text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information security team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information security team.

companyName: Oil-Dri Corp of America

ticker: ODC

secItem: Item 1C


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information security team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including leaders from our information security and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security team, such as our Chief Information Officer, Director, Applications Delivery, and our Director of Information Technology. Such individuals have nearly 40, over 30, and over 20 years of experience, respectively, in various roles involving information technology, including infrastructure and operations, security, auditing, compliance, and application development. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Old Republic depends upon technology-based information systems to conduct business. The Company uses computer systems and other electronic information resources, including both proprietary and third-party technology systems and tools, to process, transmit, receive, and store certain personal, confidential, and proprietary information; to communicate with customers, service providers, and other third parties by email and other electronic means; and perform various business operations, including transferring significant amounts of funds.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include malware and computer virus attacks, ransomware, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues and reputational damage.


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure. The Company's CISO has more than 26 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 20 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, as well as a member of ISACA (formerly known as the Information Systems and Audit and Control Association) and the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.


text: Each Old Republic operating subsidiary maintains its own security program based on its particular risk, applicable insurance industry requirements, and mandates and guidance from the CISO and enterprise-wide security advisory team. These programs encompass asset protection, threat identification, monitoring, timely response procedures, containment and recovery measures, and internal escalation procedures. An enterprise-wide information technology team consisting of a working group of information technology leaders representing all operating subsidiaries meets regularly for the review and monitoring of and updates to information security business processes due to significant changes in operating environments, statutory or regulatory changes or changing or emerging threats. Operating subsidiaries are required to report certain cyber incidents based on documented severity classification to the enterprise-wide information technology team. This team consists of key information technology personnel, including the CISO and the Chief Information Officer (CIO). They are responsible for overseeing incident response and escalation to the Company's General Counsel and Chief Financial Officer (CFO) when necessary. As part of the Company's overall risk management strategy, the General Counsel, CFO, and CIO, in consultation with the CEO, navigate escalated incidents for law enforcement and other external engagements and assess the impact and materiality of such incidents on the Company's enterprise-wide business.


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise-level and subsidiary level generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.


text: When engaging third-party vendors, operating subsidiaries are directed to use cybersecurity screening and risk assessment measures and to include appropriate data security privacy terms and conditions in vendor agreements, including, as necessary for certain vendors, a duty to report certain security incidents to the Company's information technology team. Third-party engagement procedures generally include (1) the identification and risk assessment of third-party service providers; (2) minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the Company; (3) due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and (4) periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security platform partners to provide advisory services related to security technologies and practices.


text: At the holding company level, Old Republic employs security awareness and training initiatives to inform associates about their role in cybersecurity risk mitigation.


text: The Audit Committee of the Company's Board of Directors has oversight authority to review the Company's data protection and cybersecurity risk exposure and the steps management has taken to assess and respond to the overall threat landscape, including the strategy management implemented to mitigate the Company's cyber risk exposure. The CISO and CIO report to the Audit Committee on current data protection and cybersecurity matters quarterly, and as may otherwise be needed. The CISO is authorized to report directly to the Audit Committee on the Company's security program and status of cybersecurity risk management efforts. The Chair of the Audit Committee reports these matters, as appropriate, to the Board of Directors.


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include ransom attacks, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues, and reputational damage.


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure, as well as the Company's practices and protocols for the use of AI. The Company's CISO has more than 27 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 21 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, a member of ISACA (formerly known as the Information Systems and Audit and Control Association), a member of the Factor Analysis of Information Risk (FAIR) Institute risk management education committee, and holds membership on the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise and subsidiary levels generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security partners to provide advisory services related to security technologies and practices.


text: Cybersecurity Risk Management and Strategy We have an enterprise-wide cybersecurity risk management approach designed to identify, protect, detect, respond to and manage cybersecurity and information technology risks and threats. This program is integrated into our enterprise risk management (ERM) framework, and the underlying controls leverage recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: OLIN Corp

ticker: OLN


text: Our Company's Chief Information Officer (CIO) is responsible for developing and maintaining our global cybersecurity and information technology program and directs our Information Security team. The Information Security team is primarily responsible for identifying and protecting against cybersecurity threats and maintains a comprehensive set of policies and standards applicable to our global organization. We consult with multiple third-party firms to assess and review these policies and standards and regularly update them for contemporary best practices. Our CIO has over fifteen years of experience leading cybersecurity oversight for global organizations, and our Information Security team leaders have extensive cybersecurity and information technology industry experience with Olin or other large public companies and hold industry certifications, including the Certified Information Systems Security Professional certification.


text: Our Information Security team monitors alerts and meets to discuss threat levels, trends and remediation tactics. Every identified cyber event is evaluated, ranked by severity and prioritized for response and remediation in compliance with our global Security Incident Management Procedure. Significant events are evaluated for both quantitative and qualitative factors to determine materiality on a case-by-case basis, including, among other factors, potential privacy, operational, financial, or reputational impacts for the Company, and our customers, vendors, shareholders, or other external stakeholders. The Information Security team prepares a monthly scorecard for senior management, summarizing cyber events for the month and reporting on our remedial actions. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: The Company regularly conducts penetration testing, both internally and by third parties, and conducts automated attacks simulating real-world cyber incidents. These tests and assessments are useful tools for maintaining a comprehensive cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. We continue to expand our cybersecurity risk mitigation strategies, which includes around-the-clock monitoring of our global network, using layered defenses and identifying and protecting critical assets, including our manufacturing facilities. The Information Security team conducts annual cybersecurity awareness training and quarterly email phishing tests and training for all employees.


text: We rely on certain external service providers to assist in the management of the day-to-day operation of our business, operate elements of our manufacturing facilities, manage relationships with our employees, customers, and suppliers, fulfill customer orders, and maintain our financial, accounting, or other business records. The Information Security team maintains a third-party security program to identify, prioritize, assess, mitigate, and remediate our third-party risks; however, we also rely on our third-party vendors, suppliers, and other business partners to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. Cybersecurity risks are assessed when selecting our third-party service providers and reassessed periodically.


text: We face a number of cybersecurity risks in connection with our business. Failure of any one or more than one of our information technology systems could be caused by internal or external events or parties, such as incursions by intruders or hackers, computer viruses, cyber-attacks, failures in hardware or software, or power or telecommunication fluctuations or failures. For more information about the cybersecurity risks we face, see Item 1A - Risk Factors.


text: Cybersecurity Governance Cybersecurity is an important component of our ERM framework and an area of focus for both our Board of Directors (Board) and management team. While management holds primary responsibility for our Company's risk management strategy, our Board, with the support of its committees, oversees the process to ensure that the framework designed, implemented and maintained by management is functioning as intended and adapts, when necessary, to our evolving strategy and emerging risks. The Board's Audit Committee is delegated responsibility for oversight of our ERM process, including our strategies to identify, detect and respond to cybersecurity and information technology risks and threats. Our Audit Committee's process includes an annual review of our ERM program to ensure appropriate practices are in place to monitor and mitigate identified risks on an ongoing basis. Additionally, our CIO meets with the Audit Committee or Board each quarter to discuss cyber hygiene, incidents (as needed), and provide updates on our enterprise-wide cybersecurity risks and strategies, including steps taken to mitigate and manage the same. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on current cyber topics, trends and best practices. We have established protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team, along with input the Head of Cyber Security, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Our Board has delegated to its Audit Committee oversight responsibility for cyber risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements. The Head of Cyber Security provides quarterly reports to our Audit Committee regarding cyber risk trends, technology security risks, projects to continually enhance our information security systems, cybersecurity strategy, and the emerging threat landscape. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity program is periodically evaluated by internal and external resources to evaluate and enhance the effectiveness of our information security policies, controls, and procedures. The results of those reviews are reported to senior management and the Audit Committee. As part of our cyber risk management program, we track and log security incidents across our enterprise and perform third-party risk assessments to identify and attempt to mitigate risks from third parties such as vendors and suppliers.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management system. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team is responsible for our overall enterprise risk management system and processes and, along with the Head of Cyber Security, regularly consider cybersecurity risks in the context of other material risks to the company.


text: As of the date of this Annual report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.


text: Management of cybersecurity risks is an integral part of our overall risk management framework. We have developed an information security program designed to assess, identify and manage material risks from cybersecurity threats, which is integrated into our overall risk management program and governance structure. The program includes policies and procedures that identify how security measures and controls drawn from relevant frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls, and intrusion detection and prevention, and vulnerability and patch management.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: We also use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from vendors and Information Sharing and Analysis Centers.


text: We have the following security processes in place: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from third-party providers, we periodically conduct penetration and vulnerability testing to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we educate certain employees depending on their role on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls, and technology systems, including cloud-based platforms and services.


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technologies receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our information technology council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2023 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Our Vice President of Information Technology, who has more than 30-years of global information technology, systems, and IT audit experience, is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis; establishing processes to ensure that such potential cybersecurity risk exposures are monitored; putting in place appropriate mitigation measures; and maintaining cybersecurity programs. The Vice President of Technology oversees a cybersecurity team that includes experienced cybersecurity professionals with credentials such as CISSP (Certified Information Systems Security Professional), CompTIA Security+, and ISO 27001. Our Vice President of Information Technology receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Technology Council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2024, we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: Cybersecurity Risk Management and Strategy Parker is committed to the protection of the Company's data, data systems and digital assets while in storage, use or transit. Our cybersecurity program is integrated into our overall Enterprise Risk Management program and exists to secure our information systems and data assets, including those data assets entrusted to us by our stakeholders, and to promote our compliance with applicable laws and regulations.

companyName: Parker-Hannifin Corp

ticker: PH


text: We proactively work to address cybersecurity risk through our Digital & IT Risk Management Program, which focuses on identifying, assessing, responding to, monitoring and remediating cybersecurity-related risks. Parker's dedicated Cyber Security team utilizes the National Institute of Standards and Technology (NIST) Cyber Security Framework as its primary resource for identifying areas of risk and benchmarking and implementing continuous improvements. Our technical security configuration employs a centrally managed, layered approach, including hardened PCs, endpoint security detection software, email security, firewall appliances, and various network security protections. We employ enhanced security measures for operational technologies and secure account management, including recently adding a secondary anti-malware solution to our existing software to bolster our company-wide defenses. Additionally, we utilize third-party security monitoring services to further improve our 24/7 monitoring capabilities. We also maintain a third-party risk management program designed to oversee, identify, and reduce the potential impact to Parker and our customers of a security incident at a third-party vendor, supplier or other provider.


text: We have adopted comprehensive Information Security Policies and Standards that clearly articulate Parker's expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. These policies and standards set forth a detailed security incident management and reporting protocol, with clear escalation timelines and responsibilities. We also maintain a global incident response plan and regularly conduct exercises to help with our overall preparedness.


text: We believe cybersecurity is the responsibility of every team member and provide ongoing mandatory cybersecurity awareness training globally to help team members recognize, avoid and report malicious activity. This includes interactive training to engage team members in identifying phishing risks and their appropriate response. We also provide regular training on data protection so that our team members understand the types of data they have and how to safeguard it.


text: Continuous improvement is a critical aspect of Parker's cybersecurity program, which is why we integrate security intelligence from internal and external sources to help identify areas for improvement and gap remediation. As a supplement to our internal cybersecurity capabilities and controls, we partner with third-party consultants and advisors to conduct penetration testing and to assess our incident response plan. We periodically undergo a third-party risk assessment and third-party incident response adversarial engagement exercises to strengthen our security profile. We also conduct internal tabletop exercises to prepare for responding to potential cybersecurity events. Parker also maintains cyber security insurance designed to mitigate the impact of any attacks or threats to our business.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors—Business and Operational Risks" of this Form 10-K, cybersecurity threats remain a risk to our business operations.


text: Cybersecurity Governance Management is responsible for assessing and managing material risks from cybersecurity threats with leadership from the Company's Vice President – Chief Digital and Information Officer (CDIO), who is responsible for the Company's global Digital, Information Technology and Cyber Security organization. Our CDIO has served in various roles in information technology and information security for over 18 years with Fortune 500 companies. Our CDIO holds Bachelor of Science and Master of Science degrees in Computer Engineering. He has also completed other advanced leadership training and coursework regarding cybersecurity risk management. Our CDIO reports directly to the Chief Executive Officer.


text: Parker's cybersecurity program is led by our Digital & IT VP – Infrastructure and Security, who functions as our chief information security officer (CISO) and has over 23 years of experience in cybersecurity operations, cybersecurity governance and compliance, risk management, operational technology (OT) and connected products (IoT) with global Fortune 200 and Fortune 500 companies across diverse industries, such as retail, consumer goods, entertainment and manufacturing. The CISO reports to our CDIO and is supported by and receives regular updates from our dedicated Cyber Security team within our IT function, as well as our IT Risk Council, a cross-functional group that meets regularly to optimize our Digital & IT Risk Management Program and promote alignment with our Enterprise Risk Management program.


text: Recognizing the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs, Parker's full Board of Directors maintains oversight of cybersecurity. Our Board receives an in-depth report from our CDIO, at least annually, on the overall cybersecurity program, and updates throughout the year from our CDIO and CISO regarding such topics as cyber-risk management and the status of projects to strengthen cybersecurity effectiveness.


text: ITEM 2. Properties. Our corporate headquarters is located in Cleveland, Ohio, and, at June 30, 2024, the Company maintained approximately 335 manufacturing plants. We also maintain various sales and administrative offices and distribution centers throughout the world. None of these manufacturing plants, administrative offices or distribution centers are individually material to our operations. The facilities are situated in 36 states within the United States and in 42 other countries. We own the majority of our manufacturing plants. Our leased properties consist of sales and administrative offices and distribution centers as well as manufacturing plants.


text: We believe that our properties have been adequately maintained, are in good condition generally and are suitable and adequate for our business as presently conducted. The extent to which we utilize our properties varies by property and from time to time. We believe that our restructuring efforts have brought capacity levels closer to present and anticipated needs. Most of our manufacturing facilities remain capable of handling volume increases.


text: ITEM 3. Legal Proceedings. None. From time to time we are involved in matters that involve governmental authorities as a party under federal, state and local laws that have been enacted or adopted regulating the discharge of materials into the environment or primarily for the purpose of protecting the environment. We will report such matters that exceed, or that we reasonably believe may exceed, $1.0 million or more in monetary sanctions.


text: We proactively work to address cybersecurity risk through our Digital & IT Risk Management Program, which focuses on identifying, assessing, responding to, monitoring and remediating cybersecurity-related risks. Parker's dedicated Cyber Security team utilizes the National Institute of Standards and Technology ("NIST") Cyber Security Framework as its primary resource for identifying areas of risk and benchmarking and implementing continuous improvements. Our technical security configuration employs a centrally managed, layered approach, including hardened PCs, endpoint security detection software, email security, firewall appliances, and various network security protections. We employ enhanced security measures for operational technologies and secure account management, including a secondary anti-malware solution to our existing software to bolster our company-wide defenses. Additionally, we utilize third-party security monitoring services to further improve our 24/7 monitoring capabilities. We also maintain a third-party risk management program, which includes formally evaluating new vendors at onboarding and monitoring existing vendors on an ongoing basis, designed to oversee, identify, and reduce the potential impact to Parker and our customers of a security incident at a third-party vendor, supplier or other provider.


text: Within the last three years, Parker has only experienced immaterial information security breaches for which the total expenses were immaterial. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors—Business and Operational Risks" of this Form 10-K, cybersecurity threats remain a risk to our business operations.


text: Cybersecurity Governance Management is responsible for assessing and managing material risks from cybersecurity threats with leadership from the Company's Vice President – Chief Digital and Information Officer ("CDIO"), who is responsible for the Company's global Digital, Information Technology and Cyber Security organization. Our CDIO has served in various roles in information technology and information security for approximately 20 years with Fortune 500 companies. Our CDIO holds Bachelor of Science and Master of Science degrees in Computer Engineering. He has also completed other advanced leadership training and coursework regarding cybersecurity risk management. Our CDIO reports directly to the Chief Executive Officer.


text: Parker's cybersecurity program is led by our Digital & IT VP – Infrastructure and Security, who functions as our chief information security officer ("CISO") and has over 25 years of experience in cybersecurity operations, cybersecurity governance and compliance, risk management, operational technology ("OT") and connected products ("IoT") with global Fortune 200 and Fortune 500 companies across diverse industries, such as retail, consumer goods, entertainment and manufacturing. The CISO reports to our CDIO and is supported by and receives regular updates from our dedicated Cyber Security team within our IT function, as well as our IT Risk Council, a cross-functional group that meets regularly to optimize our Digital & IT Risk Management Program and promote alignment with our Enterprise Risk Management program.


text: Cybersecurity is critical to Patrick's ability to drive its vision and operational initiatives. Patrick faces a range of cybersecurity threats including attacks common to most industries, such as ransomware and denial-of-service, and attacks from more advanced and persistent, highly organized adversaries. Our customers, suppliers, consultants and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: The Board of Directors oversees Management's processes for identifying and mitigating risks, including cybersecurity risks, and to support alignment of our risk exposure with our strategic objectives. Senior leadership, including our Vice President – IT Operations and Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. In the event of an incident, we intend to follow our incident response protocol, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security organization manages the Company's enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our carefully selected combination of security tools that concentrate on both perimeter and internal environments. These solutions are responsible for the protection, detection and response capabilities used in the defense of Patrick's data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity program.


text: The corporate information security organization has implemented a governance structure and process to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats, and mitigate those threats in a timely manner. In addition to developing and implementing pre-existing third party frameworks, we have implemented our own practices and customized controls tailored to the Patrick enterprise environment. We believe this approach enhances our defense in depth stance while increasing our ability to identify, contain and manage cybersecurity risks.


text: Third parties also play a role in our cybersecurity program initiatives. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess the top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, "risk owners" are assigned to develop risk mitigation plans, which are then tracked to completion. The process's annual risk assessment is presented to the Board of Directors.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us, but we do ensure all proper cybersecurity protocol and due diligence is applied across the organization. While Patrick maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, and to support alignment of our risk exposure with our strategic objectives. Senior leadership, including our Vice President – IT Operations and Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. In the event of an incident, we intend to follow our incident response protocol, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.


text: The corporate information security organization has implemented a governance structure and process to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats and mitigate those threats in a timely manner. In addition to developing and implementing pre-existing third party frameworks, we have implemented our own practices and customized controls tailored to the Patrick enterprise environment. We believe this approach enhances our defense in depth stance while increasing our ability to identify, contain and manage cybersecurity risks.


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") program, in which cybersecurity risk is included. Our cybersecurity program is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and leverages International Organization for Standardization and other applicable industry standards. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products. This is supported by our security operating framework, roadmap and governance.

companyName: PENTAIR plc

ticker: PNR


text: Security governance We have established processes to assess, identify and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our ERM organizational process. Strategic and operational cybersecurity risks are assessed, identified and managed by our cybersecurity team, which is led by our Chief Information Security Officer (the "CISO"). Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our Chief Financial Officer, General Counsel, Chief Human Resources Officer, Chief Technology Officer and Chief Supply Chain Officer, and our ERM function, both of which support the Board's oversight of cybersecurity risk.


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls. Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.


text: Security and privacy incident response We have in place an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. The CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.


text: Our incident response team maintains a standard playbook to respond to any potential cybersecurity incidents. We test and evaluate our plans on a regular basis.


text: Third-party risk management We maintain a risk-based third-party risk management process to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Professional-level employees receive mandatory cybersecurity education and training. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and our company.


text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We believe our cybersecurity program is enhanced with the results of the audits, assessments and reviews performed.


text: The Board is responsible for general oversight of our risk management, including cybersecurity risk. The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures. Cybersecurity reviews are conducted at least quarterly and reported to the Board or the Audit and Finance Committee by the CISO and/or Chief Financial Officer at least quarterly.


text: Our cybersecurity team, which assesses and manages our risks from cybersecurity threats, is led by the CISO, who reports to our Chief Financial Officer. Additional oversight for assessing and managing cybersecurity risk include the Security Steering Committee and as part of our ERM program.


text: The CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have, combined, over 100 years of cybersecurity experience, have degrees including Bachelors in Information Systems, Management Information Systems and/or Masters in Security Technologies, and hold professional certifications including Certified Information Systems Security Professional, Global Information Assurance Certification Security Essentials, Certified Cloud Security Professional, Certified Information Systems Auditor, Microsoft Cybersecurity Architect Expert and/or Certified Digital Forensics Examiner. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Impact of Cybersecurity Threats Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See ITEM 1A. "Risk Factors - Increased cybersecurity threats and computer crime pose a risk to our systems, networks, products and services, and we are exposed to potential regulatory, financial and reputational risks relating to the protection of our data" for a discussion of cybersecurity risks.


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors. The Board oversees our risk management practices, including our overall enterprise risk management ("ERM") program, in which cybersecurity risk is included. Our cybersecurity program is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and leverages the International Organization for Standardization and other applicable industry standards. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products. This is supported by our security operating framework, roadmap and governance.


text: Security governance We have established processes aimed to assess, identify and manage material risks from cybersecurity threats. Our ERM organizational process includes annual risk assessments. Our cybersecurity team, which is led by our Chief Information Officer and Chief Information Security Officer (the "CIO/CISO"), is responsible for identifying, assessing and managing strategic and operational cybersecurity risks. Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our General Counsel, Chief Financial Officer, CIO/CISO, and members of our IT, Legal and ERM functions. Both our Security Steering Committee and our ERM function support the Board's oversight of cybersecurity risk.


text: Technical safeguards We deploy technical safeguards designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls. Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.


text: Security and privacy incident response We maintain an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. We test and evaluate our plans on a regular basis. The CIO/CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.


text: Third-party risk management We maintain a risk-based third-party risk management process designed to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.


text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We look to enhance our cybersecurity program with the results of the audits, assessments and reviews we perform.


text: The Board is responsible for general oversight of our risk management, including cybersecurity risk. The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures. We conduct cybersecurity audits and assessments on a regular basis and either our CIO/CISO or Chief Financial Officer report to the Audit and Finance Committee on a quarterly basis.


text: Our cybersecurity team, which is responsible for assessing and managing our risks from cybersecurity threats, is led by the CIO/CISO, who reports to our Chief Financial Officer. The Security Steering Committee provides additional oversight for assessing and managing cybersecurity risk.


text: The CIO/CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CIO/CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have broad experience in security functions in various industries. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We are regularly subject to cyberattacks and other cyber incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: PEPSICO INC

ticker: PEP


text: We assess PepsiCo's Information Security program using an industry-leading cybersecurity framework from the National Institute of Standards and Technology. To help assess and identify our cybersecurity risks, we maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of PepsiCo's environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, the Board believes it is useful and effective for the full Board to maintain direct oversight over cybersecurity matters. In 2021, the Board amended our Corporate Governance Guidelines to specifically mention cybersecurity as an area of Board oversight to reflect this existing practice. The Board receives and provides feedback on regular updates from management, including from the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, regarding cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and also discusses any significant cyber incidents, including recent incidents at other companies and the emerging threat landscape.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer. Such individuals have significant prior work experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.


text: Cybersecurity Governance Cybersecurity and risks related to our information technology ("IT") are an important focus of our Board of Directors' risk oversight. Our Board of Directors, with assistance from the Audit Committee, oversees the Company's enterprise risk management process, which includes cybersecurity risk management. The Audit Committee, a member of which holds a Certificate in Cyber Risk Governance and a Qualified Risk Director designation from the DCRO Institute, receives regular reports from our Chief Information Officer ("CIO"), along with members of senior management, on the identification and status of cybersecurity risks and management.

companyName: TUTOR PERINI CORP

ticker: TPC


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President. Our CIO has over 35 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.


text: Cybersecurity Risk Management and Strategy We have established various policies, processes, and technologies to aid in our efforts to assess, identify, manage, and mitigate material risks posed by cybersecurity threats, including, among other things: • Our CISO and IT teams continuously monitor our systems and perform an annual cybersecurity risk assessment; • We have implemented a proactive incident response and management plan generally aligned with the National Institute of Standards and Technology (NIST), with annual plan testing and training for employees involved in the response process; • Annual penetration tests are performed by a third party and any notable findings are included in remediation plans; • We engage with key industry partners and threat intelligence services, including assessors, consultants and other industry third parties to evaluate our cybersecurity risk management and incident response plans and processes; • All employees, contractors and temporary workers are required to review and acknowledge our acceptable use policies, which include sections on information and cybersecurity practices and policies; • Employees are regularly engaged in cybersecurity awareness campaigns, anti-phishing tests, and mandatory training as needed; • We address third-party cybersecurity risks through interviews and third-party independent assessment reports; • We maintain cybersecurity insurance coverage as part of our overall insurance portfolio; and • In conformity with customer requirements, we require proof that subcontractors complete relevant cybersecurity education and awareness training prior to being awarded a subcontract.


text: We are not aware of any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our Company, business strategy, or financial results, and we have not experienced any cybersecurity incidents that have had a material adverse impact on our operations or financial results. See Item 1A. Risk Factors for a discussion of cybersecurity risks.


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President (who also became the Chief Executive Officer effective January 1, 2025). Our CIO has over 30 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with relevant industry standards.

companyName: PFIZER INC

ticker: PFE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as applicable. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which material incidents would be communicated to executive management, our BOD, external regulators and shareholders. • Enterprise-Wide Coordination: We engage experts from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.


text: • Governance: Our BOD's oversight of cybersecurity risk management is led by the Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are periodically reviewed by the Audit Committee and such reviews include both internal and independent assessment of risks, controls and effectiveness.


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported to the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Security Officer (CISO).


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer, the Chief Compliance and Risk Officer and the General Counsel and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: Our CISO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CISO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other Pfizer colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) program. Management is responsible for assessing and managing risk, including through the ERM program, subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with NIST (National Institute of Standards and Technology) industry standards.


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as appropriate. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which certain significant or potentially material incidents would be communicated to executive management, our BOD, external regulators and shareholders, as appropriate. • Enterprise-Wide Coordination: We engage relevant stakeholders from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information could include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported by the Chief Information Security Officer (CISO) to certain senior leaders, the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives periodic briefings on, and discusses with our CISO, cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding certain significant or potentially material cybersecurity incidents that may occur, including any ongoing updates regarding the same.


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. We believe our CISO and the information security organization have the appropriate expertise, background and depth of experience relating to monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents to manage risks arising from cybersecurity threats. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer and the Chief Legal Officer and their designees.


text: For the fiscal year ended December 31, 2024, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.


text: Risk Management and Strategy Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST (National Institute of Standards and Technology). This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.

companyName: PVH CORP. /DE/

ticker: PVH


text: Risk-based Controls for Information and Systems – We strive to secure our information technology infrastructure and data by implementing, maintaining and executing controls and continuously improving our cybersecurity program's maturity, risk management framework, policies, procedures and governance.


text: Incident Response Plan and Testing – We have a cybersecurity incident response plan and dedicated teams to respond to incidents. Cross-functional teams assess priority and severity, and external experts, including legal counsel, may be consulted. Our cybersecurity teams respond to incidents based on severity levels and improve our plan through regular table top breach exercises, penetration tests and simulations.


text: Education & Interactive Training – We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.


text: Third-Party Risk Management – We execute targeted cybersecurity assessments of suppliers, evaluating their risk profiles and using a rating mechanism to identify vulnerabilities. We also partner with primary suppliers to implement advanced security measures to safeguard their information technology systems and have data security provisions in our contracts with third parties that handle our data.


text: Threat and Vulnerability Management – We, along with our external partners, use resources, technology, and processes to identify, remediate, and report security threats in our systems. These controls are crucial to minimize our attack surface and prioritize possible threats.


text: Cybersecurity and Compliance Assessment Practices – We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.


text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer (CISO) on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer of any cybersecurity incidents should they occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.


text: The CISO reports to the Chief Technology and Information Officer and leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups.


text: Risk Management and Strategy Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST. This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.


text: Education and Interactive Training – We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.


text: Cybersecurity and Compliance Assessment Practices – We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework version 2.0. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or the systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.