text: Governance — Our audit committee oversees our ERM program, including the management of risks arising from cybersecurity threats, and are supported by the Information Security Steering Committee (the "ISSC"), the Cybersecurity Incident Response Team (the "CSIRT"), and our information security ("InfoSec") team. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The ISSC oversees the frameworks the InfoSec team uses to benchmark the controls and maturity of our security program. The ISSC is a cross-functional group that has oversight and input into the roadmap and projects reflecting the maturity benchmarks of the frameworks upon which we base our program, and receives monthly updates as to the status of the roadmap projects. The CSIRT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the ISSC, who then reports up to our audit committee when appropriate. The audit committee is responsible for escalating cybersecurity threats and incidents to the Board if and when appropriate. We have established frameworks so that our ISSC, audit committee, and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: To facilitate the success of our cybersecurity risk management program, the CSIRT is composed of multidisciplinary teams throughout Redfin who are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The audit committee consists of at least three members of the Board. The ISSC includes our chief financial officer ("CFO"), our chief legal officer ("CLO"), and other key leaders across the company. Our chief technology officer ("CTO") oversees our security team. Our CFO has over 30 years of experience managing risks at Redfin, Zappos, Amazon (Home and Garden), Bain & Company and Accenture, including risks arising from cybersecurity threats. Our CLO has 16 years of experience managing risks, including risks arising from cybersecurity threats. Our CTO has over 24 years of experience, including experience managing risks arising from cybersecurity threats across several industries to include health care and business solutions. Our Director of Security has 17 years of experience building and leading cybersecurity teams at Microsoft, Ubisoft, and Citrix Systems.

companyName: Redfin Corp

secItem: Item 1C


text: Collaborative Approach —We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. The ISSC and the CSIRT work collaboratively to build and implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: Technical Safeguards—We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including rate-limiting and web application firewalls, anti-malware and anti-phishing technology, access controls, and threat detection systems including posture management tooling. We conduct regular security reviews of our technical components, code, libraries, and environments.


text: Incident Response and Recovery Planning—We maintain incident response and recovery plans that address our response to a cybersecurity incident. These plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management —We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness—We provide mandatory training for our personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control envir onment and operating effectiveness. We report the results of these assessments, audits and reviews to the ISSC, the audit committee, and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance—We maintain cyber insurance coverage.


text: Risks from Cybersecurity Threats To date we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to affect our business, including our business strategy, results of operations or financial condition.


text: Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information. We maintain International Organization for Standardization ("ISO") 27001 certification for most of our business units and core applications and facilities, and, where applicable, align to other industry standards or frameworks, including Cloud Security Alliance's Cloud Controls Matrix ("CSA CCM"), Payment Card Industry Data Security Standard ("PCI DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), and HITRUST Common Security Framework ("HITRUST CSF").

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") process which provides an ongoing procedure, effected at all levels of the Company across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action. Central to our risk management process is the Risk Committee, which is a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks. The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Privacy Officer, and other senior executives of the Company. Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations.


text: We take the following actions, among others, to demonstrate our commitment to maintaining the highest levels of information security, provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to identify, protect against, detect, respond to, and recover from cybersecurity incidents: • leverage encryption, data masking technology, data loss prevention technology, authentication technology, entitlement management, access control, network and application segmentation, anti-malware software, and transmission of data over private networks, among other systems and procedures designed to protect against unauthorized access to information; • conduct annual reviews with many of our clients on our cybersecurity and data security policies, practices and controls, and engage with regulators across the world, to remain apprised of cybersecurity and data security standards and best practices; • utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. We are currently evaluating our program against the newly issued NIST Framework 2.0. The NIST Framework outlines security controls and outcomes over five functions: identify, protect, detect, respond, and recover; • conduct network and endpoint monitoring, vulnerability assessments, and network penetration testing; • conduct quarterly information security management and incident training, and regular phishing email simulations for all associates to enhance awareness and responsiveness to possible threats; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures; • conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services; and • maintain global information security policies and procedures, including an incident response and crisis management plan which include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.


text: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches or cybersecurity incidents could adversely affect our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation.," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our information security program and team are currently managed by our Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer. Our CISO has more than 25 years of experience in managing and leading cybersecurity functions which includes cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China. Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data. With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, including the President, Chief Financial Officer, Chief Legal Officer, and Chief Technology Officer, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.


text: The responsibilities of the Company's Board of Directors ("Board") include oversight of our risk management processes. The Board has two primary methods of oversight. The first method is through the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company. The second is through the functioning of the Board's committees. The Audit Committee assists the Board in its oversight of the Company's information security program, including cybersecurity and data privacy risks and controls. Our CISO provides reports on the Company's cybersecurity program to the Audit Committee, which includes all members of the Board, on a quarterly basis. In addition, our Internal Audit function regularly audits our technology and cybersecurity programs and reports to the Audit Committee on its findings.


text: Cyberattacks represent a potentially significant risk to the Partnership and its industry. We have implemented policies and procedures that are intended to manage and reduce this risk, including those managed by affiliates of Cheniere through our service agreements with them, as further discussed in Note 14—Related Party Transactions of our Notes to Consolidated Financial Statements.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: Risk Management and Strategy As part of our broader approach to risk management, our cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Our strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, we routinely evaluate opportunities to refine our cybersecurity program in order to mitigate operational network risks. We include business continuity planning as a component of our strategy to help ensure critical systems are available to support the Partnership in the instance of a disruptive event. We also participate in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, we and Cheniere assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of, and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of our corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the board of directors of our general partner participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. We seek to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to us, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.


text: Risks that could affect us are an integral part of the board of directors of our general partner and Audit Committee deliberations throughout the year. The board of directors of our general partner has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee has been delegated the authority to oversee and periodically review the security of Cheniere's information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with management our cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including our risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates the Audit Committee on the overall status of our cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Cyberattacks represent a potentially significant risk to the Partnership and our industry. We have implemented policies and procedures that are intended to manage and reduce this risk, including those managed by affiliates of Cheniere through our service agreements with them, as further discussed in Note 13—Related Party Transactions of our Notes to Consolidated Financial Statements.


text: On an ongoing basis, we and Cheniere assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of our corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the board of directors of our general partner participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere seeks to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to us, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, patients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Our cybersecurity policies, standards, processes and practices continue to be incorporated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: VERACYTE, INC.

ticker: VCYT


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," the board of directors' oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors, or the Audit Committee, our Chief Information Officer, or CIO, other members of management and relevant management committees as appropriate.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Physical Safeguards: We deploy physical safeguards such as facility access control via keycard access and security cameras. In addition, workstation and device security is controlled with proper logging and identity access controls to protect our physical assets. Administrative Safeguards: We have implemented policies, security standards and procedures to ensure proper user and protection of our assets.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to help equip our personnel with tools to address such threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Incident Response and Recovery Planning: We have established and maintain a cybersecurity incident response plan that addresses our response to a cybersecurity incident.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems that could adversely impact our business in the event of a cybersecurity incident.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The board of directors, in coordination with the Audit Committee, oversees our management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with the members of management, including the CIO.


text: The Cybersecurity Executive Leadership Team is composed of the CIO, in coordination with our Chief Executive Officer, or CEO, Chief Financial Officer, or CFO, Chief Compliance Officer and General Counsel, or GC. The team works collaboratively across our company to design and implement programs to protect our information systems from cybersecurity threats and to appropriately respond to any cybersecurity incidents in accordance with our cybersecurity incident response plan. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our company are engaged to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO and the Cybersecurity Executive Leadership Team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CIO brings more than 20 years of information and operational leadership experience in the life sciences and technology industries to his role at Veracyte. He holds a B.B.A. and an M.B.A from the University of San Diego. Our VP, Global IT Operation oversees IT operations for all sites globally, and has more than 20 years' of experience. He holds a M.S. in Business Technology Management, and a B.S. in Computer Applications and Networks from Coleman University. Our Director of Cybersecurity has over 25 years' of experience in enhancing digital security and driving technological innovation. He holds a B.Sc. (Honors) in Computer Information Systems from the National University along with several industry related Cybersecurity certifications.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Security breaches, loss of data and other disruptions to our or our third-party service providers' data systems could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Physical Safeguards: We deploy physical safeguards such as facility access control via keycard access and security cameras. In addition, workstation and device security is controlled with proper logging and identity access controls to protect our physical assets.


text: Administrative Safeguards: We have implemented policies, security standards and procedures to ensure proper user and protection of our assets. We maintain cybersecurity risk insurance coverage to provide financial protection in the event a cybersecurity breach was to occur.


text: Education and Awareness: We provide regular, mandatory, and ongoing training and reinforcement for personnel regarding cybersecurity threats to help equip our personnel with tools to address such threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Risk Management and Strategy We have an enterprise-wide information security program designed to protect, identify, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Furthermore, to protect our information systems and data from cybersecurity threats, we use various security tools that help prevent, identify, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third party risk management program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: RingCentral, Inc.

ticker: RNG


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors.


text: The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has served in various information technology and security leadership roles for over 20 years, including serving as the Chief Information Security Officer at 8x8 Communications and Lam Research Corporation. He holds a B.S. degree in Information Technology from the University of the Pacific and an M.B.A. from the University of Southern California.


text: Our board of directors oversees our enterprise risk management activities in general, and receives regular updates on the company's risk management process and the risk trends related to cybersecurity. The audit committee specifically assists the board of directors in its oversight of risks related to cybersecurity. To help ensure effective oversight, the audit committee receives regular reports on information security and cybersecurity from the CISO.


text: We have an established process and playbook led by our CISO governing our assessment, containment, mitigation, response and internal and external disclosures upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors (including our lead independent director and the audit and committee chair).


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring - We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24 hour, seven day per week monitoring system which complements the technology, processes, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our internal audit function to conduct additional reviews and assessments. • Insider Threats - We maintain an insider threat program designed to identify, assess, and address potential risks from within our company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration - We work with government and local law enforcement, customers, industry and/or supplier partners to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information. • Third Party Risk Assessments - We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness - We provide on at least an annual basis awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate quarterly in required training, including spear phishing, social engineering and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement - We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.


text: Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: The CISO is responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has served in various information technology and security leadership roles for over 20 years, including serving as the Chief Information Security Officer at 8x8 Communications and Lam Research Corporation. He holds a B.S. degree in Information Technology from the University of the Pacific and an M.B.A. from the University of Southern California.


text: Cybersecurity is a complex and constantly evolving risk that we are committed to understanding and mitigating. The foundation of our information security practices is rooted in the principles set forth by the National Institute of Standards and Technology ("NIST"), ensuring a robust and comprehensive approach to safeguarding our digital assets. This program provides standards, guidelines, and best practices for improving our cybersecurity risk management. To effectively manage our cybersecurity risk, we employ a comprehensive approach encompassing risk assessment, identification, and mitigation, all aligned with the rigorous standards and principles. Cybersecurity and IT compliance risk metrics are monitored regularly to assess, identify, manage and protect our environment. Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits and are performed by professionals.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Our approach to third-party cybersecurity underscores a commitment to robust risk management and adherence to industry best practices. By implementing comprehensive measures in line with recognized standards, we ensure that our third-party cybersecurity protocols are aligned with rigorous standards. Regular assessments, SOC reviews, and collaborative efforts are integral components of our strategy, aimed at fostering a secure and resilient ecosystem that safeguards sensitive information and maintains the integrity of our digital infrastructure in partnership with external entities.


text: We have a Chief Information Security Officer ("CISO") and have an IT Steering Committee ("ITSC"). Our CISO is responsible for establishing the cybersecurity vision for the Company, determining and prioritizing cybersecurity initiatives, and keeping abreast of developing security threats. The ITSC reports to the Board and Audit Committee, is chaired by our Chief Risk Officer ("CRO"), and has our CISO, Chief Financial Officer ("CFO"), and GRILChief Executive Officer, and SEC Reporting Officer as some of its members. Our CISO brings over three decades of expertise in the IT Industry and is a member of ISACA, showcasing a rich portfolio of industry certifications like the Certified Information Security Manager ("CISM"), Certified Data Privacy Solutions Engineer ("CPDSE"), and Microsoft Certified Systems Engineer ("MCSE"). The CISO also holds accreditations from vendors such as CISCO and Microsoft. Our CRO has over 20 years' experience in the property and casualty reinsurance industry, and significant expertise in the field of risk management. He holds a CISM certification, as well as a B.Sc. in Mathematics and a Ph. D. in Computer Science from the University of Salford. Other members of the ITSC hold relevant qualifications and collectively, the ITSC has substantial experience and expertise in cybersecurity, risk, strategy, and management.


text: The ITSC meets at least quarterly to discuss and approve IT and Cybersecurity matters. The ITSC produces and approves an annual IT budget, as well as an Incident Management and Response plan through which the CISO and the ITSC are informed about cybersecurity incidents.


text: To assist with mitigating the risks of cybersecurity threats, periodic cybersecurity training is provided to employees, vendors, and members of the Board. Further, to mitigate risk arising from our relationships with third-parties, key vendors must be SOC 2 compliant, as determined in accordance with the framework developed by the American Institute of Certified Public Accountants, or undertake the Company's enhanced due diligence process. Periodic testing is performed, and all material incidents are reported to the Board.


text: IT and cybersecurity are a standing Board agenda item, with quarterly presentations to the Board from the IT leadership quarterly. Our Audit Committee assists the Board in its oversight responsibilities regarding our systems, policies, and procedures relating to technology and cybersecurity. The Audit Committee's charter mandates that the Audit Committee reviews our technology and cybersecurity systems, policies, and procedures (including those relating to our assessment of third-party provider cybersecurity controls) with management. The Audit Committee is further tasked with discussing with management the policies with respect to risk assessment and risk management, including those related to technology and cybersecurity. The CRO presents an IT and Cybersecurity update to the Audit Committee on a quarterly basis and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.


text: For the year ended December 31, 2023, we have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.


text: See "Item 1A. Risk Factors — Risks Relating to Our Business — Technology breaches or failures, including those resulting from a malicious ransomware or cyber-attack on us or our business partners and service providers, could disrupt or otherwise negatively impact our business."


text: Cybersecurity is a complex and constantly evolving risk that we are committed to understanding and mitigating. The foundation of our information security practices is rooted in the principles set forth by the National Institute of Standards and Technology ("NIST"), ensuring a robust and comprehensive approach to safeguarding our digital assets. This program provides standards, guidelines, and best practices for improving our cybersecurity risk management. To effectively manage our cybersecurity risk, we employ a comprehensive approach encompassing risk assessment, identification, and mitigation, all aligned with the rigorous standards and principles. Cybersecurity and IT compliance risk metrics are monitored regularly to assess, identify, manage and protect our environment. Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits, are performed by professionals and form a part of our overall risk management system and processes.


text: We have a Chief Information Security Officer ("CISO") and have an IT Steering Committee ("ITSC"). Our CISO is responsible for establishing the cybersecurity vision for the Company, determining and prioritizing cybersecurity initiatives, and keeping abreast of developing security threats. The ITSC reports to the Board and Audit Committee, is chaired by our Head of IT and Software Development ("Head of IT"), and has our CISO, CFO, COO, and SEC Reporting Officer as some of its members. Our CISO brings over three decades of expertise in the IT Industry and is a member of ISACA, showcasing a rich portfolio of industry certifications like the Certified Information Security Manager ("CISM"), Certified Data Privacy Solutions Engineer ("CPDSE"), and Microsoft Certified Systems Engineer ("MCSE"). The CISO also holds accreditations from vendors such as CISCO and Microsoft. Our Head of IT brings two decades of experience in aligning technology initiatives with business goals and managing IT strategy. With a background of over 15 years in insurance and reinsurance, the Head of IT is responsible for ensuring the implementation and adherence to governance and cybersecurity frameworks. Other members of the ITSC hold relevant qualifications and collectively, the ITSC has substantial experience and expertise in cybersecurity, risk, strategy, and management.


text: IT and cybersecurity are a standing Board agenda item, with quarterly presentations to the Board from the IT leadership quarterly. Our Audit Committee assists the Board in its oversight responsibilities regarding our systems, policies, and procedures relating to technology and cybersecurity. The Audit Committee's charter mandates that the Audit Committee reviews our technology and cybersecurity systems, policies, and procedures (including those relating to our assessment of third-party provider cybersecurity controls) with management. The Audit Committee is further tasked with discussing with management the policies with respect to risk assessment and risk management, including those related to technology and cybersecurity. An IT and Cybersecurity presentation is made to the Audit Committee quarterly and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.


text: We have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have established and maintain a comprehensive Information Security Program that is designed to support us in assessing, identifying, protecting, managing, responding to, and recovering from cybersecurity threats and cybersecurity incidents.

companyName: GREEN DOT CORP

ticker: GDOT


text: We leverage the following guidelines and frameworks to develop and maintain our Information Security Program: Federal Financial Institutions Examination Council ("FFIEC") Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, the Payment Card Industry Data Security Standard ("PCI DSS"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b).


text: Our Information Security Program includes an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of our Information Security Program, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Regular cybersecurity training programs for employees and directors; conducting annual customer data handling and use requirements training for all our employees; conducting annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • Monitoring emerging data protection laws and implementing changes to our processes designed to comply; • Conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • Through policy, practice and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; and • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident.


text: Our Information Security Program is integrated into our overall Enterprise Risk Management Program, which covers all company risks. As part of this program appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We routinely engage with assessors, consultants, auditors, and other third-parties, including by annually having an independent Qualified Security Assessor review our Information Security Program to help identify areas for continued focus, improvement and/or compliance, including undergoing annual compliance audits with respect to PCI DSS and SOC 2 compliance.


text: Our processes also address oversight and identification of cybersecurity risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.


text: Risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Although our cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, remediate, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see the headings "Our business is dependent on the efficient and uninterrupted operation of computer network systems and data centers, including third party systems" and "A data security breach could expose us to liability and protracted and costly litigation, regulatory penalties, and could adversely affect our reputation and operating revenues" included as part of our risk factor disclosures in "Part I, Item 1A, Risk Factors," of this Annual Report on Form 10-K.


text: The Risk Committee of our Board of Directors provides structured oversight of the Company's Enterprise Risk Management Program, including the oversight of risks from cybersecurity threats. The Risk Committee regularly receives an overview from management of our cybersecurity risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Risk Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer and Chief Technology Officer. Annually, the Risk Committee reviews and approves the Information Security Program. Additionally, the Risk Committee is promptly apprised of any cybersecurity incident that meets established reporting thresholds, and receives ongoing updates regarding any such incident until it has been resolved. At each regularly scheduled Board meeting, the Risk Committee Chair provides the full Board with an update on all significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled Board meeting.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Technology Officer. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and adhering to relevant compliance requirements as well as several relevant degrees and certifications, including undergraduate degrees in information systems and computer engineering, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Internal Security Assessor.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the Information Security Program described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: As discussed above, these members of management report to the Risk Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.


text: Risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Although our cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, remediate, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see the headings "Our business is dependent on the efficient and uninterrupted operation of computer network systems and data centers, including third party systems" and "A cyber-attack, incident or security breach could expose us to liability and protracted and costly litigation, regulatory penalties, and could negatively impact our reputation and operating revenues" included as part of our risk factor disclosures in "Part I, Item 1A, Risk Factors," of this Annual Report on Form 10-K.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Technology Officer. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and adhering to relevant compliance requirements as well as several relevant degrees and certifications, including undergraduate degrees in information systems and computer engineering, Certified Information Systems Security Professional, Global Information Assurance Certification, and Internal Security Assessor.


text: Risk Management and Strategy We recognize the importance of managing cybersecurity threats and risks related to our business, and we have adopted a multi-faceted and proactive strategy to identify, evaluate, address, respond and neutralize cybersecurity threats and attacks. We employ a combination of technical solutions, security policies and procedures, employee training programs, and regular security audits to enhance and fortify our defenses. We utilize advanced monitoring tools and anomaly detection systems to swiftly identify any suspicious activities or deviations from normal operation. Our security infrastructure includes firewalls, intrusion detection systems, encryption protocols, and access controls to protect our systems and data from unauthorized access or malicious attacks. In the event of a security incident, we have established incident response procedures to contain the threat, minimize the impact, and restore normal operations as quickly as possible. We also conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Our cybersecurity team plays a critical role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents on a day-to-day basis, including threats arising internally or from our vendors, suppliers or other third parties that we conduct business with. In addition, we have developed and implemented information security policies, standards, procedures and security guidelines that are based on industry standards, particularly the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Furthermore, we have implemented and maintained employee policies design to reduce risk of cyber-attacks and educate employees on protocol in the event of a potential cybersecurity incident.


text: We use third-party service providers in various functions throughout our business. We have implemented stringent processes to oversee and manage cybersecurity risk with these third parties, which includes risk assessment activities, enforcement of policies to ensure compliance with current cybersecurity standards and monitoring activities, and periodic review of potential cyber breaches announcements made by the third-party service providers.


text: Currently we are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.


text: Our management team, including our cybersecurity team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk management processes. Our cybersecurity team includes Vice President of Information Technology and Information Security Officer with a team of eight full-time information technology professionals and several outside security vendors to manage our information security program. Our Vice President of Information Technology and Information Security Officer have served in various roles in information technology and information security, and together they have over 55 years of experience in this field. The cybersecurity management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Executive Officer and Chief Financial Officer, as well as our Board of Directors.


text: Our Board of Directors (the "Board") plays an active role in overseeing and managing the Company's cybersecurity risks. The Audit Committee of the Board has established a Cybersecurity Subcommittee for the purpose of assessing, analyzing and managing the Company's key cybersecurity and information technology risks, and to ensure that our systems are adequate to protect against security breach and effectively safeguard the Company's IT infrastructure, assets, intellectual property, and data. The roles and responsibilities of the Cybersecurity Subcommittee are determined, from time to time, by the Audit Committee. The Cybersecurity Subcommittee meets quarterly with our management team to discuss various matters relating to IT and cybersecurity risks, and our senior management team communicates and coordinates directly with the Cybersecurity Subcommittee in the event of any cybersecurity incident. The Cybersecurity Subcommittee is given the following responsibilities: • Oversight of policies, procedures, plans, and execution intended to provide security, confidentiality, availability, and integrity of the information. • Oversight of the quality and effectiveness of the Company's policies and procedures with respect to its IT systems; • Review and oversight on policies and procedures of the Company in preparation for responding to cybersecurity incidents. • Oversight of risks related to IT systems and processes, including privacy, network security and data security, and any internal audits of such systems and processes. • Review and oversight of preparation of the Company's public disclosures, including SEC filings, relating to the Company's IT systems, including privacy, network security, and data security, and • Report to the Audit Committee and the Board of significant and material cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an important part of our risk management at iRhythm. Our cybersecurity program includes mitigating risks for our company and for other companies that may have access to our data and systems. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The risk oversight responsibility of our board of directors and its committees is supported by our cybersecurity management reporting processes, which are designed to provide visibility to our board of directors and to our personnel that are responsible for risk assessment and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. These areas of focus include risks from cybersecurity threats as well as competitive, economic, operational, financial, legal, regulatory, privacy, compliance, and reputational risks, among others. We understand that our customers, patients, and stakeholders entrust us with sensitive data, including Protected Health Information, and we take this responsibility seriously.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Vice President of Cybersecurity ("VP of Cybersecurity") and Chief Risk Officer ("CRO"). We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.


text: We have established policies to govern the security of our systems and the protection of customer and patient data, which include regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. Our Cybersecurity department, which reports to our VP of Cybersecurity, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below. To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework and HIPAA. To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating ("ARR") system that considers certain attributes that represent impact to the Company, and we prioritize our actions based on our ARR system. Our cybersecurity risk assessment program provides the underlying basis for the activities our Cybersecurity and Global Risk & Integrity departments take to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.


text: In addition, we also regularly perform phishing tests on our employees and review our training plan at least annually for appropriate updates to address results from this testing. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. On top of annual information security awareness training for our employees, we also provide focused training for certain departments. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, and incident reporting process, as well as physical security best practices.


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Assessments by external providers of our cybersecurity measures include information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such internal and external assessments, audits, and reviews are reported to the audit committee and the board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our data and systems, including payors and IDTFs. These processes include vetting of all service providers for security, reliability, and availability; execution of a Business Associate Agreement with each provider for compliant management, storage, or processing of PHI; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete an in-depth review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.


text: Based on our board of directors' and management's review of risks associated with cybersecurity threats, we have concluded that, to date, there have been no cybersecurity threats which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled "Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical data systems and give rise to potential harm to our patients, remediation and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."


text: Governance As described above, our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy, with certain components of such oversight, including matters related to the security of and risks related to computerized information and technology systems, delegated to the audit committee.


text: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our VP of Cybersecurity and CRO, respectively. Our VP of Cybersecurity currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams. Our CRO has held leadership roles in internal audit and risk for over a decade, including most recently as CRO of another public company.


text: Individuals in our Cybersecurity and Global Risk & Integrity departments regularly monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the VP of Cybersecurity promptly and discussed in regular team meetings generally held several times per week. Risks are escalated to the CRO and other members of management in accordance with our incident response and reporting policy.


text: Our VP of Cybersecurity reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee. These periodic updates include updates on our cybersecurity risk posture, including material risk assessments, the status of any projects to improve our information security systems, and the emerging cybersecurity threat landscape. The audit committee's reviews may also include presentations by members of senior management, as well as briefings with other internal and external subject-matter experts to help broaden the board of directors' understanding of the latest cybersecurity issues and the latest regulatory and threat landscapes. Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as cybersecurity incident response and recovery metrics. Our management also periodically engages external service providers to conduct objective assessments of our cybersecurity program, and results of such assessments are directly reported to the audit committee. Finally, the audit committee reports out to the larger board of directors periodically on the company's cybersecurity risks and posture.


text: Our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Chief Information Security Officer ("CISO") and Chief Risk Officer ("CRO"). We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.


text: We have established policies to govern the security of our systems and the protection of customer and patient data, which include regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. Our Cybersecurity department, which reports to our CISO, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below. To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework and HIPAA. To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating ("ARR") system that considers certain attributes that represent impact to the Company, and we prioritize our actions based on our ARR system. Our cybersecurity risk assessment program provides the underlying basis for the activities our Cybersecurity and Global Risk & Integrity departments take to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Assessments by external providers of our cybersecurity measures include information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such internal and external assessments, audits, and reviews are reported to the audit committee and the board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our data and systems, including payors and IDTFs. These processes include vetting of service providers for security, reliability, and availability; execution of a Business Associate Agreement with each provider for compliant management, storage, or processing of PHI; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete a risk-based review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.


text: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our CISO and CRO, respectively. Our CISO currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams. Our CRO has held leadership roles in internal audit and risk for over a decade, including most recently as CRO of another public company.


text: Individuals in our Cybersecurity and Global Risk & Integrity departments regularly monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the CISO promptly and discussed in regular team meetings generally held several times per week. Risks are escalated to the CRO and other members of management in accordance with our incident response and reporting policy.


text: Our CISO reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee. These periodic updates include updates on our cybersecurity risk posture, including material risk assessments, the status of any projects to improve our information security systems, and the emerging cybersecurity threat landscape. The audit committee's reviews may also include presentations by members of senior management, as well as briefings with other internal and external subject-matter experts to help broaden the board of directors' understanding of the latest cybersecurity issues and the latest regulatory and threat landscapes. Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as cybersecurity incident response and recovery metrics. Our management also periodically engages external service providers to conduct objective assessments of our cybersecurity program, and results of such assessments are directly reported to the audit committee. Finally, the audit committee reports out to the larger board of directors periodically on the company's cybersecurity risks and posture.


text: We recognize the critical importance of maintaining the trust and confidence of business partners, such as CROs and CMOs, clinical trial investigators, patients and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks, and other security incidents, including perpetration by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we, together with our contracted third-party cybersecurity advisors, maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring of internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by management.


text: We, with assistance from our contracted third-party cybersecurity advisors, identify our cybersecurity threat risks by comparing our processes to standards set by the National Institute of Standards and Technology, or NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is a potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our selection and oversight of third-party service providers, including our suppliers and manufacturers or those who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Significant disruptions of information technology systems, computer system failures or cybersecurity incidents could adversely affect our business, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: The Audit Committee of the Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Vice President, Associate General Counsel and Head of Compliance, with the assistance of our contracted third-party cybersecurity advisors. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including incident response processes. As discussed above, these management team members periodically report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: The information required by this Item is set forth in the "MD&A – Cybersecurity" section in the Annual Report, which is incorporated herein by reference.

companyName: Bank of New York Mellon Corp

ticker: BK


text: Risk Management and Strategy The Company identifies, assesses, and manages cybersecurity risks as part of its risk management program. Our cybersecurity strategy aligns the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), applicable regulatory guidelines and other industry practices to secure critical information systems and sensitive data.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Key components of the Company's cybersecurity program include: • Risk Assessment & Management: Regular identification and evaluation of cybersecurity threats, vulnerabilities, and exposures informed by threat intelligence, industry trends, and regulatory developments. • Governance & Oversight: Defined cybersecurity policies and procedures overseen by senior management and the Board of Directors. The Director of Technology is responsible for monitoring cybersecurity risks and reporting any material threats or incidents to the IT Committee or Board for oversight, strategic response planning, and mitigation efforts. • Access Controls & Identity Management: Implementation of multi-factor authentication, role-based access controls, and monitoring of user permissions. • Incident Detection & Response: Security monitoring supported by an incident response plan designed for timely identification, containment, and remediation of cybersecurity incidents. • Data Protection & Encryption: Encryption, standards, data loss prevention protocols, and secure data storage measures for sensitive client and corporate information. • Third-Party Risk Management: Security assessments, monitoring, and contractual requirements to manage cybersecurity risks from third-party vendors. • Training & Awareness: Mandatory cybersecurity training for employees to enhance awareness of cybersecurity threats and compliance requirements. • Regulatory Compliance & Audit: Regular internal and external cybersecurity audits to assess compliance with applicable regulations, standards, and Company policies. • Continuous Improvement & Testing: Periodic penetration tests and vulnerability assessments to evaluate cybersecurity risks and enhanced security measures. Program updates are implemented as needed to address emerging threats and align with evolving industry best practices.


text: The Company uses third-party assessors, auditors, and consultants to independently evaluate security practices through penetration testing, vulnerability assessments, and vendor evaluations. Despite these measures, the Company acknowledges that cybersecurity incidents cannot be fully prevented.


text: Third-Party Risk Management Cybersecurity risks posed by third-party vendors and service providers are integrated into the Company's risk management framework. Vendor security practices, compliance with contractual cybersecurity obligations, and exposure to cybersecurity threats related to external providers are assessed regularly. While these efforts aim to assess and mitigate cybersecurity risks, no security assessment can eliminate all potential risks associated with third-party vendors.


text: The Board oversees cybersecurity through the Bank's Information Technology Committee (" IT Committee "), the Company's Audit Committee, and the Company's Risk Committee, aligning cybersecurity practices with the Company's risk management framework and regulatory requirements. Updates on cybersecurity strategy, risk assessments, and regulatory developments are provided to the relevant committees.


text: The Risk Committee monitors the quality and effectiveness of the Company's information technology security, and at least annually reviews, appraises, and discuss with management the quality and effectiveness of the Company's information technology security, data privacy, disaster recovery capabilities and cybersecurity and related risks. Additionally, the IT Committee reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: Cybersecurity and IT risks are reported to the Board through multiple channels. The IT Committee Chair periodically reports to the Board summarizing key issues, risk assessments, and compliance matters. Additionally, the Director of Technology submits semi-annual reports to the Board, providing insights into ongoing and emerging risks, technology developments, and IT security initiatives. In cases where significant IT or cybersecurity risks arise, such matters are escalated to the Company's Board through the Chair of the Risk Committee or the Chief Risk Officer, for timely awareness and response.


text: The IT Committee is chaired by Dr. Yonesy F. N ez, CISSP, who holds a Doctor of Professional Studies in Computing Information Assurance and Security from Pace University. Dr. N ez has experience in cybersecurity governance and risk management and currently serves as Chief Information Security Officer ("CISO") of a Systematically Important Financial Market Utility. His prior roles include CISO at Jack Henry & Associates and senior cybersecurity positions at major financial institutions.


text: The Risk Committee, chaired by a former senior executive from KPMG LLP, who established and led KPMG's Financial Risk Management practice in the U.S., annually evaluates the effectiveness of the Company's cybersecurity controls.


text: The Audit Committee selects third-party auditors to conducts cybersecurity audits, penetration tests, and risk assessments. The Committee Chair has expertise in auditing and regulatory compliance within the financial services industry.


text: Management Oversight The Company's cybersecurity operations are overseen by the Director of Technology, who possesses twelve years of experience in cybersecurity management, information technology infrastructure, and risk mitigation. The Director of Technology participates in industry committees, reports to executive management, and updates Board committees and the Board of Directors. Reporting to the Chief Executive Officer, and working with executive leadership, this role supports cybersecurity risk management and helps aligns them with the Company's broader risk framework. Issues are elevated to the Board by either the Director of Technology or by the Chairs of the IT Committee and Risk Committee, the Chief Risk Officer, or the CEO.


text: As of the date of this Annual Report on Form 10-K, the Company has contracted with a third-party firm to provide CISO services, who reports to the Chief Risk Officer and the IT Committee Chair. This engagement allows the Company to access specialized knowledge, industry best practices, and regulatory insights while maintaining flexibility in managing its information security strategy. The external CISO provides guidance and oversight on cybersecurity risk assessments, incident response, and compliance.


text: Incident Response As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents materially affecting its business strategy, results of operations, or financial condition. Recognizing cybersecurity threats continue to evolve, the Company maintains a focus on enhancing its detection, response, and resilience capabilities. The Company cannot assure the prevention of future cybersecurity incidents.


text: For additional information regarding the risk we face from cybersecurity threats, see the risk factors entitled "The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents could have a material adverse effect on our business, financial condition, results of operations, and reputation" and "We also face risks related to cyberattacks and other security breaches involving external, third-party vendors and counterparties" included in Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.

companyName: PROS Holdings, Inc.


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance. As discussed in more detail under the heading "Governance" below, our Board and management devote significant time to cybersecurity risk oversight. The Board annually reviews our overall cybersecurity risk profile to help ensure that sensitive data remains secure in an ever-changing threat landscape, including risk preparedness and mitigation strategies. This assessment considers a range of factors, including our business objectives, the threat landscape, industry trends and regulatory requirements. The Audit Committee of the Board ("Audit Committee") spearheads the oversight of our cybersecurity risk management and regularly meets, not less than quarterly, with our Chief Information Security Officer ("CISO") and other members of management, including those with significant roles in our cybersecurity efforts. Our Executive Steering Committee, described below, provides senior management oversight to our cybersecurity program.


text: Collaborative Approach. We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards. We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.