text: Our Chief Information Security Officer meets regularly with our information technology teams as well as other members of management to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer also provides similar topical updates to the full board of directors at least annually.

companyName: AbbVie Inc.

ticker: ABBV

secItem: Item 1C


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program designed to protect our systems and the confidentiality, integrity and availability of our data.


text: We have implemented processes that are intended to govern, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, detect, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.


text: We also have invested in tools and technologies to protect our and our patients' and customers' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for emerging threats and risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees information to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles and for business functions who may be impacted by a cyber incident. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework and undergo a third-party assessment every two years to measure the maturity of our cybersecurity program against the NIST Cybersecurity Framework. In addition, we periodically engage third-party advisors to assess the effectiveness and capabilities of our cybersecurity program, strengthen our cybersecurity policies and practices and identify potential vulnerabilities of our systems.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personally identifiable information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personally identifiable information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. These relevant service providers are contractually required to notify us promptly of information security incidents that may affect our systems or data, including personally identifiable information. While we conduct due diligence on the security and business controls of our third-party service providers and take steps to monitor their compliance with our security requirements, we may not have the ability in all cases to effectively monitor or oversee the implementation of these control measures.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."


text: Our board of directors has risk oversight responsibility for AbbVie and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the board of directors on its risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program, which is designed to be business aligned, risk-focused and multi-faceted to protect our and our patients', customers' and business partners' data. Our board of directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.


text: The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the board of directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management program. The Audit Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.


text: Our cybersecurity program is led by our Chief Information Security Officer, who is responsible for assessing and managing our information security and technology risks (including cybersecurity). He has more than 25 years of experience in information security and information technology risk management, holding chief information security officer positions with Fortune 500 companies in the retail, healthcare and life sciences industries. He has also served on the Health-ISAC board of directors and is a Certified Information System Security Professional (CISSP).


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer and other senior information technology executives also provides similar topical updates to the full board of directors at least annually.


text: Eaton follows the U.S. National Institute of Standards and Technology (NIST) Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, Eaton maintains documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Eaton's reactive processes are captured primarily by a cyber incident response plan (the IRP), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to Eaton's technology environment and are refined iteratively. Further, Eaton has an information risk management program that includes a vendor risk assessment process, whereby Eaton systematically oversees and identifies risks from cybersecurity threats related to its use of third-party service providers.

companyName: Eaton Corp plc

ticker: ETN


text: The IRP is executed by an Incident Response Team (IRT), led by our Chief Information Security Officer (CISO). The exact composition of the IRT varies depending on the severity and potential impact of an incident, and will typically include stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, external auditors, forensic accountants, and consultants who are on retainer contracts for expedited availability.


text: While cybersecurity threats remain a risk to the Company's business operations (see discussion in Item 1A. Risk Factors.), our robust risk mitigation strategies have been effective. Accordingly, no such threats have materially affected or are reasonably likely to materially affect the company, our business strategy, results of operations or our financial condition. Governance.


text: While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CISO, who reports to the Company's CIO. Our CIO reports directly to the Chief Executive Officer. Our CISO leads a robust team of dedicated professionals that are responsible for a wide range of risk assessment and management and leads at least ten specialized teams of internal and external experts focusing on distinct categories of threats.


text: Eaton's Board of Directors is trained annually regarding incident response and risk management. While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. The Audit Committee also participates in risk management training related to cybersecurity risk management specifically.


text: At Progyny, cybersecurity risk management is an integral part of our broader risk management system and processes. Our cybersecurity risk management program incorporates industry-standard frameworks, policies and practices designed to protect the security of our technology infrastructure and sensitive information.

companyName: Progyny, Inc.

ticker: PGNY


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters including material cybersecurity threats and incidents.


text: We have established and test our disaster recovery plan and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessment and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we maintain various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity programs, developments in cybersecurity and updates to our cybersecurity programs and mitigation strategies.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – If our information technology systems, or those of our provider clinics, specialty pharmacies or other vendors lag, fail or suffer security breaches, we may incur a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and the results of operations" in this annual report on Form 10-K.


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters, including material cybersecurity threats and incidents.


text: We have established and test our disaster recovery plan, and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessments and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we have implemented various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. T he Audit Committee is responsible for ensuring that management has processes in place that are designed to identify and evaluate cybersecurity risks to which we are exposed and has implemented processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is overseen by our Chief Information Security Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and cybersecurity team are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity program, developments in cybersecurity and updates to our cybersecurity program and mitigation strategies.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—If our information technology systems, or those of the third parties with whom we do business, including our provider clinics, specialty pharmacies or other vendors, lag, fail or suffer cybersecurity breaches, we may experience a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and results of operations" in this Annual Report on Form 10-K.


text: We are managed and operated by the board of directors and executive officers of MPLX GP, our general partner and a wholly owned subsidiary of MPC. Our general partner has the sole responsibility for providing the employees and other personnel necessary to conduct our operations, including processes for the assessment, identification and management of material risks from cybersecurity threats.

companyName: MPLX LP

ticker: MPLX


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team to identify, assess and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.


text: MPC engages with external resources to contribute to and provide independent evaluation of MPC's cybersecurity practices, including a periodical assessment of our cybersecurity program performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO") and the MPLX GP Audit Committee of the MPLX GP Board use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify, protect, detect, respond and recover from cybersecurity incidents.


text: MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third party risk assessment processes.


text: As of February 28, 2024, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company, including our business, operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that these events may occur and could have a material adverse effect on our business, operations or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO provides regular cybersecurity briefings to the MPLX GP Board of Directors and the MPLX GP Audit Committee as needed, with a minimum of two briefings per year. The MPLX GP Audit Committee further reviews and provides input on our cybersecurity and information security strategy.


text: MPC's CISO is responsible for the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Operations & Engineering, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing.


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers.


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing, and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team and overseen by the Board to identify, assess, and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.


text: MPC engages with external resources to contribute to and provide independent evaluation of its cybersecurity practices, including a periodic assessment of its cybersecurity program that is performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team, through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO"), and the MPLX GP Audit Committee of the MPLX GP Board, use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify cybersecurity threats and protect against, detect, respond to and recover from cybersecurity incidents.


text: The information systems, data, assets, infrastructure, and computing environments of MPC's third-party service providers are also at risk of cybersecurity incidents. MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third-party risk assessment processes.


text: As of February 27, 2025, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the Partnership, including our business strategy, results of operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that cybersecurity incidents may occur and could have a material adverse effect on our business strategy, results of operations, or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO are responsible for managing risks from cybersecurity threats. The CDO and CISO provide regular cybersecurity briefings to the MPLX GP Board of Directors including the MPLX GP Audit Committee, with a minimum of two briefings per year and additional briefings as needed. The MPLX GP Audit Committee also has direct access to the CDO and CISO and their management teams for other updates on cybersecurity and information security strategy throughout the year. Additionally, the CDO and CISO, from time to time, meet with members of management to discuss cybersecurity risks, strategy, and threats.


text: MPC's CISO is responsible for implementing the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Engineering & Operations, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has more than 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing, including collectively serving as a chief information security officer for seven years at two publicly traded companies. Its CISO also holds an Executive Master in Cybersecurity degree, a Master of Computer Science degree, and undergraduate degrees in both computer science and mathematics.


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, its CDO was employed by General Electric Company ("GE") and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. MPC's CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: TransUnion

ticker: TRU


text: Our Information Security program is guided by the ISO/IEC 27001:2022 principles and led by a global-level Information Security Department that develops our security policies, standards and procedures. We seek to evolve our approach to protect against increasing and changing security threats around the world.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which reports to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), provides oversight of mitigation of key risks related to technology and information security. This oversight includes monitoring and approving relevant policies, projects, and programs for the enterprise risk assessments related to technology and information security. The STRC also serves as an escalation point to the ERMC with respect to technology and information security risks. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.


text: The ERMC, which meets monthly, also monitors TransUnion's risk and governance policies and procedures to ensure that TransUnion risks are within the Board-approved Global Risk Taxonomy, which is described below. The ERMC reviews the broader risk environment and provides direction to mitigate (to an acceptable level) identified risks that may adversely affect our ability to achieve strategic objectives. The ERMC stewards our Enterprise Risk Management Policy and additional enterprise policies in risk-related areas, such as privacy and information security and key issues are reported to the appropriate committee of the Board.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Risk and Compliance Committee of the Board. The Risk and Compliance Committee oversees the quality and effectiveness of our information security framework, including capabilities, policies and controls, and methods for identifying, assessing and mitigating information and cybersecurity risks. The Risk and Compliance Committee also assesses the effectiveness of the Company's management of information security-related risks, including consulting with internal and external advisors as appropriate.


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.


text: Our CISO supervises and assists the ERMC in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our CISO, along with the STRC, are responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.


text: Our Information Security program is led by a global-level Information Security Department that develops our security policies, standards and procedures guided by the ISO/IEC 27001:2022 principles and aligned to the Center for Internet Security controls. We seek to evolve our approach to protect against increasing and changing security threats around the world.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India and Asia Pacific who receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center for responding to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.


text: We have not identified incidents from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which escalates significant issues to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), is responsible for overseeing key risks related to technology and information security for the global enterprise. The STRC provides oversight to ensure key risks related to technology and information security have appropriate controls and mitigations in place. The STRC also oversees associated policies, projects and programs for enterprise risk assessments related to technology and information security. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, our cyber risk management program activities and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: monitoring and mitigating cybersecurity threats and risks with a defense structure to provide a third-party cybersecurity oversight program to effectively discover, analyze and understand oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets and information; and an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023, and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.


text: cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.


text: use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.


text: to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework. The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.


text: Role of Management management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.


text: framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board of Directors. audit over cybersecurity related activities is completed by an independent third party.


text: We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: To address risks from cybersecurity threats, we have implemented and maintain cybersecurity policies and procedures, including an incident response plan, and our managed services provider implements a number of cybersecurity technologies and controls, including but not limited to, vulnerability scans and patch management tools. Our current approach to managing cybersecurity risks is informed by periodic risk assessments conducted by our managed services provider that incorporates elements of a recognized industry framework and evaluates our cyber risk management controls. We have implemented a process for senior management to review assessments performed and determine the appropriate treatment of identified risks.


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information about the cybersecurity risks we face, see Item 1A "Risk Factors."


text: We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board was recently tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving reports from members of senior management, including the risk manager and CEO, on areas of identified material risk to the Company.


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data; actively monitoring and mitigating cybersecurity threats and risks with a defense structure to provide oversight, governance, challenge, and testing;


text: using a third-party cybersecurity oversight program maintaining oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023 and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.


text: cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.


text: We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines.


text: We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information.


text: Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.


text: to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework.


text: The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.


text: management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.


text: framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board annual audit over cybersecurity related activities is completed by an independent third party.


text: Risk Management and Strategy We depend on information technology ("IT") and operational technology ("OT") for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. The Partnership collaborates with third-party vendors to leverage managed security services, enhancing the Partnership's cybersecurity capabilities. The Partnership possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. The Partnership has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Board of Directors Oversight The board of directors of our general partner and executive leadership team at the Partnership are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the Partnership's resiliency against cyber threats. To assist in these efforts, the board of directors of our general partner has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.


text: Unresolved Staff Comments & Properties In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Partnership's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Partnership's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Partnership's digitalization, information and operational security policies help ensure strategic alignment of the Partnership's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology & Data Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership upholds a robust mandatory security awareness program, including required training and phishing campaigns for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2024, 2023 and 2022. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Unresolved Staff Comments, Cybersecurity Related Matters, Legal Proceedings and Mine Safety Disclosures In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Data Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Like all businesses, the Company faces cybersecurity threats, as the Company is reliant upon information systems and the Internet to conduct its business activities. For example, in connection with payment card sales and other transactions, including bank cards, debit cards, credit cards and other merchant cards, the Company processes and transmits confidential banking and payment card information. Additionally, as part of its normal business activities, the Company collects and stores sensitive personal information related to the Company's employees, customers, suppliers and other parties. Businesses, including those in our industry, and third parties on which we rely are frequently confronted with a broad range of cybersecurity threats, from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Although the Company employs measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personally identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. Any such incidents could compromise the Company's networks, or those of our vendors, or disrupt the Company's or our vendors' critical systems, and the information stored there, such as personally identifiable information or funds, could be accessed, publicly disclosed, lost, corrupted or stolen. Third parties may have the technology and know-how to breach the security of this information, and the Company's security measures and those of the Company's banks, merchant card processing and other technology suppliers may not effectively prohibit others from obtaining improper access to this information. The techniques used by criminals to obtain unauthorized access to sensitive data change frequently and often are not recognized until launched against a target; accordingly, the Company may be unable to anticipate these techniques or implement adequate preventative measures.


text: The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, and litigation with third parties, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of the Company's enterprise risk management program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company has also established a process to validate the aforementioned controls are in place and the results are being reviewed as a part of the overall company risk assessment. The Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: The Company has cybersecurity insurance (subject to specified retentions or deductibles) related to a cybersecurity incident that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. However, damages, fines and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.


text: Many of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, we are dependent on the operations of IT service providers. Our vendor management process, which includes due diligence steps prior to selecting third party service providers, is an important part of our risk mitigation strategy. In particular, we require ISO and other security compliance for all critical vendors by contract. Additionally, the Company monitors risks from cybersecurity threats associated with the user of third-party service providers and will audit critical vendors for compliance, as appropriate. Notwithstanding, if there is a catastrophic event, such as a natural disaster or other adverse weather condition, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to operate business as usual, or at all, for the duration of the event and/or a time thereafter.


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Finance Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer and Chief Financial Officer have prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks, including artificial intelligence. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Financial Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer has prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is no t aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this report.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) that provide 24 x 7 x 365 Network Operations Center and Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from ESRT's Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of ESRT's Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.


text: face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET