text: Depending on the environment and system, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of the Company's enterprise risk management program. In addition, we have developed a process whereby our senior management will evaluate material risks from cybersecurity threats against our overall business objectives and will report certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS

secItem: Item 1C


text: We use third-party service providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on information technology systems, infrastructure and data, which exposes us to data security risks."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who is an information technology professional with healthcare and digital certifications and has over 25 years of relevant experience, and other employees in our Information Technology department who are certified security professionals and have relevant experience.


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. As part of such process, the Audit Committee of the Board of Directors receives regular reports from our Senior Vice President, Information Technology concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.


text: Risk management and strategy We have implemented and maintain various information security processes designed to detect, respond to, recover, and protect our technology ecosystem from cybersecurity threats. These processes are designed to identify, assess, and manage material risks that may result from cybersecurity threats and apply to our critical technologies inclusive of networks, third party hosted services, communications systems, hardware, software, and critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.


text: Our Information Technology department, led by our Senior Vice President, Information Technology, helps to detect, respond to, and manage cybersecurity threats and risks by monitoring and evaluating our threat environment using various manual and automated tools in certain environments and systems and other methods including, for example: analyzing reports of certain threats and actors; conducting scans of the threat environment; evaluating our and our industry's risk profile; evaluating certain threats reported to us; conducting internal and external audits; conducting threat assessments for certain internal and external threats; and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, system and data, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies and data, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of our enterprise risk management program. In addition, we have developed a process whereby our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators. The Company maintains a risk-based approach and process designed to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could materially impact our business if there is a cybersecurity incident affecting those third-party systems.


text: For an additional description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 1A, Risk Factors, in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on data as well as information technology systems and infrastructure, which exposes us to data protection risks."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Audit Committee also oversees our internal audit department and management's internal controls over financial reporting, including with respect to cybersecurity.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who holds an undergraduate degree in Computer Engineering and has served in information technology and security roles dedicated to the pharmaceutical and biotechnology sector for approximately 18 years, including serving as the Chief Information Officer of two public biopharmaceutical companies.


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. The Audit Committee of the Board of Directors receives reports from our Senior Vice President, Information Technology concerning our significant cybersecurity threats and risks (including certain cybersecurity threats) and the processes we have implemented that are designed to address them.


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: We have implemented a cybersecurity program to safeguard our information systems, which includes policies, procedures and controls designed to protect against cybersecurity threats. Throughout the reporting period, we have made significant changes and enhancements to our cybersecurity program and the adoption of industry best practices.


text: We are aware of the various risks and threats that the Company faces in relation to cybersecurity. These risks include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, we recognize the potential for internal risks, such as employee negligence or malicious activities, which can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, and we believe this demonstrates our commitment to cybersecurity awareness.


text: In the event of a cybersecurity incident, the Company has a well-defined incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Throughout the reporting period, we have successfully implemented our incident response plan.


text: Within our organization, we have established a dedicated cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.


text: In its risk oversight role, our Board of Directors focuses on understanding the nature of our enterprise risks, including our operations and strategic direction, as well as the adequacy of our risk management process and overall risk management system. The Board of Directors evaluates risks over the short-term and over the long-term. Risk evaluation over the short-term includes the assessment of multiple inputs, including (i) receiving management updates on our business operations, financial results and strategy and discussing risks related to the business at each regular board meeting, (ii) receiving regular reports on all significant committee activities at each regular board meeting and (iii) evaluating the risks inherent in significant transactions, as applicable. In connection with risk evaluation over the long-term, the Board of Directors also seeks out the input of subject matter experts and consultants. Accordingly, a formal, enterprise risk assessment, which includes numerous members of Company management, is performed annually as part our strategic plan process.


text: We are subject to various legal and regulatory requirements related to cybersecurity. Compliance with these requirements is of utmost importance to management, is a top priority for the Company and is a shared responsibility among all stakeholders. Throughout the reporting period, we have diligently worked to ensure our compliance efforts align with these obligations, and we are committed to ongoing efforts to enhance our cybersecurity measures and stay vigilant against evolving threats.


text: Looking ahead, we remain committed to continuously improving our cybersecurity strategy and initiatives. We recognize the ever-evolving nature of cybersecurity threats and the need to adapt our measures accordingly. In the future, we plan to focus on enhancing employee training and awareness programs to foster a culture of cybersecurity awareness within the Company.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our systems and data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.


text: We have a cybersecurity program to safeguard our information systems and data, which includes policies, processes and controls designed to protect against cybersecurity threats.


text: The risks and threats that the Company faces in relation to cybersecurity include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, internal risks, such as employee negligence or malicious activities, can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, which we believe demonstrates our commitment to cybersecurity awareness.


text: In the event of a cybersecurity incident, the Company has an incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Our security operations include monitoring conducted by a third-party provider in collaboration with internal teams. The Company has also invested in modern cybersecurity tools to protect and detect the systems and data from attacks and compromises.


text: Within our organization, we have established a cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for cybersecurity risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.


text: We are subject to various legal and regulatory requirements related to cybersecurity. Compliance with these requirements is of utmost importance to management, is a top priority for the Company and is a shared responsibility among all stakeholders. We continue to diligently work to ensure our compliance efforts align with these obligations, and we are committed to ongoing efforts to enhance our cybersecurity measures and stay vigilant against evolving threats.


text: We are committed to continuously improving our cybersecurity program as we recognize the ever-evolving nature of cybersecurity threats and the need to adapt our measures accordingly. We plan to focus on expanding our cybersecurity leadership, resources and expertise, and enhancing our governance and processes.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: The Company is exposed to diverse cybersecurity risks that have the potential to significantly impact our business operations, financial standing, and reputation. We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information, and employ a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines, to increase the likelihood that system risks are identified.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: To identify potential risks, Ambac also assesses the security measures of vendors and third-party service providers that have access to the Company's information systems and sensitive data. Each review involves an initial risk assessment of the provider, and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers' systems that could affect the Company, or to have cybersecurity incident notice requirements in their cybersecurity programs.


text: Our approach to managing cybersecurity risks includes implementing cybersecurity measures such as selective use of encryption, firewalls, data loss prevention, security monitoring, endpoint detection and response, anti-spam and anti-phishing email security, and intrusion detection systems to fortify our defenses. We conduct mandatory annual employee cybersecurity training programs and frequent simulated phishing campaigns to enhance cybersecurity knowledge and practices across the organization. Ambac maintains an incident response plan that is updated regularly to respond to changes in the organization, risks and laws. Ambac also conducts an annual test to restore business critical systems and data from back-ups. We have established reporting processes and escalation pathways for our business units and functions to identify, assess and manage potential cybersecurity incidents in a timely manner. Once an incident is identified, the Chief Information Security Officer ("CISO") (with the assistance of the IT team) will begin the investigation to determine the level of risk of the event and the appropriate response.


text: The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company's cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management Ambac Financial Group, Inc has become aware. In addition the Board receives periodic cybersecurity awareness training.


text: The Company's technology staff and CISO conduct weekly meetings, attended regularly by the Chief Operating Officer and Chief Information Officer, to review: (i) implementation of new security measures, (ii) results of existing technical system monitoring tools to identify any potential risk and propose remediation, as necessary; (iii) newly disclosed software patch updates to assess risks and set patch implementation priorities; and (iv) threat intelligence from various organizations, such as the Cybersecurity and Infrastructure Security Agency, to assess risks and suggest security measures, as necessary. Cybersecurity risk is also included in the Company's Enterprise Risk Management ("ERM") process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company's ability to execute on its corporate strategy and fulfill its business objectives. The Company's Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks. The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board of Directors, which receives ERM updates on a quarterly basis. The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.


text: The Company's Chief Information Officer and CISO bring over 35 years of combined experience in the technology and cybersecurity space. The Chief Information Officer has served as a chief information officer and chief technology officer of both private and public institutions for the past 10 years and was responsible for the IT operations and cybersecurity practices of those institutions. The CISO is a certified cybersecurity professional and technologist. He holds an active ISO/ANSI-accredited cybersecurity certification and has experience managing security programs across multiple industries, including financial services and insurance. Other credentials among Ambac's IT staff include a Certified Information Systems Security Professional certification and a Masters Degree in cybersecurity risk and management.


text: Ambac and its subsidiaries are subject to various U.S. Federal and state laws and regulations with respect to privacy, data protection and cybersecurity that require financial institutions, including insurance companies and agencies, to safeguard personal and other sensitive information, and may provide for notice of their practices relating to the collection, disclosure and processing of personal information, disclosure of cybersecurity risk management practices, reporting of cybersecurity incidents, and implementation of governance practices. For example, the National Association of Insurance Commissioners ("NAIC") adopted the NAIC Insurance Data Security Model Law (#668) ("NAIC Model Law") that creates rules for insurers and other covered entities addressing data security and the investigation and notification of cybersecurity events involving unauthorized access to, or the misuse of, certain nonpublic information. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. Legislation based on the NAIC Model Law has been enacted in many states and may be enacted in other states. Certain of our subsidiaries, as insurance companies and agencies licensed in the State of New York, are also required to comply with the New York Department of Financial Services ("NYDFS") cybersecurity regulation, which establishes requirements for covered financial services institutions to implement a cybersecurity program designed to protect the confidentiality, integrity and availability of information systems of regulated entities, and information stored on those systems. The regulation imposes a governance framework for cybersecurity program, risk based minimum standards for technology systems for data protection, monitoring and testing, third-party service provider reviews, security incident response and reporting to NYDFS of certain security incidents, annual certifications of regulatory compliance to NYDFS, and other requirements. Recent amendments to the NYDFS cybersecurity regulation impose additional security requirements and new governance obligations.


text: The California Consumer Privacy Act, went into effect in January 2020, and provides additional privacy rights for California residents, and in November 2020, California further expanded privacy rights for California residents by enacting the California Privacy Rights Act, which became effective January 1, 2023. Several other states have enacted similar comprehensive privacy laws. We anticipate federal and state regulators to continue to enact legislation related to privacy and cybersecurity, which may require additional compliance investments and changes to policies, procedures and operations.


text: The federal Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") impose minimum standards on covered entities, such as health insurers, for the privacy and security of protected health information ("PHI"). The Health Information Technology for Economic and Clinical Health Act, enacted in 2009 ("HITECH") provides for the extension of certain privacy and security provisions of HIPAA to business associates of covered entities that handle electronic PHI. Xchange specializes in accident and health insurance and is a business associate of the health insurers carriers it partners with, making it subject to compliance with the provisions of HITECH and HIPAA applicable to business associates.


text: The Company is exposed to diverse cybersecurity risks that have the potential to significantly impact our business operations, financial standing, and reputation. We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information, and employ a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines or ISO (International Organization for Standardization) 27001 standard, to increase the likelihood that system risks are identified.


text: To identify potential risks, Ambac or a third party vendor engaged by the Company also assesses the security measures of vendors and third-party service providers that have access to the Company's information systems and sensitive data. Each review involves an initial risk assessment of the provider, and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers' systems that could affect the Company, or to have cybersecurity incident notice requirements in their cybersecurity programs.


text: The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company's cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management has become aware. In addition the Board receives periodic cybersecurity awareness training.


text: The Company's technology staff and CISO conduct weekly meetings to review: (i) implementation of new security measures, (ii) results of existing technical system monitoring tools to identify any potential risk and propose remediation, as necessary; (iii) newly disclosed software patch updates to assess risks and set patch implementation priorities; and (iv) threat intelligence from various organizations, such as the Cybersecurity and Infrastructure Security Agency, to assess risks and suggest security measures, as necessary. Cybersecurity risk is also included in the Company's Enterprise Risk Management ("ERM") process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company's ability to execute on its corporate strategy and fulfill its business objectives. The Company's Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks. The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board Ambac Financial Group, Inc.


text: Table of Contents, of Directors, which receives ERM updates on a quarterly basis. The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.


text: In the United Kingdom, data protection is governed by the UK General Data Protection Regulation 2016/679 and the UK Data Protection Act of 2018 (together the "UK GDPR"), which requires companies to manage the access and transfer of personal information of UK residents. The Company's affiliates licensed and doing business in the UK are subject to compliance with the provisions of the UK GDPR.


text: Our Cybersecurity Risk Management Program Like other companies, we currently inhabit an environment of increasing global cybersecurity vulnerabilities and threats. We aim to effectively assess, identify, and manage material risks from these cybersecurity threats through our cybersecurity risk management program.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Our cybersecurity risk management program includes processes that incorporate and utilize certain principles from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the COBIT 2019 Framework and the IT Infrastructure Library ("ITIL") Framework. The program aims to protect and preserve the security, availability, integrity, confidentiality, and privacy of our information systems and information residing on those systems and includes controls and procedures for the prevention, identification, containment, and remediation of cybersecurity threats through the use of various technologies, tools, policies, standards, and practices. Features of our cybersecurity risk management program include: • An expectation, set forth in our Code of Ethics, that all employees are responsible for protecting our data, operations and environment from unauthorized access and use; • Regular cybersecurity risk assessments and benchmarking; • Policies and processes related to the detection and reporting of and response to cybersecurity events; • Cybersecurity training for all newly hired employees upon onboarding; • Individualized, biannual employee information security assessments, coupled with tailored follow-on employee trainings; • Phishing tests conducted at least quarterly on a global basis, with additional periodic phishing tests conducted with high-risk employee groups; • Channels for employees to report suspicious emails or other activity and the actual or suspected loss, theft, improper use of or access to IDEXX systems or information; • Deployment and ongoing assessment of the effectiveness of technological tools aimed at preventing, detecting, and mitigating cybersecurity threats; • Policies and procedures to assess third-party service provider cybersecurity risks and security controls and measures (as part of our procurement process and periodically/regularly thereafter); • Performance of cybersecurity tabletop exercises; • Regular review of and, as applicable, updates to our cyber incident response plan and protocols, system backup measures, redundancy planning and disaster recovery plans; and • Maintenance of a cyber risk insurance policy to help address risk of loss due to certain types of cybersecurity events.


text: A review of cybersecurity risks is integrated into our annual enterprise risk assessment that occurs as part of our annual strategic planning process and is included in our quarterly disclosure controls and procedures. Our annual enterprise risk assessment process involves the identification and assessment by senior line-of-business and functional leaders, as well as our Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), of the risks relevant to their lines of business and functional areas, the materiality of those risks, our risk tolerances and our plans to manage and mitigate the risks to the extent prudent and feasible.


text: From time to time, we engage third parties, including assessors, consultants, legal counsel, and others to conduct penetration testing, assess our program, provide recommendations for improvement, and advise us on best practices.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats (including from any prior cybersecurity incidents) have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurances, however, that we or our business partners or suppliers will not experience a future system disruption, attack or security breach that materially impacts our business, operations, results of operations, or financial condition. For more information refer to "Item 1A. Risk Factors, General Risks, We are increasingly dependent on the continuous and reliable operation of our information technology systems, and a disruption of these systems or significant security breaches could adversely affect our business."


text: Role of Management Our cybersecurity risk management program and activities are led by our CISO, who reports to Ken Grady, our Senior Vice President and CIO, and oversees a team of information security professionals. At this time, Mr. Grady is our acting CISO while we are conducting a search to hire a new CISO. Mr. Grady, who joined IDEXX as our CIO in 2014, has more than twenty years of experience leading information technology teams, including cybersecurity teams, at healthcare companies. Our CIO is responsible for our cybersecurity-related governance programs, overseeing testing of our compliance with standards and remediation of known risks, and leads our employee training program.


text: Our CIO and CISO are responsible for providing information regarding our cybersecurity risk management program, as well as cybersecurity risks and incidents, to a senior management-level cybersecurity steering committee. Within our cybersecurity risk governance model, the steering committee, which includes our CIO, CISO, General Counsel, Chief Compliance Officer, Chief Audit Executive, Chief Human Resources Officer and other senior functional and business leaders, meets quarterly, and more frequently as warranted, to review and discuss, among other things, cybersecurity risk assessments, prioritization of initiatives, training plans and incident response plan, protocols and testing. This committee regularly provides updates on its discussions and decisions to our Chief Executive Officer.


text: Role of the Board of Directors In December 2023, the Board delegated responsibility for overseeing our cybersecurity risk management to the Audit Committee. In accordance with the Audit Committee's charter, the Audit Committee will at least annually review and discuss with management, including the CIO and CISO, our processes, policies, procedures, and protocols related to cybersecurity and information security, and it is anticipated that the full Board will participate in this annual review. In addition, in accordance with the Audit Committee's charter, the Audit Committee will throughout the year regularly review and discuss with management, including the CIO and CISO, cybersecurity program assessments and audits, planned improvements and the status of any information security initiatives, as well as risks from cybersecurity threats pertinent to us and any previous cybersecurity incidents experienced by us, including any material impact or reasonably likely material impact on the Company, our business strategy, results of operations, or financial condition. The Audit Committee will provide reports to the Board at each regularly scheduled Board meeting of the matters it has recently addressed, including relating to the oversight of our cybersecurity risk management, and the full Board may participate from time to time, as warranted, in the Audit Committee's sessions on cybersecurity risk management. Outside advisors also may meet from time to time with the Audit Committee or Board, as warranted, to review and discuss cybersecurity matters.


text: Prior to December 2023, our entire Board oversaw cybersecurity risk management, and our CIO and CISO reviewed our cybersecurity risks and risk management program and activities with the Board at least annually. The Board also received additional updates on changes in our cybersecurity risks and related risk management program and activities from time to time throughout the year, as warranted. Management also shared, and will continue to share, the results of our annual enterprise risk assessment, which includes a review of cybersecurity risk, with our full Board.


text: Our cybersecurity risk management program includes processes that incorporate and utilize certain principles from the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework. The program aims to protect and preserve the security, availability, integrity, confidentiality, and privacy of our information systems and information residing on those systems and includes controls and procedures for the prevention, identification, containment, and remediation of cybersecurity threats through the use of various technologies, tools, policies, standards, and practices. Features of our cybersecurity risk management program include: • An expectation, set forth in our Code of Ethics, that all employees are responsible for protecting our data, operations and environment from unauthorized access and use; • Regular cybersecurity risk assessments and benchmarking; • Policies and processes related to the detection and reporting of and response to cybersecurity events; • Cybersecurity training for all newly hired employees upon onboarding; • Individualized, biannual employee information security assessments, coupled with tailored follow-on employee trainings; • Phishing tests conducted at least quarterly on a global basis, with additional periodic phishing tests conducted with high-risk employee groups; • Channels for employees to report suspicious emails or other activity and the actual or suspected loss, theft, improper use of or access to IDEXX systems or information; • Deployment and ongoing assessment of the effectiveness of technological tools aimed at preventing, detecting, and mitigating cybersecurity threats; • Policies and procedures to assess third-party service provider cybersecurity risks and security controls and measures (as part of our procurement process and periodically thereafter); • Periodic performance of cybersecurity tabletop exercises; • Regular review of and, as applicable, updates to our cyber incident response plan and protocols, system backup measures, redundancy planning and disaster recovery plans; and • Maintenance of a cyber risk insurance policy to help address risk of loss due to certain types of cybersecurity events.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats (including from any prior cybersecurity incidents) have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurances, however, that we or our business partners or suppliers will not experience a future system disruption, attack or security breach that materially impacts our business, operations, results of operations, or financial condition. For more information refer to "Item 1A. Risk Factors, General Risks, We depend on the continuous and reliable operation and security of our information technology systems and our products and services that incorporate or rely on information technology, and any disruption or significant cybersecurity breach or other incident could adversely affect our business."


text: Role of Management Our cybersecurity risk management program and activities are led by a dedicated CISO who is also our Vice President of Information Technology. Our CISO reports to our Senior Vice President and CIO, and oversees a team of information security professionals within the Information Security Group. Our CISO joined IDEXX in 2024 and has more than twenty years of business and technical experience leading information technology teams, including cybersecurity teams, at high tech, marketing and healthcare companies. Our CISO, in close collaboration with our CIO is responsible for our cybersecurity-related governance programs, overseeing testing of our compliance with standards and remediation of known risks, and leads our employee training program.


text: Our CISO is responsible for providing information regarding our cybersecurity risk management program, as well as cybersecurity risks and incidents, to a senior management-level cybersecurity steering committee. Within our cybersecurity risk governance model, the steering committee, which includes our CIO, CISO, General Counsel, Chief Compliance Officer, Chief Audit Executive, Chief Human Resources Officer and other senior functional and business leaders, meets quarterly, and more frequently as warranted, to review and discuss, among other things, our cybersecurity risk assessments, prioritization of initiatives, training plans and incident response plan, protocols and testing. This committee regularly provides updates on its discussions and decisions to our Chief Executive Officer.


text: Role of the Board of Directors T he Audit Committee has responsibility for overseeing our cybersecurity risk management. In accordance with the Audit Committee's charter, the Audit Committee at least annually reviews and discusses with management, including the CIO and CISO, our processes, policies, procedures, and protocols related to cybersecurity and information security. In addition, the Audit Committee regularly reviews and discusses with management, including the CIO and CISO, cybersecurity program assessments and audits, planned improvements and the status of any information security initiatives, as well as risks from cybersecurity threats pertinent to us and any previous cybersecurity incidents experienced by us, including any material impact or reasonably likely material impact on the Company, our business strategy, results of operations, or financial condition. The Audit Committee provides reports to the Board at each regularly scheduled Board meeting of the matters it has recently addressed, including relating to the oversight of our cybersecurity risk management, and the full Board may participate, as warranted, in the Audit Committee's sessions on cybersecurity risk management. Outside advisors also may meet from time to time with the Audit Committee or Board, as warranted, to review and discuss cybersecurity matters.


text: The Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a 'defense-in-depth' strategy that uses multiple security measures to protect the integrity of the Company's information assets. This 'defense-in-depth' strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve five categorical objectives, including identification, protection, detection, response and recovery.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation and the California Consumer Privacy Act.


text: We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices.


text: In connection with the regular assessment of third-party service providers performed by our procurement organization, our information protection team performs a third-party assessment of each vendor's information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company's business processes and risk assessments for vendors in the highest tier are completed periodically. With respect to cyber, we have procedures to verify each service provider's information security controls, and each vendor completes a cyber questionnaire that also addresses their resiliency in the event of an intrusion to their systems. We proactively communicate with suppliers to understand mitigation steps taken when major cyber exposures are identified.


text: We are executing on a multi-year roadmap to, among other things, further improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. We are also required to maintain strong cyber defense protocols in the states where we are authorized or licensed to write business. A number of states where our insurance companies are domiciled, including Connecticut, have adopted the NAIC Insurance Data Security Model Law. Our legal team monitors the status of new cybersecurity regulations, including notification requirements.


text: To the best knowledge of Management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the Company's risks related to cybersecurity, see Part I, Item 1A, — Risk Factors for the risk factor "Our businesses may suffer and we may incur substantial costs if we are unable to access our systems and safeguard the security of our data in the event of a disaster, cyber breach or other information security incident."


text: From a governance perspective, senior members of our Enterprise Risk Management, Information Protection and Internal Audit functions provide detailed, regular reports on cybersecurity matters to the Board, primarily through the Audit Committee, which oversees controls for the Company's major risk exposures and has principal responsibility for oversight of cybersecurity risk, and the Finance, Investment and Risk Management Committee ("FIRMCo"), which oversees business risk related to cyber insurance products. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.


text: The Audit Committee is provided with updates on technology and cybersecurity risks at least four times annually, including annual reviews of the Company's cybersecurity program and technology risks and controls, and bi-annual updates on operational risks (in spring and fall). Given its importance, the full Board is invited to attend the annual cybersecurity program and time is reserved at each Audit Committee meeting for cybersecurity technology matters that warrant discussion between the standing sessions. In addition, our Enterprise Risk Management team provides FIRMCo with an assessment of cybersecurity insurance risk once per year. The Audit Committee, FIRMCo and the full Board are apprised of developments in the external environment and business strategies that present additional potential cyber risk exposure to the Company, such as modifications to on-line platforms and expanded use of cloud-based applications, on an ongoing, as-needed basis. As a result, cybersecurity and cyber risk are typically discussed more frequently than the annual minimum requirements.


text: The Company has established an Executive Privacy & Security Council ("EPSC") that meets semi-annually. Formed in 2003, the EPSC consists of a cross-functional senior leaders, including the Chief Information Officer ("CIO"), the Chief Information Security Officer ("CISO"), the Chief Risk Officer ("CRO") and General Counsel among others. The EPSC receives a monthly written executive briefing on topics, and with metrics related to cybersecurity, including incident prevention, detection, mitigation and remediation. Quarterly, the IT Risk Council, made up of senior IT leaders, is also provided with an update of cybersecurity risks and preparedness. Various other meetings are held on cybersecurity topics periodically, including monthly business operating reviews, and meetings of the Enterprise Risk and Capital Committee ("ERCC") and executive leadership team.


text: Part I - Item 1C. Cybersecurity Both the CIO and the CISO have expertise assessing and managing cybersecurity risks. The CIO has served in her current role since 2019 and served in similar technology leadership roles before her current role. She has eighteen years of executive leadership experience in the financial services industry and twenty-eight years of overall technology experience, during which time she has led large scale business transformation, delivered innovative technology strategies and has overseen and modernized complex technology portfolios.


text: The CISO has held several senior-level information technology roles in his twenty-five-year tenure with the Company and has served in his current role since 2021. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: The Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a 'defense-in-depth' strategy that uses multiple security measures to protect the integrity of the Company's information assets. This 'defense-in-depth' strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve the six categorical objectives of governance, identification, protection, detection, response and recovery.


text: Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation, the California Consumer Privacy Act and the New York Department of Financial Services Cybersecurity Regulation.


text: We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities and external advisors to monitor the threat environment and to inform our security practices.


text: In connection with regular assessments of third-party service providers, our information protection team performs an assessment of each vendor's information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company's business processes and risk assessments for vendors in the highest tier are completed periodically. With respect to cyber, we have procedures to verify each service provider's information security controls, and each vendor completes a cyber questionnaire that also addresses their resiliency in the event of an intrusion to their systems. We proactively communicate with suppliers to understand mitigation steps taken when major cyber exposures are identified.


text: We are executing on a multi-year roadmap to, among other things, further improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. A number of states where our insurance companies are domiciled, including Connecticut, have adopted the NAIC Insurance Data Security Model Law. Our legal team monitors the status of new cybersecurity regulations, including notification requirements.


text: From a governance perspective, senior members of our Enterprise Risk Management, Information Protection and Internal Audit functions provide detailed, regular reports on cybersecurity matters to the Board of Directors, primarily through the Audit Committee, which oversees controls for the Company's major risk exposures and has principal responsibility for oversight of cybersecurity risk, and the Finance, Investment and Risk Management Committee ("FIRMCo"), which oversees business risk related to cyber insurance products. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.


text: The Audit Committee is provided with updates on technology and cybersecurity risks at least four times annually, including annual reviews of the Company's cybersecurity program and technology risks and controls, and bi-annual updates on operational risks (in spring and fall). Given its importance, the full Board of Directors is invited to attend the annual cybersecurity program update and time is reserved at each Audit Committee meeting for cybersecurity technology matters that warrant discussion between the standing sessions. In addition, Enterprise Risk Management provides FIRMCo an assessment of cyber insurance risk once per year. The Audit Committee, FIRMCo and the full Board of Directors are apprised of developments in the external environment and business strategies that present additional potential cyber risk exposure to the Company on an as-needed basis. As a result, cybersecurity and cyber risk are typically discussed more frequently than the annual minimum requirements.


text: The Company has established an Executive Privacy & Security Council ("EPSC") that meets semi-annually. The EPSC consists of a cross-functional senior leaders, including the Chief Information Officer ("CIO"), the Chief Information Security Officer ("CISO"), the Chief Risk Officer ("CRO"), the Chief Privacy Officer ("CPO") and General Counsel, among others. The EPSC receives a monthly written executive briefing on topics, and with metrics related to cybersecurity, including incident prevention, detection, mitigation and remediation. Quarterly, the Information Technology ("IT') Risk Council, made up of senior IT leaders, is also provided with an update of cybersecurity risks and preparedness. Various other meetings are held on cybersecurity topics periodically, including monthly business operating reviews, and meetings of the Enterprise Risk and Capital Committee ("ERCC") and executive leadership team.


text: Part I - Item 1C. Cybersecurity Both the CIO and the CISO have expertise assessing and managing cybersecurity risks. The CIO has served in her current role since 2019 and served in similar technology leadership roles before her current role. She has nineteen years of executive leadership experience in the financial services industry and twenty-nine years of overall technology experience, during which time she has led large scale business transformation, delivered innovative technology strategies and has overseen and modernized complex technology portfolios.


text: The CISO has held several senior-level information technology roles in his twenty-six-year tenure with the Company and has served in his current role since 2021. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: RISK MANAGEMENT AND STRATEGY We maintain a technology and cybersecurity program, which includes information security, as part of our overall risk management process with the aim that our information systems, including those of our vendors and other third-parties, will be resilient, effective and capable of safeguarding against emerging risks and cybersecurity threats. We endeavor to assure our program is appropriately resourced and to attract and retain expert talent to execute it.

companyName: BIOGEN INC.

ticker: BIIB


text: In designing, operating, evaluating and maintaining our program we use internal and external resources and frameworks, including cybersecurity expert consultants, industry working groups, the U.S. NIST Cybersecurity Framework and the U.S. Cybersecurity Agency's National Cyber Incident Scoring System model to benchmark, inform and evaluate the design of our program, our operational capabilities and our program maturity.


text: Consistent with NIST 800-53, our technology and cybersecurity program and controls include a third party and vendor risk management component. As part of our vendor risk management program, we conduct security assessments prior to engagement of high-risk vendors and other third-party providers and have a monitoring program to evaluate ongoing compliance with our cybersecurity standards.


text: A key element of our technology and cybersecurity program strategy is fostering training and awareness. Our training and awareness program includes annual cybersecurity awareness training and role-based phishing tests for our employees and for third parties with access to our systems.


text: Our technology and cybersecurity program focuses on the defense, rapid detection and rapid remediation of cybersecurity threats and incidents. Our program includes systems and processes designed based on defense-in-depth and zero-trust architectural principles and that are intended to provide the control capabilities set forth in NIST's 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations. Our program also includes cybersecurity policies and a crisis response and management plan that is intended to allow rapid management and response and appropriate communication of cybersecurity threats and incidents.


text: We staff a cybersecurity operations center to respond to threats and incidents. Our cybersecurity crisis management plan sets forth the items, procedures and actions we expect to address and follow in the event of a cybersecurity incident, including detection, response, mitigation and remediation. In addition to the cybersecurity operations center and our designated cybersecurity response team, we maintain a cross-functional cybersecurity crisis core team, which includes our CISO and senior representatives from our Legal, Finance, IT and Corporate Security teams.


text: When a potential threat or incident is identified, our cyber security incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our CISO. Our CISO, Chief Legal Officer and Chief Financial Officer, will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management or our Executive Committee. Our Executive Committee will inform our Board of Directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.


text: Our program's maturity and operational readiness are regularly evaluated by independent experts using the U.S. NIST's CyberSecurity Framework and penetration tests. Our program, and the results of these independent evaluations and testing, are regularly reviewed by our senior management and members of our Board of Directors.


text: CYBERSECURITY RISK GOVERNANCE We are committed to appropriate cybersecurity governance and oversight. Our technology and cybersecurity program is the principal responsibility of our Chief Information Officer and CISO, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, we have a Cybersecurity steering committee that includes senior representatives from our Legal, Finance and IT departments, which meets regularly to discuss cybersecurity matters.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, internal audits of our program, independent external expert evaluations of our program's maturity and operational readiness and the results of penetration testing. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident report and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: For additional information on our cybersecurity risks, please read Item 1A. Risk Factors - A breakdown or breach of our technology systems could subject us to liability or interrupt the operation of our business, included in this report.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, internal audits of our program, independent external expert evaluations of our program's maturity and operational readiness and the results of penetration testing. Our Board of Directors also receives cybersecurity updates and education on a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident report and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: We do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition during the period covered by this filing. For additional information on our cybersecurity risks, please read Item 1A. Risk Factors - A breakdown or breach of our information systems could subject us to liability or interrupt the operation of our business, included in this report.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with global regulatory controls; user and employee awareness of cyber policies and practices; information systems configuration management; third-party risk management systems; identity and information asset protection; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: Our cybersecurity program is integrated into our overall risk management systems, including our annual enterprise risk management program, internal audit program, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. As part of our overall risk management program, we maintain a global insurance portfolio with comprehensive cyber coverage. Our Chief Information Security Officer ("CISO") and the Information Security function advises, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.


text: While our board of directors has oversight responsibility for risk management generally, the Audit and Finance Committee ("Audit Committee") is specifically responsible for overseeing our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our CISO provides periodic updates to the Audit Committee in this regard, and covers the state of our cybersecurity program, supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third-party service providers; the board will be informed promptly of material risks from cybersecurity threats.


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our CISO, Michael Daly. Mr. Daly has more than 35 years of experience in security and information systems and spent 25 years with Raytheon Technologies, most recently as Chief Technology Officer of Cybersecurity, Special Missions, Training & Services. Mr. Daly supported the U.S. President's National Security Telecommunications Advisory Committee for more than 20 years, is a member of the Massachusetts Cybersecurity Strategy Council, and is Chair of the Kogod Cybersecurity Governance Center at American University. Formerly, he served on the Rhode Island Homeland Security Advisory Board and was a member of various commercial cyber product councils.


text: Mr. Daly oversees a team of skilled cybersecurity professionals who have Certified Information Systems Security Professional ("CISSP") credentials, Global Information Assurance Certification from the SANS Institute, and other security and network certifications. The cybersecurity team monitors and evaluates our cybersecurity posture and performance on an ongoing basis, including through regular vulnerability scans, penetration tests, and threat intelligence feeds. The cybersecurity team uses various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence, and assesses and evaluates cybersecurity incidents, escalating certain cybersecurity incidents to Mr. Daly according to protocol. Mr. Daly is continually informed regarding the performance of the cybersecurity program, as well as the latest developments in cybersecurity, including potential threats and innovative risk management techniques.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with global regulatory controls and aligned with National Institute of Standards and Technology Cybersecurity Framework; user and employee awareness of cyber policies and practices; information systems configuration management; third-party risk management systems; identity and information asset protection; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program, including audit and compliance, threat hunting, monitoring, and end-user support.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. Similar to other companies, we have experienced cybersecurity incidents, including temporary service interruptions of third-party suppliers. As of the date of this report, however, known cybersecurity incidents, individually or in aggregate, have not had a material impact on our company. Over the last three years, net expenses incurred from any information security breaches, including any penalties and settlements, are not material relative to our total revenue. For additional discussion on cybersecurity risks we face, see Item 1.A Risk Factors — A breakdown or breach of our information technology systems could subject us to liability or interrupt the operation of our business.


text: While our board of directors has oversight responsibility for risk management generally, the Audit and Finance Committee ("Audit Committee") is specifically responsible for overseeing our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our CISO provides quarterly updates to the Audit Committee in this regard, and covers the state of our cybersecurity program, supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third-party service providers; the board will be informed promptly of material risks from cybersecurity threats.


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our CISO, Michael Daly, who has more than 35 years of experience in security and information systems and spent 25 years with Raytheon Technologies, most recently as Chief Technology Officer of Cybersecurity, Special Missions, Training & Services. Our CISO supported the U.S. President's National Security Telecommunications Advisory Committee for more than 20 years, is a member of the Massachusetts Cybersecurity Strategy Council, and previously served as Chair of the Kogod Cybersecurity Governance Center at American University. He also served on the Rhode Island Homeland Security Advisory Board and was a member of various commercial cyber product councils.


text: Our CISO oversees a team of skilled cybersecurity professionals who have Certified Information Systems Security Professional ("CISSP") credentials, Global Information Assurance Certification from the SANS Institute, and other security and network certifications. The cybersecurity team monitors and evaluates our cybersecurity posture and performance on an ongoing basis, including through regular vulnerability scans, penetration tests, and threat intelligence feeds. The cybersecurity team uses various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence, and assesses and evaluates cybersecurity incidents, escalating certain cybersecurity incidents to the CISO according to protocol. The CISO is continually informed regarding the performance of the cybersecurity program, as well as the latest developments in cybersecurity, including potential threats and innovative risk management techniques aligned with industry standards. The CISO reports to our Chief Scientific Officer ("CSO"). Our CSO is an executive officer and leads internal research and external innovation, corporate data strategy, technology and data sciences, and reports directly to our CEO.


text: Risk Management and Strategy BOK Financial is committed to safeguarding company and client information through protections integrated into all lines of business, support functions and third-party relationships. To effectively manage cybersecurity risks mentioned in Item 1A, our cybersecurity risk management program evaluates the likelihood and potential damage of internal and external threats. We also evaluate the adequacy of our policies, procedures, and capabilities in place to mitigate cyber risk at least annually.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Each employee and contractor is responsible for the security and confidentiality of company and client information. This expectation is communicated at on boarding and through required annual data security and privacy trainings; frequent internal publications; and annual employee attestations to the Company's Standards of Conduct. BOK Financial regularly conducts risk assessments to evaluate internal controls implemented to prevent and detect data breaches. These controls are aligned with ISO 27001:2013 and the NIST Cybersecurity Framework and are frequently monitored to ensure their effectiveness. The controls are routinely tested via tabletop exercises and reviewed by internal auditors.


text: Vulnerability and penetration assessments are also conducted at least annually by an independent third party. In addition to a strong set of internal controls, the company has implemented a robust due diligence process for third-party providers prior to executing an agreement. Risk assessments include evaluating the third-party's security posture through intelligence feeds, SOC reports, ISO certifications and self-attestation questionnaires. Third parties processing customer data are contractually required to meet all legal obligations for protecting against anticipated security threats to client data, protecting against unauthorized access to client data, and ensuring proper disposal of client data.


text: An array of protective technologies have been implemented to detect and respond to indicators of malicious behavior before an incident ever takes place; however, should a cybersecurity incident occur, the Company has incident response and recovery procedures, which include determination of materiality and proper notification and reporting to the appropriate parties. These include legal and regulatory reporting requirements as well as notifications to impacted customers. The Company collaborates with peer financial institutions, local universities, threat intelligence organizations, third-party providers, law enforcement and our customers to share tactical threat intelligence and best practices in protecting against emerging threats.


text: Results of cybersecurity risk assessments and tabletop exercises are reported to governance committees and aid in the development of our cybersecurity strategy, which takes into account the Company's strategic objectives and our ability to navigate potential internal and external disruptions. The overarching objective of our cybersecurity strategy is to reduce risk and enhance the resilience of our assets. Four key components support this objective: enabling our cyber defense posture, creating and retaining cyber-aware customers, considering identities at system access, and preparing a cyber-resilient workforce. Our cybersecurity team operates under eight distinct programs, each led by a subject matter expert. Each program has its own strategy, projects, and initiatives designed to achieve the overall strategic objective and its key components.


text: The collective framework, regulatory compliance requirements, and associated controls are collectively referred to as the ISMS. The ISMS provides a comprehensive structure that supports the Information Security Program designed to safeguard information technology resources, maintain the confidentiality, integrity and availability of data, and manage the resources used to provide technology and security services to the organization.


text: To date, no cybersecurity threats or incidents have materially affected, or are reasonably likely to affect, the Company including its business strategy, results of operations, or financial condition.


text: The Company's cybersecurity program is overseen by the Risk Committee of the Board, which is responsible for ensuring the program is well resourced and able to protect the security and confidentiality of our data and that of our clients. The program is managed by the CISO who reports to the chief risk officer and is reviewed by regulators, as well as internal auditors. The CISO provides quarterly information security updates to the Risk Committee as well as the Company's executive-level Risk Council on cybersecurity programs, policies and controls; efforts to improve security; and responses to cybersecurity events. Annually, the CISO meets with the Risk Committee of the Board of Directors to communicate the Board's responsibilities for cybersecurity and privacy, as well as the cybersecurity program's strategy for addressing emerging risks and regulatory requirements.


text: The Company's CISO has over 26 years of building and operating enterprise security functions, security engineering, and security governance and program management. Prior to joining the Company, the CISO managed an Information Security and Risk Management program within a Fortune 500 energy company that handled a wide variety of information security issues including industrial control system security. The CISO has also served on the board of several academic institutions, professional service organizations, and local non-profits and contributed on many special committees for cybersecurity initiatives.


text: Risk Management and Strategy BOK Financial is committed to safeguarding company and client information through protections integrated into all lines of business, support functions, and third-party relationships. To effectively manage cybersecurity risks mentioned in Item 1A, our cybersecurity risk management program evaluates the likelihood and potential damage of internal and external threats. We also evaluate the adequacy of our policies, procedures, and capabilities in place to mitigate cyber risk at least annually.


text: Each employee and contractor is responsible for the security and confidentiality of company and client information. This expectation is communicated at onboarding and through required annual data security and privacy trainings; frequent internal publications; and annual employee attestations to the Company's Standards of Conduct. BOK Financial regularly conducts risk assessments to evaluate internal controls implemented to prevent and detect data breaches. These controls are aligned with ISO 27001:2013 and the NIST Cybersecurity Framework Version 2.0 and are frequently monitored to ensure their effectiveness. The controls are routinely tested via tabletop exercises and reviewed by internal auditors.


text: Vulnerability and penetration assessments are also conducted at least annually by an independent third party. In addition to a strong set of internal controls, the Company has implemented a robust due diligence process for third-party providers prior to executing an agreement. Risk assessments include evaluating the third party's security posture through intelligence feeds, SOC reports, ISO certifications, and self-attestation questionnaires. Third parties processing customer data are contractually required to meet all legal obligations for protecting against anticipated security threats to client data, protecting against unauthorized access to client data, and ensuring proper disposal of client data.


text: An array of protective technologies have been implemented to detect and respond to indicators of malicious behavior before an incident ever takes place; however, should a cybersecurity incident occur, the Company has incident response and recovery procedures, which include determination of materiality and proper notification and reporting to the appropriate parties. These include legal and regulatory reporting requirements as well as notifications to impacted customers. The Company collaborates with peer financial institutions, local universities, threat intelligence organizations, third-party providers, law enforcement, and our customers to share tactical threat intelligence and best practices in protecting against emerging threats.


text: The Company's cybersecurity program is overseen by the Risk Committee of the Board, which is responsible for ensuring the program is well resourced and able to protect the security and confidentiality of our data and that of our clients. The program is managed by the CISO who reports to the chief risk officer and is reviewed by regulators, as well as internal auditors. The CISO provides quarterly information security updates to the Risk Committee as well as the Company's executive-level Risk Council on cybersecurity programs, policies and controls, efforts to improve security, and responses to cybersecurity events. Annually, the CISO meets with the Risk Committee of the Board of Directors to communicate the Board's responsibilities for cybersecurity and privacy, as well as the cybersecurity program's strategy for addressing emerging risks and regulatory requirements.


text: The Company's CISO has over 28 years of experience building and operating enterprise security functions, security engineering, and security governance and program management. Prior to joining the Company, the CISO managed an Information Security and Risk Management program within a Fortune 500 energy company that handled a wide variety of information security issues including industrial control system security. The CISO has also served on the board of several academic institutions, professional service organizations, and local non-profits and contributed on many special committees for cybersecurity initiatives.


text: Risk Management and Strategy We maintain a comprehensive cybersecurity program and continuously assess our approach against industry best practices. Our focus on cybersecurity risk management, including risk identification, analysis, and response, centers on the following areas: • Enterprise security: We reference industry-accepted control frameworks, compliance regulations, privacy requirements and best practices. • Product security: Our development teams participate in regular training and adopt industry best practices to enhance the security of our product portfolio. • Threat landscape analysis: We continuously assess emerging threat vectors and the evolving data privacy regulatory environment. • Incident response: We continuously monitor the threat landscape and our systems in coordination with an external monitoring firm and regularly test our incident response preparedness.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: We actively participate in the cybersecurity community to stay current regarding best practices and continuously improve our security awareness posture. Our employees are engaged in security and privacy awareness training to enhance the protection of our systems and data. In addition, we incorporate data and privacy protection education in our customer engagement through ongoing resources, such as best practices content and security consultations. We also assess third-party service providers for cybersecurity risks at onboarding, refreshing as needed throughout our engagement.


text: We also engage third-party resources to assist in our cybersecurity program, including annual ISO 27001 assessments of our cybersecurity program, validation of our SOC2 controls' operational effectiveness for certain products, and retaining leading cybersecurity experts as needed in response to cybersecurity incidents and for other consultative needs (e.g., due diligence of potential acquisitions).


text: Our multi-level cybersecurity governance and risk management structure begins with our management-level Enterprise Risk Management ("ERM") Committee, which consists of cross-functional management representatives throughout Progress. The ERM Committee receives detailed cybersecurity information from key security personnel, led by our Chief Information Security Officer ("CISO"), and reports to Progress' Chief Executive Officer, Chief Financial Officer, Chief Information Officer, Chief Legal Officer, and other members of CEO Staff at least quarterly.


text: Our CISO has significant information technology experience, having served in various roles in information technology and information security for more than 20 years, including serving in various cybersecurity leadership roles within public and private companies. He holds an undergraduate degree in management and obtained CISO Executive Education Certification from Carnegie Mellon University. Cybersecurity leaders reporting to our CISO also have significant relevant experience and industry recognized certifications.


text: Our CISO has routinely reported to the Audit Committee of our Board of Directors at the Audit Committee's regular quarterly meetings, or more frequently as needed. The Audit Committee's duties include, among other things, oversight of risks related to cybersecurity, as well as our broader ERM program. The Audit Committee communicates regularly with our full Board of Directors, which is ultimately responsible for overall risk oversight for Progress.


text: Additionally, our cybersecurity incident response plans require timely reporting to our Disclosure Committee ("DC") regarding any potentially material cybersecurity incidents. The DC is tasked with evaluating the materiality of any such incidents and is comprised of our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, and supported by key leaders across the organization, including our Chief Information Officer and CISO.


text: Notwithstanding our commitments to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Please see Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: MGIC's Information Security Program includes information security policies, annual risk assessments and analyses, threat monitoring and alerting, vulnerability management, incident response, and data loss prevention controls. With this program, MGIC seeks to prevent, detect, and respond to unauthorized access, use, or disclosure of confidential information.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: MGIC's Information Risk Management (IRM) team is responsible for safeguarding the organization's information assets, data, and technology infrastructure from security threats and vulnerabilities. The IRM team's primary focus is the protection of the confidentiality, integrity, and availability of sensitive information and compliance with relevant laws, regulations, and industry standards.


text: Various aspects of the Information Security Program are subject to periodic audit by the Company's Internal Audit department or third-party professionals engaged by the Internal Audit department. Such audits vary from year-to-year but are generally focused on compliance with stated control activities, standards, and internal policies, as well as maintaining the integrity and independence of the audit process. Cybersecurity risk reviews such as SOC2, SOX controls, Penetration Tests, and regulatory controls are conducted by independent third parties.


text: The Information Security Program also incorporates a vendor due diligence process that is designed to evaluate whether a vendor or third-party service provider that receives confidential data meets MGIC's information security governance, risk, and compliance requirements. The process includes assessing and managing the cyber risks associated with engaging third-party vendors and reviewing their information security practices.


text: In the event of a suspected or threatened cybersecurity incident, the Company's Chief Information Security Officer ("CISO") determines whether to activate the Company's Cyber Incident Response Team ("CIRT"), composed of different subject matter experts from applicable domains such as network, infrastructure, and application areas in order to evaluate the technical issues relative to the incident. The CIRT is overseen by the CISO. If necessary, the CIRT may engage third-party cybersecurity experts to evaluate and/or remediate the incident. In the event that the CIRT confirms that the incident relates to a cybersecurity incident or compromise of MGIC's computer systems, the CISO will notify the General Counsel, who will advise the Chief Executive Officer ("CEO"), who is a member of the Board of Directors. In addition to advising the CEO, the General Counsel will also convene an established committee whose members include the General Counsel, Chief Financial Officer, Senior Vice President of Investor Relations, and Chief Accounting Officer in order to determine if the event is a material cybersecurity incident so as to trigger an Item 1.05 filing on Form 8-K. If a determination is made that the event is material, or if the CEO or General Counsel otherwise determines it advisable, the CEO or General Counsel, or a delegate thereof, shall notify the Chairman of the Board, Lead Independent Director, and Chairpersons of the Board's Business Technology and Transformation Committee (the "BTTC") and Audit Committee.


text: To our knowledge, there have been no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.


text: If a cybersecurity incident were to occur, it could affect our operations, results of operations, or financial condition as described in our Risk Factors titled "Information technology system failures or interruptions may materially impact our operations and/or adversely affect our financial results" and "We could be materially adversely affected by a cybersecurity breach or failure of information security controls."


text: The CISO partners with the Company's Risk Department to promote alignment of cybersecurity risk management strategy with the broader risk management strategy for the organization. The integration of information security into the overall enterprise risk management framework enables collaboration on the identification, assessment, mitigation and monitoring of cybersecurity risks that have the potential to materially impact the operation of the Company.


text: The Risk Management Committee of the Board coordinates with the Board and other Board committees regarding the assignment to the Board and Committees of oversight responsibilities for all identified key risks to the Company. Risks related to cybersecurity are overseen by the BTTC. The BTTC monitors cybersecurity risks associated with both internal and external actors, including third-party vendors and service providers. Additional information about the BTTC's role in overseeing risks related to cybersecurity and information technology generally can be found in the Committee's Charter at mtg.mgic.com/corporate-governance/highlights.


text: The CISO provides quarterly updates about the Company's cybersecurity program to the BTTC. Updates may include topics such as management's efforts to identify and monitor risks, investments to improve the Company's detection and response systems, the results of risk assessments, compliance with controls, vendor oversight, strategic technology planning, and if necessary, the status of any new, ongoing, or prior cybersecurity incident. The CISO also periodically attends the BTTC meetings.


text: MGIC Investment Corporation and Subsidiaries The Company's current CISO, Jennifer Westphal, is responsible for assessing and managing the material risks posed by cybersecurity threats. Ms. Westphal has over 25 years of experience in information technology, with 18 of those years focused on cybersecurity. Ms. Westphal has been with the Company for more than ten years and was promoted to the position of CISO in January 2021. Prior to 2021, Ms. Westphal served as the Deputy CISO and before that, as the Director of Information Risk Management.


text: RISK MANAGEMENT AND STRATEGY MGIC's Information Security Program (ISP) includes information security policies, annual risk assessments and analyses, threat monitoring and alerting, vulnerability management, incident response, and data loss prevention controls. With the ISP, MGIC seeks to prevent, detect, and respond to unauthorized access, use, or disclosure of confidential information.