text: The information set forth under "Legal Contingencies" in Note 15 (Commitments and Contingencies) to our Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," is incorporated herein by reference.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such material risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal red team program, which simulates cyber threats, intended to allow us to address vulnerabilities before threat actors identify them; and (5) a threat intelligence program designed to model and research our adversaries. These processes vary in maturity across the business and are processes we work to continually improve.

companyName: DROPBOX, INC.

ticker: DBX

secItem: Item 1C


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct regular tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business could be damaged, and we could be subject to liability, if there is any unauthorized access to our data or our users' content, including through privacy and data security breaches or incidents," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors is actively involved in overseeing cybersecurity risk management. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Dropbox's business strategy. Additionally, our audit committee oversees programs and policies related to cybersecurity risks and initiatives. Our audit committee is comprised entirely of independent directors who evaluate these issues at least quarterly.


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage and mitigate security and privacy risks. Members of this team also report periodically to the board of directors, audit committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Business Foundations, our Head of Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Business Foundations has been with us since 2020, and has worked in the technology industry for over 20 years, working in product development, engineering, and security leadership and risk management roles over that time. Our Head of Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.


text: Members of senior leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Additionally, all employees are required to complete annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education via informational emails, talks and presentations, and resources available on our intranet.


text: Our process for identifying and assessing material risks from cybersecurity threats (our "Cybersecurity Process") operates alongside our broader overall risk assessment process, covering other risks facing the company. As part of our Cybersecurity Process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess the severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Our cybersecurity risk management approach is supplemented by external and internal management audits against commonly accepted frameworks, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program through which security researchers can help identify vulnerabilities in our systems before threat actors do. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We have in the past and may continue to experience privacy and data security breaches or incidents" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors is actively involved in overseeing cybersecurity risk management. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Dropbox's business strategy. Additionally, our Audit Committee oversees programs and policies related to cybersecurity risks and initiatives. Our Audit Committee is comprised entirely of independent directors who evaluate these issues at least quarterly.


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage, and mitigate security and privacy risks. Members of this team also report periodically to the Board of Directors, Audit Committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, the AGM's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.


text: Risk Management and Strategy Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise and third-party suppliers and vendors, and monitoring such risks and threats is integrated into the Company's overall risk management program.

companyName: General Motors Co

ticker: GM


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and certain incident information are reviewed by the Company's Chief Cybersecurity Officer (CCO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.


text: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.


text: As cybersecurity incidents occur, the GM Cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the Cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CCO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to GM's Executive Vice President, Legal, Policy, Cybersecurity, and Corporate Secretary as well as to the Risk and Cybersecurity Committee. The CCO has served in this role for four years, and has more than 11 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CCO holds a bachelor's degree in electrical engineering and a master's degree in systems engineering, with over 10 years of previous software and hardware systems engineering experience. The CCO chairs the Automotive – Information Sharing and Analysis Center (ISAC) and serves on the Department of Homeland Security – Cybersecurity and Infrastructure Security Agency (DHS-CISA) Advisory Committee.


text: The CCO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CCO and the Cybersecurity Management Board, as appropriate. As discussed above, the CCO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: Risk Management and Strategy We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. We have implemented cybersecurity policies, procedures, technologies and controls to aid in our efforts to access, identify and manage such risks. Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise, service providers such as data processors, third-party suppliers, dealers and vendors, and monitoring such risks and threats are integrated into the Company's overall risk management program.


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and incident information are reviewed by the Company's Chief Information Security Officer (CISO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.


text: The Company maintains administrative, physical, technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.


text: When cybersecurity incidents occur, the GM Cybersecurity team's focus is on responding to and containing the threat and minimizing impact. When we become aware of a cybersecurity incident, we have defined policies and procedures to respond to and recover from such incident as quickly as possible. In the event of a cybersecurity incident, the Cybersecurity team also assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement, as appropriate. Our policies and procedures are reviewed periodically for alignment with regulatory requirements and the threat landscape.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing our cybersecurity program, among other things. The Company's cybersecurity organization is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to the Risk and Cybersecurity Committee. The CISO has served in this role since December 2024 and has more than 20 years of experience in various information technology, cybersecurity and software engineering roles. The CISO's experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software engineering teams responsible for building and operating large-scale software services. The CISO also has expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The CISO holds a master's degree in information security policy and management, has taught information security courses at the graduate level, is an inventor on cybersecurity-related patents and has been a speaker at leading cybersecurity conferences.


text: The CISO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the Risk and Cybersecurity Committee, as appropriate, and simulated exercises.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest information.

companyName: Hyatt Hotels Corp

ticker: H


text: We design and assess our security program using an internally-developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program includes: • a cybersecurity department principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally-managed vendors based on their criticality to our business and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding significant cybersecurity incidents or updates.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. From time to time, board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity department provides reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.


text: Our CISO and cybersecurity department collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third party risk management, threat intelligence, and cloud security areas. Our CISO and cybersecurity department personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest and colleague information.


text: Key elements of our cybersecurity risk management program include: • cybersecurity and information technology governance departments principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally managed vendors based on their criticality to our business and risk profile.


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity and information technology governance departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity and information technology governance departments provide reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.


text: Our CISO and cybersecurity and information technology governance departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third-party risk management, threat intelligence, and cloud security areas. Our CISO and the personnel of our cybersecurity and information technology governance departments are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Rent the Runway, Inc.

ticker: RENT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is managed separately from our other risk management programs.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for certain third-party service providers, suppliers, and vendors based on, among other things, their criticality to our operations, access to RTR data, cybersecurity risk profile, and business requirements.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations." and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our full Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on cybersecurity risks. In addition, management is responsible for updating the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISOs experience includes developing secure products as well as head of security and CISO positions at both public and private companies.


text: Under the supervision of our SVP, Engineering and our VP, IT, Infra & Security, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations. " and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISO's experience includes developing secure products as well as head of security and CISO positions at both public and private companies.


text: Under the supervision of our SVP, Engineering and our VP, Technology & CISO, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery and remediation efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and participants in our vulnerability disclosure program; and alerts and reports produced by security tools deployed in our IT environment. The security team, under the leadership of the SVP, Engineering and VP, Technology & CISO, meet periodically to review the status of the cybersecurity program, including, as applicable, the status of regularly monitored cybersecurity benchmarks, responses to external or internal incidence or intelligence, oversight of third-party vendors, and progress against discrete program goals. Trends in risks, risk mitigations, long-term progress against program goals, and discrete intelligence or incidents discussed in these meetings are then shared in periodic cybersecurity reports to the Board.


text: As a provider of cybersecurity offerings, we understand that threat actors are increasingly becoming more sophisticated and extremely effective at compromising information and operational technologies. As this trend continues, it is vital that we have processes in place to timely and accurately detect, mitigate, respond to, and remediate cybersecurity incidents, threats or vulnerabilities that may create a material risk to our Company, that could, if the risk occurs, materially impact our Company, including, but not limited to, our financial condition and results of operations. For additional information regarding the variety of material risks we may face, including, but not limited to, those that relate to cybersecurity, refer to "Part I – Item 1A – Risk Factors" in this report.

companyName: SecureWorks Corp


text: While our enterprise risk management program considers cybersecurity risks alongside other significant business risks, we also maintain robust cybersecurity processes, technologies, and controls to aid our efforts to identify, assess, and manage material risks posed to our Company. Annually, we conduct an information security risk assessment, and we periodically review our security architecture and assess third-party vendors that we use. We continuously monitor for security risks and vulnerabilities posed by the technological tools and people enabled processes we utilize. In addition, we employ a range of tools and services, including network and endpoint monitoring, third-party penetration testing, and periodic tabletop exercises to ensure timely discovery of, response to, and remediation of, security incidents. While we assess and monitor for security risks and vulnerabilities posed by our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that our assessment and monitoring of such third parties will prevent or mitigate the risk of any compromise or failure in the information assets they own or control.


text: Our internal security controls are designed to align with standards set by the National Institute of Standards and Technology, or NIST, and the International Organization for Standardization, or ISO. In addition, our security processes are assessed by the Federal Financial Institutions Examination Council, or FFIEC, due to our status as a cybersecurity provider to several financial institutions and financial services organizations. Our security processes also are tested or assessed in accordance with the Sarbanes-Oxley Act of 2002, compliance obligations under the Service Organization Control Type 2 auditing procedure, or SOC2, and applicable privacy laws, both in the United States and internationally.


text: Our internal security controls and our cybersecurity processes, technologies, and controls are governed by the Company's Chief Security Officer and Chief Information Security Officer, or CISO, who reports quarterly on security matters, including cybersecurity, to the Company's internal Enterprise Risk Committee. Our CISO has been with us since 2011 and has worked in cybersecurity for over 21 years. In addition, as a provider of cybersecurity offerings, we employ numerous leaders who have experience in the cybersecurity industry. All Company employees must complete required annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education through emails, presentations, and other available training materials on our intranet. Pursuant to the Board's oversight of the Company's operational risk management, the Board has designated authority and responsibility to its Audit Committee to regularly review our processes and procedures for managing cybersecurity risks and handling cybersecurity incidents. The Audit Committee receives quarterly updates from the CISO and others from the CISO's security team regarding our security programs, including a review of cybersecurity risks, threats, and vulnerabilities. Additionally, the Board of Directors receives an annual report on the cybersecurity threat landscape from at least one senior leader.


text: Our Company, through the leadership of the CISO, utilizes a variety of security governance and operational processes to manage our secure use of technology, including, but not limited to, the management of risks from insiders, third-parties, security controls, vulnerabilities, threats, and incident response.


text: We have adopted a comprehensive cybersecurity assessment framework, which is integrated into our security team's processes to ensure cybersecurity incidents are assessed and escalated in a timely manner, so that certain leaders within our organization further investigate, respond to, and remediate, the incident. Certain members of the Company's executive leadership team will also consider potentially applicable legal and regulatory obligations and take action to mitigate brand and reputational damage. In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. If a cybersecurity incident is determined to be material, in accordance with reporting requirements applicable to us, our comprehensive cybersecurity assessment framework outlines our controls and the procedures adopted to ensure timely compliance with our reporting obligations.


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: Millburn Multi-Markets Fund L.P.


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Sunrun Inc.

ticker: RUN


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which helps identify our cybersecurity threat risks by considering certain industry standards as well as by engaging third parties to assess the security posture of our information security program.


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing email simulations for employees and contractors with access to corporate email systems; • require employees, and certain service providers, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.


text: We describe the risks from cybersecurity threats that may materially affect us and how they may do so under the heading "Risks Related to Our Business Operations" under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer (CISO) in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs, and our CISO has both CISSP and CRISC certifications.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, these members of management report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters at least annually, with updates to the Audit Committee on a quarterly basis.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which surfaces cybersecurity risks by measuring our posture against industry standards and engaging third parties to assess our information security program.


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing security training for employees and contractors with access to corporate email systems; • require employees, and data service providers with whom we share customer, employee or partner data, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance. In addition to maintaining a robust incident response plan, we regularly test our response capabilities through real-world simulations, post-incident reviews, and lessons-learned exercises to ensure continuous improvement in our ability to respond effectively to cybersecurity incidents.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Our cybersecurity program is closely aligned with our commitment to data privacy. We adhere to applicable data protection laws and regulations, integrate privacy-by-design principles into our processes, and routinely assess our practices to ensure that we protect customer, employee, and partner information. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.


text: Cybersecurity Incidents During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have encountered routine cybersecurity threats and attempted attacks, such as phishing emails and malware attempts, our security measures have effectively mitigated these risks without causing material disruption.


text: Despite our efforts, the risk of cybersecurity incidents remains, and we continue to monitor, adapt and enhance our security posture to address evolving threats. Any future cybersecurity breaches or system vulnerabilities could impact our business operations, reputation and regulatory compliance obligations. We remain committed to maintaining a robust cybersecurity program to mitigate these risks.


text: We provide disclosures on the potential material impacts of cybersecurity threats on our business operations, which are detailed under the heading 'Risks Related to Our Business Operations' in Item 1A of this Annual Report on Form 10-K, and those disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is a critical component of our enterprise risk management framework and a key area of focus for both our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also integrated into Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP Information Security in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including credit, market, treasury, operational, compliance, model and data, and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the Chief Information Officer and, as discussed below, periodically to the Innovation and Technology Committee of our board of directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practices recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited periodically in accordance with our Board approved Internal Audit plan.


text: We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: We maintain both an Incident Response Plan and a Crisis Management Plan (the "Plans") that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Innovation and Technology Committee of our board of directors. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the Chief Information Officer, and key members of management are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually. Integral elements of the Plans related to the Company's response to security vulnerabilities include the following.


text: • Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents. • Coordinating Incident or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents. • Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by our Chief Information Security Officer and their team. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 20 years of cybersecurity experience, 12 of which was spent at the Company.


text: Our Operational Risk Management group provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer.


text: Our board of directors has established management committees including the Information Technology Steering Committee, which focuses on technology and business impact, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and are chaired by the Chief Information Officer and Chief Operational Risk Management Officer, respectively, and include the Chief Information Security Officer and other key departmental managers from throughout the entire company. The Information Technology Steering Committee meets monthly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Innovation and Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Innovation and Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews key metrics summarizing our cyber security risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.


text: Lastly, at least annually, the CISO reports directly to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance, model and data, and reputational risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for system failure, interruption, or a cybersecurity breach to occur, which could disrupt business operations or compromise confidential, personal, sensitive or proprietary information. Our CISO is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the CIO (who then reports directly to our Chief Executive Officer) and, as discussed below, periodically to the Innovation and Technology Committee, Enterprise Risk Committee and to our Board of Directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.


text: In an effort to prepare for and respond to system failures, interruptions or cybersecurity breaches, the Company has implemented a multi-layered cybersecurity program that integrates people, technology, and processes and is intended to comply with the information security standards established pursuant to the Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B. This cybersecurity program includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts that penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practice and recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Maturity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to govern, identify, protect, detect, respond and recover from system failures, interruptions, and cybersecurity breaches. Our CISO and our CIO, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The cybersecurity program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We also employ a variety of preventative and monitoring tools designed to monitor, block, and provide alerts regarding suspicious activity including suspected. We have established processes and systems designed to mitigate cybersecurity risk, including regular and ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for incoming and outgoing malicious emails and monitor remote connections as a significant portion of our workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these their-party vendors, especially in the financial services industry, have access to confidential, personal, sensitive and proprietary information. To mitigate the cyber, privacy and other operational risks associated with the use of third-party vendors, the Company maintains a third-party risk management program, which is implemented through a third-party risk management policy and includes a detailed onboarding process and periodic reviews of third-party vendors with access to confidential, personal, sensitive and propriety information. The third-party risk management policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in alignment with the Interagency Guidance on Third-Party Relationships: Risk Management. The third-party risk management program is audited periodically in accordance with our Board approved internal audit plan.


text: We leverage internal and third-party auditors and independent third-party sources to periodically review our processes, systems, and controls related to our cybersecurity security program. This includes assessing control design and operating effectiveness and recommendations to strengthen our cybersecurity program. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: We maintain both an incident response plan and a crisis management plan (the "Plans") that provide a documented framework for responding to actual or potential system failures, interruptions, or cybersecurity breaches, including timely notification of and escalation to the appropriate Board-approved management committees as discussed further below. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the CISO and the CIO respectively, and key members of management who are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually.


text: Integral elements of the Plans related to the Company's response to cybersecurity vulnerabilities include the following: • Identifying the appropriate team and any appropriate sub-teams to address specific system failures, interruptions, or cybersecurity breaches, or categories thereof. • Coordinating incident or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified system failures, interruptions, or cybersecurity breaches. • Conducting post-incident reviews to gather feedback on incident response procedures and address any identified gaps in cybersecurity measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its incident response procedures.


text: Not withstanding our defensive measures and processes, the threats posed by system failures, interruptions, or cybersecurity breaches are severe. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.


text: Governance. Our CISO is accountable for managing our enterprise cybersecurity department and delivering our cybersecurity program. The responsibilities of this department include privacy, resiliency, cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by our CISO and their team. The cybersecurity department consists of cybersecurity professionals with varying degrees of education and experience. Individuals within the cybersecurity department are generally subject to professional education and certification requirements. Our CISO has substantial relevant expertise and formal training in the areas of cybersecurity risk management, including 25 years of cybersecurity experience in the financial services, retail, insurance sectors.


text: Our Board of Directors has established management committees including the Innovation and Technology Steering Committee (ITSC), which focuses on overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cybersecurity program. These committees provide oversight and governance of the cybersecurity program and are chaired by the CIO and Chief Operational Risk Management Officer, respectively, and include the CISO and other key departmental managers from throughout the Company. The ITSC meets quarterly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage cybersecurity risks. More frequent meetings occur from time to time in accordance with the incident response plan to facilitate timely informing and monitoring efforts. The CISO reports summaries of key issues, including significant system failures, interruptions or cybersecurity breaches, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the incident response plan). Additionally, the Chief Operational Risk Management Officer reports summaries of key cybersecurity risks to the Risk Committee of our Board of Directors on a quarterly basis.