professionals in cybersecurity. This team sets the cybersecurity strategy for Teradata; develops Teradata's cybersecurity architecture and deploys and manages tools and technologies aligned with such architecture to safeguard our information systems; manages the cybersecurity training required of our employees; monitors our cybersecurity threats and incidents; escalates the occurrence of cybersecurity incidents pursuant to the CIRP; and addresses and incorporates mitigation items. • The CISO appoints a Cybersecurity Incident Response Coordinator ("CIRC") to lead the management of cybersecurity incidents. The primary responsibilities of the CIRC include, but are not limited to: receiving and tracking all reported potential cybersecurity threats; escalating incident response;


text: determining relevant stakeholders of the Information Technology function and cybersecurity incident response team, which team is selected by CIRC to serve as the lead function for investigating and coordinating cybersecurity incidents;


text: alerting the applicable support functions of the potential cybersecurity threat and any defensive action that would be required; and alerting management, as applicable and necessary, of the potential cybersecurity threat. • Members of our Information Security function have broad ranges of qualifications and experience in information technology and security.


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO has a Bachelor of Science in Information Technology and an MBA.


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional ("CISSP") for general security practices, Certified Ethical Hacker ("CEH") for penetration testing capabilities, Certified Information Systems Auditor ("CISA") for information systems auditing, Certified Information Security Manager ("CISM") for overseeing enterprise security, Certified Risk and Information Systems Control ("CRISC") for risk management, and Certified Cloud Security Professional ("CCSP") for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO was also a founding member of the U.S. Department of Homeland Security and is a veteran who served in the United States Marine Corps. Our CISO has a Bachelor of Science in Information Technology and an MBA.


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional for general security practices, Certified Ethical Hacker for penetration testing capabilities, Certified Information Systems Auditor for information systems auditing, Certified Information Security Manager for overseeing enterprise security, Certified Risk and Information Systems Control for risk management, and Certified Cloud Security Professional for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.


text: We take an active role in ensuring the confidentiality, integrity, and availability of data, systems, processes, applications, and products. We are diligent when it comes to safeguarding the data of our strategic partners, employees, existing and future customers, and our teams throughout the globe. We take the protection of proprietary information, intellectual property, and sensitive information seriously, making it our commitment to provide comprehensive prevention, detection, and response capabilities, in order to maintain integrity.

companyName: CONMED Corp

ticker: CNMD


text: We manage cyber risk and assess internal maturity capabilities by leveraging the National Institute of Standards and Technology (NIST) framework, in conjunction with the Center for Internet Security (CIS) top 18 risk framework. Internal and external assessments are conducted for best practice benchmarking. Outputs from these assessments are used to develop strategic priorities, and to develop tactical action plans to continue to mature our cyber posture. CONMED leverages technologies, external consultants and vendors to support our risk management strategies, threat insights, trends, and mitigation approaches. In addition, CONMED has published corporate policies that support our cybersecurity efforts, such as our employee handbook, and has proactively implemented protection measures such as endpoint encryption, endpoint monitoring (EDR), remote access, VPN, and multi-factor authentication. Policies and procedures must go through a controlled review process by senior management to ensure relevant updates are being incorporated in our policies.


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our executive management team along with our Chief Information Security Officer (CISO) are responsible for managing cybersecurity risk, including assessing cyber maturity and development of short and long-term strategies. Our CISO has extensive leadership and experience within the cybersecurity space. We invest in the growth and development of our security team's expertise through hands-on training, technical industry certifications and security domain specific conferences. Security is approached as a unified company strategy, where everyone in the organization plays a key role in the success of our programs. Through required phishing training and awareness campaigns, policy and procedures training, and periodic multi-level tabletop exercise scenarios, we continue to improve identification, reporting, response, recovery, and prevention of threats. We engage in penetration testing, provided by external entities to ensure our internal processes and controls are validated.


text: We continue to invest in IT Security to improve technical capabilities, streamline response effectiveness, and harden preventive, detection, and response measures, while growing the core security organization to support business growth efforts.


text: We build our security program with the intent of a global reach and a global customer base at the top of our minds. Cybersecurity risk factors are evaluated, prioritized, and connected to annual strategic priorities. Strategic priorities are comprised of critical cybersecurity efforts in an ongoing effort to mitigate internal or external risks factors, and drive maturity objectives. We have developed and continue to develop strategic and tactical cyber capabilities to provide a modern approach to protecting the partnerships we have built our business around. This is, and will continue to be, an ongoing effort to provide and implement cyber best practices. Our Audit Committee is briefed semi-annually by our management team to provide awareness around IT environmental risk factors, cyber posture, global threat landscape, and changing regulatory requirements. Decisions are then made based on all assessed risk factors, including cyber maturity growth, strategic personnel, and appropriate cyber capability. All critical response activities are assessed and communicated from executive management to the Audit Committee which then reports to the Board of Directors.


text: During the fiscal year ended December 31, 2023 and through the date of the filing of this Form 10-K, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition.


text: During the fiscal year ended December 31, 2024 and through the date of the filing of this Form 10-K, we have not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, our business strategy, results of operations, or financial condition. The risk factors related to cybersecurity threats identified to be reasonably likely to affect, our business strategy, results of operations, or financial condition are included in "Item 1A. Risk Factors - Other Risks Related to Our Business".


text: Risk Management and Strategy Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets, assessing and prioritizing risks and employing various tools and techniques to identify and remediate threats. We also leverage third party service providers to test and validate our existing processes and procedures. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, our results of operations or our financial condition under the heading "We face risks associated with security breaches or cyberattacks" included as part of our risk factors disclosures in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: We have not experienced a cybersecurity incident which has been determined to be material and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the heads of the IT Security and Internal Audit departments on a regular basis, typically biannually. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks, also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal Officer, may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Information Security Management Steering Committee ("ISMS Committee"), comprised of our Chief Information Security Officer ("CISO"), as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, Cyber Incident Response Team and ISMS Committee to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO has significant experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.


text: Risk Management and Strategy The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital business solutions. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Identifying and assessing cybersecurity risk is fully integrated into our overall risk management systems and processes. The Company has established a cybersecurity and information security program that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. Our security program under this framework utilizes policies, software, training programs and hardware solutions to protect and monitor our environment, including multi-factor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing and identity management systems.


text: Our Chief Information Security Officer ("CISO"), who reports directly to the Chief Financial Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CISO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams, and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendors risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents. These include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee in responding to any such incidents.


text: Our cybersecurity and information security program also includes review and assessment by external, independent third-parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company has a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.


text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents, and use the findings to improve our practices, procedures, and technologies. In 2024, as part of upcoming enhancements to security preparedness, members of senior management are scheduled to participate in tabletop exercises led by third-party experts on cyber incident response best practices to apply their learnings to the Company's business continuity management program. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including the impact of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three years, we have not experienced any material information security breach incidents. The Company maintains cybersecurity insurance, and as part of management oversight we regularly review our policy and levels of coverage based on current risks.


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CISO who reports directly to our Chief Financial Officer. Our CISO has over 25 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CISO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CISO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CISO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.


text: Board of Directors Oversight Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The Audit and Finance Committee is charged with oversight of data privacy and cybersecurity risks. Our CISO provides updates to either the Audit and Finance Committee or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.


text: The CISO also promptly informs and updates the Board about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The Audit and Finance Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Board. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital technologies. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.


text: Our Chief Information Officer ("CIO"), who reports directly to the Chief Executive Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CIO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendor risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we undertake to prepare for, detect, respond to and recover from cybersecurity incidents. These activities include processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee ("AFC") of the Company's Board of Directors in responding to any such incidents.


text: Our cybersecurity and information security program also includes review and assessment by external, independent third parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company uses a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.


text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and conducts enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents and use the findings to improve our practices, procedures, and technologies. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CIO who reports directly to our Chief Executive Officer. Our CIO has over 20 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CIO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CIO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CIO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CIO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.


text: Board of Directors Oversight Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The AFC is charged with oversight of data privacy and cybersecurity risks. Our CIO provides updates to either the AFC or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.


text: The CIO also promptly informs and updates the Company's Board of Directors about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The AFC conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Company's Board of Directors. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our customer's business, cause us to lose customers and result in significant financial exposure and legal liability.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: These risks are identified, assessed and managed within the broader context of our ERM strategy, ensuring a comprehensive approach to organizational risk. We incorporate cybersecurity risk assessments into our overall enterprise risk assessment process. This integration ensures that cyber risks are evaluated and managed alongside other operational, financial, and strategic risks, offering a holistic view of our risk landscape. Our ERM strategy is overseen by an Enterprise Risk Management Committee, which is made up of representatives from our finance, legal, accounting, internal audit and global information systems functions, our business leaders and members of the Senior Leadership Team. It is led by our Chief Financial Officer and its actions are reported to our Board of Directors on a quarterly basis.


text: Our Chief Information Officer and Director of Information Security, along with members of their respective teams, are responsible for identifying and managing cybersecurity risk. The Senior Leadership Team, the Board of Directors and the Board's Audit Committee receive regular updates and engage in regular strategic discussions relating to cybersecurity risk management as part of their overall oversight of risk management.


text: Our cybersecurity framework leverages internationally recognized standards, including the CIS 20 and the NIST SP 800-171 frameworks, and is required to comply with the Department of Defense CMMC. We have policies and procedures in place designed to maintain compliance with relevant cybersecurity and data privacy laws and regulations in the jurisdictions in which we operate, such as the European Union GDPR and the California Consumer Privacy Act.


text: Our cybersecurity strategy includes policies, procedures, and technology that proactively safeguard our operations against cybersecurity threats. Internal teams and external experts regularly conduct risk assessments and audits to identify cybersecurity threats, ensure regulatory compliance, and adhere to control process best practices. Continuous monitoring of our networks and systems for threats and vulnerabilities is a key component of our strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats. We regularly review and update our cybersecurity strategies, policies and procedures, taking into consideration the latest advancements in cybersecurity practices and changes to the threat landscape.


text: We have a cybersecurity incident response and crisis management plan in place, which incorporates regular training and simulation exercises, including with senior management, to ensure readiness and efficacy in responding to cybersecurity incidents. Our incident response and crisis management plan coordinates the activities we will take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.


text: In addition, we provide regular security awareness education and training for all employees and consultants, conduct internal "phishing" testing and training for "clickers," require mandatory security training for all new hires and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: We engage qualified third-party cybersecurity experts for in-depth cyber risk assessments, penetration tests, and compliance audits, which provide impartial perspective and insight into our cybersecurity posture and we engage consultants for the development and refinement of our cybersecurity strategy and maturity, drawing upon industry best practices and regulatory knowledge. These collaborations also include the refinement of our incident response and crisis management plan and employee training, emphasizing the transfer of knowledge for sustainable in-house capabilities.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of these providers through surveys and reports, audits, and performance reviews.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Based on our review of past cybersecurity incidents, we believe that all such incidents were addressed promptly and effectively. In the last fiscal three years, we have not experienced any material information cybersecurity incidents and the expenses we have incurred from any cybersecurity incidents were immaterial. See Item 1A, "Risk Factors" of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Board of Directors The Board of Directors oversees our risk management processes, including with respect to cybersecurity risk, and the Board considers cybersecurity risk management an enterprise priority. The Board has delegated primary responsibility for reviewing and discussing with management our strategies, initiatives and policies relating to cybersecurity to the Audit Committee, which regularly reports to the full Board regarding such review and discussions. In addition, in connection with its oversight of cybersecurity risks in relation to financial reporting and internal controls, the Audit Committee plays a crucial role in the Board's understanding and management of the financial and operational impacts of cybersecurity risks.


text: As part of their oversight of cybersecurity risk, the Board and Audit Committee regularly review detailed cybersecurity reports, which include analyses of the threat landscape, recent incidents, and the efficacy of our cybersecurity strategy. In addition, the Chief Information Officer provides bi-annual updates to the Audit Committee and annual briefings to the full Board on our cybersecurity posture, strategy, and risk management. These reviews and updates are complemented by ongoing cybersecurity training for board members to enhance their decision-making and oversight effectiveness.


text: Regular active engagement in strategic discussions by the Board and Audit Committee ensures that cybersecurity considerations are effectively integrated into our overall business strategy and align with Company objectives and demonstrates the Board's commitment to proactive cybersecurity oversight.


text: Although the Board oversees our overall risk management, day-to-day management of cybersecurity risk is the responsibility of management. Management's critical role involves assessing and managing these risks through regular evaluations, deploying advanced security measures, and developing policies. Management integrates these strategies across all our operations, fostering a culture of cybersecurity awareness within the Company. This proactive stance is essential to safeguarding digital assets and ensuring operational resilience against evolving cyber threats.


text: Quarterly, the Chief Information Officer presents detailed cybersecurity reports to the Enterprise Risk Committee, focusing on strategic initiatives and evolving threats. The Enterprise Risk Committee, meeting quarterly, evaluates cybersecurity within the broader organizational risk context, ensuring consistent assessment and management.


text: The Chief Financial Officer chairs quarterly Enterprise Risk Management Committee meetings to review and evaluate various risk factors, including cybersecurity. The Chief Financial Officer's expertise in financial risk management, strategic planning, and organizational leadership is instrumental in guiding the committee's discussions and decisions. The Chief Financial Officer ensures that appropriate financial and operational implications of cybersecurity risk are considered and integrated into our Enterprise Risk Management Strategy.


text: The Chief Information Officer oversees our broader IT strategy, including cybersecurity, and presents quarterly to the Enterprise Risk Management Committee, bi-annually to the Audit Committee, and annually to the Board. The Chief Information Officer's expertise in information technology, cybersecurity, and strategic planning, forged over 24 years, 20 of which has been spent in leadership at global publicly traded companies, is integral to our approach to cybersecurity risk management. This expertise is crucial in aligning our cybersecurity initiatives with business objectives, ensuring that our strategies effectively support the Company's overall goals.


text: The Director of Information Security, reporting to and collaborating with the Vice President of Information Technology & the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security Director plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.


text: Regular reporting channels between the Director of Information Security, the Chief Information Officer, and the Chief Financial Officer facilitate a cohesive, well-informed approach to managing cybersecurity risks. These reports include detailed analyses of potential threats, incident response readiness, and the effectiveness of existing cybersecurity measures.


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our business or our customers' businesses, cause us to lose customers and result in significant financial exposure and legal liability.


text: These risks are identified, assessed and managed within the broader context of our ERM strategy, ensuring a comprehensive approach to organizational risk. We incorporate cybersecurity risk assessments into our overall enterprise risk assessment process. This integration ensures that cyber risks are evaluated and managed alongside other operational, financial, and strategic risks, offering a holistic view of our risk landscape. Our ERM strategy is overseen by an Enterprise Risk Management Committee, which is made up of representatives from our finance, legal, accounting, internal audit and global information systems functions, our business leaders and members of the Senior Leadership Team. It is led by our Chief Financial Officer and its actions are reported to our Board of Directors on a quarterly basis.


text: Our Chief Information Officer and Director of Information Security, along with members of their respective teams, are responsible for identifying and managing cybersecurity risk. The Senior Leadership Team, the Board of Directors and the Board's Audit Committee receive regular updates and engage in regular strategic discussions relating to cybersecurity risk management as part of their overall oversight of risk management.


text: Our cybersecurity framework leverages internationally recognized standards, including the CIS 20 and the NIST SP 800-171 frameworks, and is required to comply with the Department of Defense CMMC. We have policies and procedures in place designed to maintain compliance with relevant cybersecurity and data privacy laws and regulations in the jurisdictions in which we operate, such as the European Union GDPR and the California Consumer Privacy Act.


text: Our cybersecurity strategy includes policies, procedures, and technology that proactively safeguard our operations against cybersecurity threats. Internal teams and external experts regularly conduct risk assessments and audits to identify cybersecurity threats, ensure regulatory compliance, and adhere to control process best practices. Continuous monitoring of our networks and systems for threats and vulnerabilities is a key component of our strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats. We regularly review and update our cybersecurity strategies, policies and procedures, taking into consideration the latest advancements in cybersecurity practices and changes to the threat landscape.


text: We have a cybersecurity incident response and crisis management plan in place, which incorporates regular training and simulation exercises, including with senior management, to ensure readiness and efficacy in responding to cybersecurity incidents. Our incident response and crisis management plan coordinates the activities we will take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.


text: In addition, we provide regular security awareness education and training for all employees and consultants, conduct internal "phishing" testing and training for "clickers," require mandatory security training for all new hires and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: We engage qualified third-party cybersecurity experts for in-depth cyber risk assessments, penetration tests, and compliance audits, which provide impartial perspective and insight into our cybersecurity posture and we engage consultants for the development and refinement of our cybersecurity strategy and maturity, drawing upon industry best practices and regulatory knowledge. These collaborations also include the refinement of our incident response and crisis management plan and employee training, emphasizing the transfer of knowledge for sustainable in-house capabilities.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of major providers through log reports and intelligent threat protection analysis.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Based on our review of past cybersecurity incidents, we believe that all such incidents were addressed promptly and effectively. In the last fiscal three years, we have not experienced any material information cybersecurity incidents and the expenses we have incurred from any cybersecurity incidents were immaterial. See Item 1A, "Risk Factors" of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Board of Directors The Board of Directors oversees our risk management processes, including with respect to cybersecurity risk, and the Board considers cybersecurity risk management an enterprise priority. The Board has delegated primary responsibility for reviewing and discussing with management our strategies, initiatives and policies relating to cybersecurity to the Audit Committee, which regularly reports to the full Board regarding such review and discussions. In addition, in connection with its oversight of cybersecurity risks in relation to financial reporting and internal controls, the Audit Committee plays a crucial role in the Board's understanding and management of the financial and operational impacts of cybersecurity risks.


text: As part of their oversight of cybersecurity risk, the Board and Audit Committee regularly review detailed cybersecurity reports, which include analyses of the threat landscape, recent incidents, and the efficacy of our cybersecurity strategy. In addition, the Chief Information Officer provides bi-annual updates to the Audit Committee and annual briefings to the full Board on our cybersecurity posture, strategy, and risk management. These reviews and updates are complemented by ongoing cybersecurity training for board members to enhance their decision-making and oversight effectiveness.


text: Regular active engagement in strategic discussions by the Board and Audit Committee ensures that cybersecurity considerations are effectively integrated into our overall business strategy and align with Company objectives and demonstrates the Board's commitment to proactive cybersecurity oversight.


text: Although the Board oversees our overall risk management, day-to-day management of cybersecurity risk is the responsibility of management. Management's critical role involves assessing and managing these risks through regular evaluations, deploying advanced security measures, and developing policies. Management integrates these strategies across all our operations, fostering a culture of cybersecurity awareness within the Company. This proactive stance is essential to safeguarding digital assets and ensuring operational resilience against evolving cyber threats.


text: Quarterly, the Chief Information Officer presents detailed cybersecurity reports to the Enterprise Risk Committee, focusing on strategic initiatives and evolving threats. The Enterprise Risk Committee, meeting quarterly, evaluates cybersecurity within the broader organizational risk context, ensuring consistent assessment and management.


text: The Chief Financial Officer chairs quarterly Enterprise Risk Management Committee meetings to review and evaluate various risk factors, including cybersecurity. The Chief Financial Officer's expertise in financial risk management, strategic planning, and organizational leadership is instrumental in guiding the committee's discussions and decisions. The Chief Financial Officer ensures that appropriate financial and operational implications of cybersecurity risk are considered and integrated into our Enterprise Risk Management Strategy.


text: The Chief Information Officer oversees our broader IT strategy, including cybersecurity, and presents quarterly to the Enterprise Risk Management Committee, bi-annually to the Audit Committee, and annually to the Board. The Chief Information Officer's expertise in information technology, cybersecurity, and strategic planning, forged over 24 years, 20 of which has been spent in leadership at global publicly traded companies, is integral to our approach to cybersecurity risk management. This expertise is crucial in aligning our cybersecurity initiatives with business objectives, ensuring that our strategies effectively support the Company's overall goals.


text: The Director of Information Security, reporting to and collaborating with the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.


text: Regular reporting channels between the Director of Information Security, the Chief Information Officer, and the Chief Financial Officer facilitate a cohesive, well-informed approach to managing cybersecurity risks. These reports include detailed analyses of potential threats, incident response readiness, and the effectiveness of existing cybersecurity measures.


text: Coherent's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners, employees, shareholders and other stakeholders. One of the critical factors in maintaining this trust is by the Board being involved in oversight of the Company's enterprise risk management ("ERM") program, of which cybersecurity represents a critical component. Coherent's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, and the International Standards Organization Risk Management Guidelines (ISO 31000), as well as other applicable industry standards.

companyName: COHERENT CORP.

ticker: COHR


text: Governance: Coherent's cybersecurity program is overseen by the Board's Environment, Sustainability and Governance ("ESG") committee. The ESG Committee is briefed quarterly by management on, among other things, updates to cybersecurity and related programs, and notable cyber incidents, threats and vulnerabilities, and provides direction on cybersecurity risk management. In addition, Coherent has established a Crisis Management Team (CMT) with responsibility for, among other things, oversight and management of cybersecurity events, including significant and material cybersecurity events. The CMT reports, as appropriate, to the ESG Committee. The CMT is headed by Coherent's Chief Risk Officer (CRO). Additionally, Coherent has a dedicated internal cybersecurity team (Cybersecurity Team), managed by the Global Head of Cybersecurity.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. On a regular meeting cadence, Coherent's President convenes a senior cybersecurity committee for reporting and planning. The committee consists of the Chief Information Officer (CIO), the Global Head of Cybersecurity, the Vice President of IT Operations, the Senior Director of IT Security, the General Counsel for Technology and Risk Management, and the CRO. Members of partner technology-risk advisory firms and Coherent internal experts from other disciplines participate in committee activities as needed from time to time.


text: As to experience of the various members of Coherent's cybersecurity functional team, the CIO is a technology executive with over 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, including leading risk management, data governance, compliance, and SOX audits, aligning technology with business goals and robust data protection. He holds a B.S. in Electrical Engineering and ITIL certification. The Coherent Global Privacy Officer earned a B.A. and a Juris Doctor degree and has over 20 years of experience in legal practice, focusing specifically on privacy law for the past eight years. Additionally, the Coherent Global Privacy Officer is an active member of the International Association of Privacy Professionals (IAPP) and holds both the Certified Information Privacy Professional/Europe (CIPP/E) and Certified Information Privacy Manager (CIPM) certifications from the IAPP. The General Counsel for Technology and Risk Management holds a B.S. in Industrial Engineering, and a Juris Doctor degree and has over 38 years of experience in legal practice, 25 years of which specifically representing businesses and financial institutions in data security and privacy in both private practice and as at in-house attorney at various private and public companies. The Senior Manager, Security, Risk & Compliance, has been in Information Technology for 25 years and in IT security for 16 years, and holds a B.S. in Computer Science, with a minor in Mathematics, and an ISC2 CISSP Certification. He is a member of the ACM and a Senior Member of the IEEE. The Senior Director of Information Security is a CISSP and member of ISSA, practicing security for over 30 years, with a B.S. degree. He also has served as a consultant and has managed international cybersecurity teams with Fortune 100 companies in finance, banking, technology, biotech, security consulting, and large manufacturing in broad areas of cybersecurity. The VP of IT Infrastructure Operations and Interim Head of Information Security and Compliance has 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, and holds a M.S. in Electrical Engineering.


text: Incident Response and Recovery Planning: Coherent has instituted a robust Cybersecurity Incident Response Plan (the CIRP), which provides a framework for responding to cybersecurity incidents at escalating severity levels. The CIRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The CIRP is implemented by the Coherent Cyber Incident Response Team (CIRT), which is headed by the Global Head of Cybersecurity, and includes as members the head of the CMT, the Chief Legal Officer, the Cybersecurity Team, and select members of the ERM team.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Security Policy and Requirements: The Coherent Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment and prioritization, and as necessary, remediation plans. The Cybersecurity Team also performs periodic system penetration testing to validate the Company's security controls and assess Coherent's infrastructure and applications. All employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, the IT group and the Cybersecurity Team participate in annual tabletop exercises designed to simulate a response to a cybersecurity incident. The Cybersecurity Team incorporates the findings from these exercises into the Coherent processes. Further, in 2023, select members of the senior management team and the Cybersecurity Team participated in a tabletop exercise.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties. This includes external third parties that may have permission to access Coherent IT systems and assets, such as consultants, and review of the systems of third parties that could adversely impact Coherent's infrastructure in the event of a cybersecurity incident affecting those third-party systems, such as through vendors and other service providers.


text: The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact Coherent or Coherent's operations to date. However, the Company recognizes the ever-evolving cyber risk landscape and cannot provide any assurances that it will not be subject to a material cybersecurity incident in the future.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks such as NIST-CSF (National Institute of Standard and Technologies – Cybersecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We maintain a risk based approach to identify cybersecurity threats, and conduct assessments to determine if our information systems are vulnerable to such cybersecurity threats. This includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: We maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer and Global Head of Cybersecurity, to manage the risk mitigation process.


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We periodically engage consultants, auditors, or other third parties. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.


text: Like any other technology company operating in today's environment, we have experienced cybersecurity incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Cybersecurity attacks and incidents and other vulnerabilities could subject us to costly damages, claims and expenses, harm to our reputation or competitive position, or disrupt our operations and business."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cyber security threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Nominating and Corporate Governance ("NCG") Committee.


text: The NCG Committee is briefed quarterly by management on, among other things, our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. The NCG Committee provides regular updates to the Board of Directors on such reports.


text: Our Chief Information Officer and Global Head of Cybersecurity have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cyber security policies and processes, including those described in "Risk Management and Strategy" above. Our Global Head of Cybersecurity monitors and keeps informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our cybersecurity team, and through the use of technological tools and software and results from third party assessments.


text: The Company is committed to ensuring the safe operation of its business by means of a dedicated cybersecurity program designed to protect the confidentiality, integrity, and availability of its assets from cybersecurity threats. The Company's customers, suppliers, and joint venture partners also face cybersecurity threats, and a cybersecurity incident impacting the Company or any of these entities could materially impact our operations, performance, and results of operations. New and evolving cybersecurity threats and related risks make it imperative that the Company allocates the appropriate resources to mitigate these risks, adapts to the changing cybersecurity landscape, and responds to emerging threats in a timely and effective manner.

companyName: Andersons, Inc.

ticker: ANDE


text: The underlying controls of the Company's cybersecurity program are designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") standards for cybersecurity and information technology. The controls in the Company's cybersecurity program include but are not limited to, endpoint threat detection and response, privileged access management, logging and monitoring, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability, and patch management. Management regularly assesses the Company's cybersecurity capabilities and has implemented policies, processes, and technology that it considers appropriate to reduce the likelihood or impact of a breach.


text: Third parties also play a role in the Company's cybersecurity. The Company engages third-party contractors to assess cybersecurity controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of these cybersecurity controls. The Company engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in the Company's information technology environment. Management also shares and receives threat intelligence with our peers, local public companies, and cybersecurity associations.


text: The Company's Senior Manager of Information Security, reporting to the Vice President of Information Technology, is the leader of the Company's cybersecurity team. The Senior Manager of Information Security is responsible for assessing and managing the Company's cybersecurity program, informs the Vice President of Information Technology and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Senior Manager of Information Security and Vice President of Information Technology have decades of collective experience in managing information technology and cybersecurity functions, both at the Company and in prior positions. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.


text: Employees outside of the cybersecurity team also have a role in our cybersecurity defenses and they are engaged in a culture supportive of security protocols, which management believes improves the Company's cybersecurity. All employees are required to complete cybersecurity trainings annually and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. The internal business owners of hosted applications are required to document user access reviews at least annually and receive a System and Organization Controls ("SOC") 1 or SOC 2 report from the vendor. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, management will take additional steps to assess the vendor's cybersecurity preparedness.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity program and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's Vice President of Information Technology regularly addresses the Audit Committee, typically on a quarterly basis, regarding our cybersecurity and data privacy progress to the NIST CSF standards along with briefing the Committee on any cybersecurity incidents that were determined to have a moderate or higher impact on the business, even if immaterial to the Company as a whole. In the event of an incident, management intends to follow the Company's incident response plan, which outlines the steps to be followed from the detection of an incident to mitigation, recovery, and notification, including notifying functional areas, as well as senior leadership and the Audit Committee, as appropriate. Determination of when to notify senior leadership and the Audit Committee is made by the Vice President of Information Technology in consultation with other members of senior leadership as needed. Depending on the nature and severity of the incident, disclosure can be handled either through scheduled quarterly reporting to the Audit Committee or as an immediate disclosure to the Chair of the Audit Committee.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into the Company-wide ERM process. On an annual basis, management assesses the top risks facing the enterprise through the Company's ERM process. Cybersecurity related risks are included in this annual function and to the extent the ERM process assigns a heightened risk to cybersecurity, risk owners are named to address the severity, likelihood, and controls in place to mitigate these risks. Upon the conclusion of the ERM process, management's assessment is then presented to the Board of Directors.


text: Notwithstanding the attention the Company pays to cybersecurity risks and the processes and controls implemented, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, strategy, financial condition, results of operations, cash flows, and reputation. Cybersecurity risks rapidly evolve and are complex, so the Company must continually adapt and enhance processes and controls. As the Company does this, management must make judgments about where to invest resources to protect the Company and our assets most effectively. These are inherently challenging processes, and management can provide no assurance that the processes and controls implemented will be effective.


text: The Company has experienced, and expects to continue to experience, cyber incidents in the normal course of business. Cybersecurity threats, including as a result of previous incidents, to date, have not had, and as of the date hereof we do not believe are reasonably likely to have, a material adverse effect on the Company's business, strategy, financial condition, results of operations, or cash flows. However, for the reasons described above, management cannot guarantee that the Company will not be materially affected in the future. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for further discussion of cybersecurity risks.


text: The Company's Director of Information Security ("CISO"), reporting to the Chief Information Officer ("CIO"), is the leader of the Company's cybersecurity team. The CISO is responsible for assessing and managing the Company's cybersecurity program, informs the CIO and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our CISO and CIO have decades of collective experience managing information technology and cybersecurity functions, both at the Company and in prior positions at large, Fortune 500 global businesses. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.