text: We have established an Information Security team led by our Chief Information Officer, who has over 30 years of experience in information technology and cloud operations. Our Information Security team is responsible for assessing, identifying and managing risks from cybersecurity threats. Managing cybersecurity risk has been integrated into our overall risk management system and is a priority that we monitor and review regularly with our board of directors. The Information Security team works closely with our Legal team to make determinations whether a cybersecurity incident has occurred and whether the incident has materially impacted or is reasonably likely to materially impact us. If a cybersecurity incident is deemed material, the incident would be communicated to various members of the Alarm.com leadership team and with the board of directors. The board of directors oversees our overall risk management system, including cybersecurity risks. The Chief Information Officer presents at quarterly Board meetings and discusses specific risk areas, including those relating to cybersecurity.


text: To date, there have not been any cybersecurity threats or incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations or financial condition. Refer to Item 1A. "Risk Factors" for a discussion of risks related to data security and the associated risks to our business.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: 2U, LLC


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We, however, have experienced and expect to continue to experience cyber incidents of varying degrees. See Part I, Item A "Risk Factors – Risks Related to our Operations and Our Growth Strategy – If our security measures or those of our third-party service providers are breached or fail, resulting in unauthorized disclosure of data, we could lose clients, fail to attract new clients and be exposed to protracted and costly litigation," for more detailed information on cybersecurity risks and the potential impacts.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from management on our cyber risk management program.


text: Our management team, including our Chief Technology Officer and our SVP Cybersecurity and Runtime Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Additional management is in place for dedicated governance, risk and compliance (GRC) team and cloud and application security team all with a daily focus on the technology risk management within 2U. These management teams have decades of experience in technology risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy We recognize the importance of protecting our critical information technology ("IT") systems and data from material risks from cybersecurity threats. Risk management for cybersecurity threats is integrated into our overall enterprise risk management system. We consider cybersecurity risks alongside other business risks. Our risk management framework includes risk assessments, internal controls, and systems monitoring mechanisms. We have established processes designed to assess, identify, and manage material risks from cybersecurity threats to our IT systems and critical data, including intellectual property, confidential information, and personal data ("Information Systems and Data"). Third parties also play a role in our cybersecurity efforts. We engage third-party services to assist us from time to time to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. We conduct audits and evaluations of our IT infrastructure, network architecture, and software applications to help us identify vulnerabilities, potential entry points, and areas for improvement. We perform assessments considering principles from the National Institute of Standards and Technology Cybersecurity Framework and by using an external third-party security assessor from time to time.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Depending on the environment, we employ strategies and practices designed to protect and mitigate cybersecurity material risks to our Information Systems and Data, including but not limited to: • Utilizing third-party tools to monitor threats and cybersecurity vulnerabilities, reduce risk, and enhance governance, risk, and compliance management. • Engaging a managed cybersecurity service provider to monitor and assess cybersecurity threats, serve as a point of contact for incident notification, and collaborate with our in-house IT team. • Maintaining security policies, procedures, and standards considering evolving threats and industry standards. • Engaging external subject matter experts and advisors to inform us of current cyber practices, policies, and programs. • Conducting tabletop exercises focused on scenarios such as ransomware, disaster recovery, and business continuity. • Providing mandatory annual security and privacy awareness training to all employees who have access to company email and connected devices. • Conducting phishing simulations and cyber hygiene training sessions to educate employees and promote responsible cybersecurity practices. • Maintaining an incident response plan and conducting tabletop exercises.


text: We have established an incident response team, which is led by our IT, legal, and compliance leaders and is comprised of stakeholders from various departments in the Company. A designated member from our IT team is responsible for conducting incident assessments, determining severity levels, informing relevant stakeholder, such as the incident response team and senior management, and maintaining documentation of the remediation activity.


text: In the event of a security incident, our incident response processes are designed to escalate certain cybersecurity incidents to senior leadership, the audit committee and the board of directors, as deemed appropriate.


text: Our audit committee is responsible for overseeing our cybersecurity risk management processes, including regarding cybersecurity threats. Our CFO, Anshul Maheshwari, and Senior Vice President of Operations & Technology, Jeff Bertolini, provide briefings to our audit committee on the effectiveness and progress of our cybersecurity risk management program on regular basis. Mr. Bertolini has completed the Chief Technology Officer program at the Wharton School of the University of Pennsylvania and has over 30 years of experience leading all aspects of operations and IT. Our board of directors receives regular reports from our audit committee chair regarding our cyber risk management programs, potential cybersecurity risks, efforts to mitigate such risks, and the audit committee's oversight of these activities.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A. "Risk Factors", including "If we experience significant disruptions in our information technology systems, our business, results of operations, and financial condition could be adversely affected".


text: Risk management and strategy We recognize the importance of protecting our critical information technology ("IT") systems and data from material risks from cybersecurity threats. Risk management for cybersecurity threats is integrated into our overall enterprise risk management system. We consider cybersecurity risks alongside other business risks. Our risk management framework includes risk assessments, internal controls, and systems monitoring mechanisms. We have implemented and maintain various processes designed to assess, identify, and manage material risks from cybersecurity threats to our IT systems and critical data, including intellectual property, confidential information, that is proprietary, strategic or competitive in nature, health and medical data, clinical trial data, and personal data ("Information Systems and Data"). Third parties also play a role in our cybersecurity efforts. We engage third-party services to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example through penetration testing, independent audits or consulting on practices to address new challenges. We conduct audits and evaluations of our IT infrastructure, network architecture, and software applications to help us identify vulnerabilities, potential entry points, and areas for improvement. We perform assessments considering principles from the National Institute of Standards and Technology Cybersecurity Framework and by using an external third-party security assessor from time to time.


text: Depending on the environment, systems, and data, we employ strategies and practices designed to protect and mitigate cybersecurity material risks to our Information Systems and Data, including but not limited to: • Utilizing third-party tools to monitor threats and cybersecurity vulnerabilities, reduce risk, and enhance governance, risk, and compliance management. • Engaging a managed cybersecurity service provider to monitor and assess cybersecurity threats, serve as a point of contact for incident notification, and collaborate with our in-house IT team. • Maintaining security policies, procedures, and standards considering evolving threats and industry standards. • Engaging external subject matter experts and advisors to inform us of current cyber practices, policies, and programs. • Conducting tabletop exercises focused on scenarios such as ransomware, disaster recovery, and business continuity. • Providing mandatory annual security and privacy awareness training to all employees who have access to company email and connected devices. • Conducting phishing simulations and cyber hygiene training sessions to educate employees and promote responsible cybersecurity practices. • Maintaining an incident response plan.


text: Our audit committee is responsible for overseeing our cybersecurity risk management processes, including regarding cybersecurity threats. Our CFO, Anshul Maheshwari, and Vice President of Information Technology, Michael Vedda, provide briefings to our audit committee on the effectiveness and progress of our cybersecurity risk management program on regular basis. Mr. Vedda has more than 20 years of experience and engages with trusted third-party experts for support and guidance when additional guidance is required. Prior to joining SI-BONE, he managed cybersecurity functions, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters. Our board of directors receives regular reports from our audit committee chair regarding our cyber risk management programs, potential cybersecurity risks, efforts to mitigate such risks, and the audit committee's oversight of these activities.


text: Risk Management and Strategy The Company maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on the Cybersecurity Framework promulgated by the National Institute of Standards and Technology and other applicable industry standards. It includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, employee training and awareness, and technical controls. • Processes to detect the occurrence of cybersecurity events and incidents, maintenance, and periodic testing of incident response and recovery and business continuity plans and processes. • A third-party risk management program to manage cybersecurity risks associated with our service providers, suppliers, and vendors using a risk-based approach that focuses on cybersecurity risks associated with critical service providers, suppliers, and vendors.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Further, the Company's internal controls, various threat landscapes, internal events and incidents, and emerging risks are periodically reviewed to make adjustments to the Cybersecurity Program as needed. Additionally, annual risk assessments and penetration tests are performed.


text: Management of Material Risks & Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into the Company's Enterprise Risk Management ("ERM") program and framework. Together, these programs are designed to foster a company-wide culture of cybersecurity risk management. Our Information Security team works closely with stakeholders across technology, legal, risk, and business units to implement and monitor controls. See "Governance" below for additional information on processes used by management to monitor cybersecurity incidents.


text: Engagement of Third Parties in Connection With Risk Management The Company leverages various third parties to conduct evaluations of our Cybersecurity Program, including security controls. The Company engages a third party to audit its information technology function, which includes an assessment of the Company's cybersecurity efforts. The Company also maintains cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured. Additionally, the Company engages third parties to perform penetration tests on an annual basis. The Company also periodically engages third parties for assessments of specific products, services, or applications. The Company leverages various software and service providers as part of its Cybersecurity Program, including a managed security service provider and a service provider that helps monitor third-party suppliers. The Company also receives periodic threat intelligence reports from vendors, peers, and industry information sharing and analysis centers. The Company maintains a relationship with a leading incident response firm to assist the Company in responding to cybersecurity incidents, if appropriate.


text: Oversight of Third-party Risks Our third-party service providers, suppliers, vendors, and partners face cybersecurity risks that could impact us. Therefore, the Company has developed and implemented processes to oversee and manage these risks. These processes include performing third-party onboarding due diligence such as risk assessments and information security reviews for critical service providers, suppliers, and vendors, seeking to have third-parties agree to contractual requirements designed to ensure cybersecurity and related matters are addressed, and conducting ongoing monitoring and due diligence in accordance with our vendor management and information security policies and standards. As noted above, we use a third-party to aid us in monitoring third-parties' cybersecurity risk.


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Managing cybersecurity risk is a key focus for the Board of Directors. The Company seeks to ensure effective governance in managing risks associated with cybersecurity threats, as more thoroughly described below.


text: Board of Directors Oversight The Risk Committee of the Board of Directors is responsible for the oversight of risks from cybersecurity threats. As described below, where appropriate, strategic risk management decisions are escalated to the Risk Committee, and the Risk Committee receives periodic reports on cybersecurity matters from management.


text: Management's Role in Cybersecurity Risk Management The Chief Information Security Officer ("CISO") of the Bank and a standing management Information Security Committee monitor, measure, and report key indicators, risk assessments, and security measures to the management Corporate Risk Committee. The CISO, in conjunction with the Corporate Risk Committee, makes quarterly reports to, the Risk Committee of the Board of Directors. Such quarterly reporting may include, but is not limited to, key metrics and risk indicators, penetration test results, risk assessment results, status of ongoing initiatives, incident and notable event reports, compliance with regulatory standards, and operational issues. In addition to quarterly reporting to the Board's Risk Committee, the Company's incident response processes include escalation to management when an incident is suspected.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing our Cybersecurity Program rests with the CISO, Mr. Richard Friedberg. With over 25 years of experience in the field of cybersecurity, his background includes extensive experience across the financial sector, technology sector, and U.S. government. Mr. Friedberg is also an adjunct faculty member at Carnegie Mellon University, teaching risk and cyber practices. Mr. Friedberg holds a Bachelor of Science from Carnegie Mellon University, a Master of Business Administration from George Washington University, and maintains certification as a Certified Information Systems Security Professional and Certified Information Security Manager.


text: Monitoring Cybersecurity Incidents The CISO is continually informed of and monitors cybersecurity risks and incidents through real-time updates, including a partnership with a managed security service provider. Periodic Information Security Committee meetings cover key metrics and risk indicators, penetration test results, risk assessment results, status of ongoing initiatives, incident and notable event reports, compliance with regulatory standards, and operational issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the CISO or the CISO's designee, who in turn engages with the corporate Incident Response Team (IRT) to respond to the incident. The CISO is also responsible for informing the Information Security Committee of cybersecurity incidents, which in turn reviews the impact of incidents and monitors the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notice to the Risk Committee of the Board of Directors. These processes assist management and the Risk Committee in staying informed of and monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Reporting to Board of Directors The CISO, in his capacity, periodically informs the Information Security Committee, Corporate Risk Committee and Board's Risk Committee of cybersecurity risks and incidents. This enables the highest levels of management to be kept abreast of the Company's cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Risk Committee of the Board of Directors, where appropriate.


text: The Board of Directors is responsible for the Company's risk management strategy and overseeing the Company's risk management program, of which cybersecurity is a critical element. The Chief Strategy and Technology Officer ("CSTO") and the Chief Information Security Officer ("CISO") are responsible for designing, implementing and administering the Company's cybersecurity risk management policies, processes and practices, business continuity planning and disaster recovery functions and activities. The CSTO and CISO meet on a quarterly basis with other members of Management as the Technology and Information Security Committee ("TIS Committee") to review the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), applicable industry standards, and applicable data privacy and cybersecurity regulations. Annual technology and cybersecurity risk assessments are conducted to identify and evaluate applicable risks and controls designed to address such risks. In general, the Company seeks to identify, assess and manage material cybersecurity risks through a company-wide approach addressing the confidentiality, integrity, and availability of the Company's information systems and the information that the Company collects and processes.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable. • Technical Safeguards: The Company implements and maintains technical safeguards designed to protect the Company's information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls. Such safeguards are generally evaluated through internal security testing, third party penetration testing and vulnerability assessments, as well as outside audits and certifications, and revised as warranted. The Company seeks to comply with the cybersecurity framework guidelines issued by the NIST and ISO. • Education and Awareness: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery to equip Company employees with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Incident Response and Recovery Planning: The Company's Security Operations Center ("SOC"), reporting to the CISO, provides 24x7 incident monitoring. If an incident occurs which SOC determines qualifies as a "critical risk" according to predetermined criteria, the SOC engages an incident management team to assist with evaluating, responding to and managing the response of the incident. The Company has established and maintains comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents. The Company conducts periodic drills and tabletop exercises to test these. • Third-Party Risk Management: The Company conducts initial, and on a periodic basis, subsequent risk evaluations of vendors that satisfy certain preestablished criteria classifying such vendors as presenting higher potential cybersecurity risks based upon vendor access to or provision of information systems or data to the Company that present significant potential risks.


text: The Company conducts periodic assessments of the Company's policies, standards, processes and practices. Summary results of such assessments are evaluated by the CISO to assist the Company in adjusting its cybersecurity policies, standards, processes and practices; the CISO reviews critical results with the TIS Committee.


text: The Board of Directors oversees the Company's risk management program, including the management of cybersecurity threats. The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company's strategy to manage the risks associated with such threats. The TIS Committee provides Management oversight of the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.


text: To facilitate the success of the Company's cybersecurity program, cross-functional teams work with the CISO and SOC to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.


text: The CISO has served in various roles in information technology, information security, and business continuity for over 20 years. The CISO holds undergraduate and graduate degrees in Information Systems Management and has attained the professional certification of Certified Information Security Manager from the Information Systems Audit and Control Association.


text: Material Effects of Cybersecurity Incidents Previous cybersecurity incidents did not have, and are not reasonably likely to have, a material effect on the Company, including its business strategy, results of operations, or financial condition.


text: The Company's cybersecurity policies, standards, processes, and practices are generally based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), applicable industry standards, and applicable data privacy and cybersecurity regulations. Annual technology and cybersecurity risk assessments are conducted to identify and evaluate applicable risks and controls designed to address such risks. In general, the Company seeks to identify, assess and manage material cybersecurity risks through a company-wide approach addressing the confidentiality, integrity, and availability of the Company's information systems and the information that the Company collects and processes.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company strives to have controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable. • Technical Safeguards: The Company strives to implement and maintain technical safeguards designed to protect the Company's information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls. Such safeguards are generally evaluated through internal security testing, third party penetration testing and vulnerability assessments, as well as outside audits and certifications, and revised as warranted. The Company seeks to comply with the cybersecurity framework guidelines issued by the NIST and ISO. • Education and Awareness: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery in an effort to equip Company employees with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Incident Response and Recovery Planning: The Company's Security Operations Center ("SOC"), reporting to the CISO, strives to provide 24x7 incident monitoring. If an incident occurs which SOC determines qualifies as a "critical risk" according to predetermined criteria, Company policy requires the SOC to engage an incident management team to assist with evaluating, responding to and managing the response of the incident. The Company has established and seeks to maintain comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents. The Company strives to conduct periodic drills and tabletop exercises to test these. • Third-Party Risk Management: The Company strives to conduct initial and periodic risk evaluations of vendors meeting predefined criteria for heightened cybersecurity risk, based on their access to or provision of critical information systems or data.


text: The Company strives to conduct periodic assessments of the Company's policies, standards, processes and practices. Summary results of such assessments are evaluated by the CISO to assist the Company in adjusting its cybersecurity policies, standards, processes and practices; the CISO reviews critical results with the TIS Committee.


text: The Board of Directors oversees the Company's risk management program, including the management of cybersecurity threats. The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company's mitigation strategies. The TIS Committee provides Management oversight of the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.


text: To facilitate the success of the Company's cybersecurity program, cross-functional teams work with the CISO and SOC seek to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.


text: Material Effects of Cybersecurity Incidents Past cybersecurity incidents have not had, and are not reasonably expected to have, a material impact on the Company's business strategy, operations, or financial condition.


text: Risk management and Strategy We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. Our critical information technology includes certain computer networks, third-party hosted services, communications systems, software, personal computers and servers (collectively, "Information Technology"), and our critical data includes certain confidential, personal, proprietary and sensitive data (collectively "Confidential Data"). Accordingly, we maintain risk assessment processes designed to identify cybersecurity threats relating to such Information Technology and Confidential Data, and assess potential material impact to our business that may result from such threats. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our Information Technology and Confidential Data and mitigate material harm to our business.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: We identify such threats by, among other methods, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting vulnerability assessments.


text: In the event a threat results in a cybersecurity incident, we have a process for escalating certain cybersecurity incidents from our security team up through our security leadership and ultimately to management.


text: Based on our risk assessment process, we implement and maintain various technical, physical and organizational processes designed to manage and mitigate cybersecurity risks that could affect our Information Technology and Confidential Data, and potential material impacts that may result from such risks. We have implemented measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. The cybersecurity risk management processes we maintain for our Information Technology and Confidential Data, depending on the particular environment and system processes, are designed to address cybersecurity threats; incident response; vulnerability management; business continuity; incident detection and response; internal and external evaluations to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security; threat modeling; physical and electronic access; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management; employee security training; penetration testing; cyber insurance; and the maintenance of a dedicated cybersecurity team.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. For certain vendors, our vendor management process includes evaluating the cybersecurity practices of such provider and contractually imposing obligations on the provider related to the services they provide and/or the information they process.


text: For a description of the risks from cybersecurity threats that may materially affect the company and how those risks may affect the company, please refer to Part I, Item 1A. Risk Factors—Risks Related to our Intellectual Property and Technology of this Annual Report on Form 10-K for additional information about cybersecurity-related risks.


text: Our board of directors oversees our overall risk management strategy. The Audit Committee has general oversight with respect to cybersecurity risk. The Audit Committee has established a cybersecurity subcommittee to discuss issues and risks related to cybersecurity, and it includes one of our board members with cybersecurity experience, and holds regular meetings. This subcommittee has a dedicated agenda during such meetings that are designed to assist the Audit Committee with its cybersecurity oversight and allow it to report to the full Board if necessary. The meetings involve presentations and reports from our management, security leadership and information security team, including updates on relevant cybersecurity threats faced by the company and steps we are taking to address them.


text: Our management team is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing the implementation and maintenance of our cybersecurity policies and procedures and activities carried out in furtherance of those policies and procedures. The Vice President of Information Technology leads our cybersecurity risk management efforts and helps us assess cybersecurity risks, establish priorities, and determine the scope and details of our cybersecurity program. We have identified certain members of management and relevant employees to oversee our cybersecurity incident response and vulnerability management processes.


text: Our management team is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing the implementation and maintenance of our cybersecurity policies and procedures and activities carried out in furtherance of those policies and procedures. The Senior Vice President of Security leads our cybersecurity risk management efforts and helps us assess cybersecurity risks, establish priorities, and determine the scope and details of our cybersecurity program. We have identified certain members of management and relevant employees to oversee our cybersecurity incident response and vulnerability management processes.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: These processes include internal and external vulnerability management systems, security grading systems, scanning systems, firewalls and breach alert systems, among others. Such systems and processes are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. As part of our risk management process, we conduct monthly vulnerability scans, annual penetration testing, phishing tests, annual risk assessments, and ad-hoc application security assessments. We also maintain a variety of playbooks for our incident response plan that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity and compliance training at least annually.


text: In addition, we engage certain third-party security providers to assist with assessing, identifying, and managing cybersecurity risks. Such services include but are not limited to managed security providers, assessors, consultants, auditors, and penetration testers. We also use a third party vendor management software to assess the security posture of other material third party vendors to reduce the impact of a security incident from such vendors. As discussed below, we rely on notifications from third-parties and other external alert systems to identify material risks that may exist with such parties.


text: Our cybersecurity team is led by our chief information security officer, who is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior management and other teams across the Company. The chief information security officer provides regular updates to the Cybersecurity Committee (discussed further below) of which he is also a member. Our chief information security officer has extensive cybersecurity knowledge and skills gained from over 20 years of experience at the Company as chief information security officer and chief information officer where he has been responsible for implementing and maintaining cybersecurity and data protection practices, implementing complex technology solutions, and managing large groups of technology professionals. He holds multiple cybersecurity industry focused certifications and reports directly to the Co-Chief Executive Officer.


text: Cybersecurity incidents come to the attention of the Company from the cybersecurity team which may be notified of such incidents from internal vulnerability monitoring systems, third-party vendors, government or industry alerts, media broadcasts, or employee self-reporting. Risk assessment and mitigation efforts related to cybersecurity incidents are subject to oversight by the Cybersecurity Committee, which monitors the prevention, detection, and remediation of such incidents. The Cybersecurity Committee, which is comprised of directors from different divisions within the Company, as well as members of the cybersecurity team and the chief information security officer, oversees Company policies and procedures for protecting cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Cybersecurity Committee meets at least quarterly or whenever a material cybersecurity incident is identified at the Company. Material cybersecurity incidents, as well as mitigation efforts related to such incidents, are promptly reported to senior management.


text: Our cybersecurity risks and associated mitigation efforts are continuously monitored and evaluated by senior management as part of the Company's overall risk management process. In addition, a report prepared by the chief information security officer outlining any material cyber risks as well as any mitigation efforts is presented by the chief information security officer to the Audit Committee of our Board of Directors on a quarterly basis as part of the Company's enterprise risk assessment.


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Data Security and Intellectual Property," which should be read in conjunction with the information above.


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats. We continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following: • industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, email security and firewalls to protect our assets and our ability to maintain operations; • use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response (EDR), security information and event management (SIEM) and vulnerability management; • a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center; • regularly monitoring and assessing our cybersecurity programs using external parties including a third-party security operations center, cyber maturity assessments, penetration tests and other targeted controls assessments; • central systems backup processes and associated disaster recovery plans; • membership in an information sharing and analysis center (FS-ISAC) so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and • employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.


text: The risk oversight committee of our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our company takes to monitor and mitigate these risks. The risk oversight committee is briefed semi-annually by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the risk oversight committee, we also have established a security and privacy steering committee comprised of members of senior management and our CISO to oversee data privacy and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in the role since 2019 and has supported the company since 2015.


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance, processing and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats, as are many other organizations within the financial servicing industry. We continuously monitor and develop our information technology networks and infrastructure to help prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition. For additional information on these risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following: • industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, patch management, email security and firewalls to protect our assets and our ability to maintain operations; • use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response, security information and event management and vulnerability management; • a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center; • regularly monitoring and assessing our cybersecurity programs using external parties including a third-party 24/7 security operations center and by conducting periodic cyber maturity and risk assessments, penetration tests and other targeted controls assessments; • central systems backup processes and associated disaster recovery plans; • membership in an information sharing and analysis center and other industry groups so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and • employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.


text: Our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our Company takes to monitor and mitigate these risks. The board is briefed semi-annually or as needed by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the board, we also have established a security and privacy steering committee comprised of members of senior management, including our CISO and our Chief Technology Officer, to oversee data privacy, information technology, and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in this role for the Company since 2019 and has supported the Company's information security function since 2015.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: Accordingly, we have developed an informational security program and devoted resources for assessing, identifying and managing risks associated with cybersecurity threats, including: • established a dedicated internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • implemented continuous monitoring tools and a third-party Security Operations Center that can detect and respond to cybersecurity threats in real-time; • perform ongoing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain measures to mitigate their cybersecurity risk; • retain third-party cybersecurity consultants who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; • conduct frequent cybersecurity training and testing for our workforce; • provide our board of directors with regular updates regarding threat levels, including analyses that demonstrate the overall cybersecurity posture and health of the organization; • engage in periodic assessments of our cyber resilience with the Cybersecurity and Infrastructure Security Agency (CISA); • conduct scheduled reviews of our Incident Response Plan to assess the responsiveness during a cybersecurity event or Ransomware attack; and • maintain third party vendor management program, which includes requirements for how our partners transmit, store and use bank information.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer and Chief Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security, integrity and confidentiality of customer records and information, and prohibit unauthorized access to our critical operating systems. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents, including with respect to our commercial customers and vendors, that require us to make changes to our processes and implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that future threats and incidents could have a material adverse effect on our business strategy, results of operations and financial condition, even if the threat or incident is promptly identified and countermeasures are implemented. Such events could lead to direct financial loss or require the expenditure of significant amounts to obtain the release of critical data and/or restore our operating systems or those of our customers and/or vendors if the incident was the result of a security breach for which we are held legally responsible.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Security Officer. Our Chief Information Security Officer has 20 years of information technology and information security experience, and before joining our Company has held the positions of Chief Technology Officer and Director of IT and Information Security Officer at his prior places of employment.


text: In addition, our board of directors, as a whole and through its Risk Policy & Compliance Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team, including from our Chief Risk Officer and our Chief Information Security Officer regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."


text: Accordingly, we have developed an informational security program and devoted resources for assessing, identifying and managing risks associated with cybersecurity threats, including: • established a dedicated internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • implemented continuous monitoring tools and a third-party Security Operations Center that can detect and respond to cybersecurity threats in real-time; • perform ongoing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain measures to mitigate their cybersecurity risk; • retain third-party cybersecurity consultants who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; • conduct frequent cybersecurity training and testing for our workforce; • provide our board of directors with regular updates regarding threat levels, including analyses that demonstrate the overall cybersecurity posture and health of the organization; • engage in periodic assessments of our cyber resilience with the Cybersecurity and Infrastructure Security Agency (CISA); • conduct scheduled reviews of our Incident Response Plan to assess the responsiveness during a cybersecurity event or Ransomware attack; and • maintain third party vendor management program, which includes requirements for how our partners transmit, store and use Bank information.


text: Risk Management and Strategy Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our residents are necessary for the operation of our business. We use these systems, among others, to manage our resident and vendor relationships, for internal communications, for accounting to operate record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: In recent years, cybersecurity attacks have increased on businesses as cyber criminals seek to gain access to sensitive information and use it for their personal or financial gain. We continuously seek to implement advanced technologies to strengthen our infrastructure, monitor for threats, and evaluate our capability to respond to incidents in order to minimize the potential impact to our systems, data, and operations.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We also work with third parties that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing certain obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Audit Committee oversees risks and exposures associated with financial matters, particularly financial reporting, tax (including compliance with REIT rules), accounting, disclosure, internal control over financial reporting, cybersecurity, financial policies, investment guidelines, development and leasing, and credit and liquidity matters. In addition, the Risk Committee oversees our enterprise risk management practices to ensure that we are equipped to anticipate, identify, prioritize, and manage material risks to the Company. Our Risk Committee assists our Board of Directors in its oversight of our enterprise risk management framework, including cybersecurity, our overall risk-taking tolerance and our management of financial, reputational and operational risk.


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over five years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries as a President and Chief Information Officer at Results Theory, Inc.. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the Chief Financial Officer.


text: We rely on a multidisciplinary team, including our information security personnel, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy by educating, and communicating key priorities such as potential threat awareness, vendor scrutiny and device security to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the President and Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our President and Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over six years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the President and Chief Financial Officer.


text: We maintain a cybersecurity risk assessment program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Trane Technologies plc

ticker: TT


text: Any changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates systems and applications hosted by external parties for cybersecurity risks and assesses the security posture and features of those services. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.


text: Like other comparable-sized companies, our information technology systems, networks and infrastructure and technology embedded in certain of our control products have been and may continue to be vulnerable to cyber-attacks and unauthorized security intrusions. These types of attacks may include computer viruses, malicious code, unauthorized access, phishing attempts, denial-of-service attacks, among others. For more information about these and other cybersecurity risks faced by us, see Part IA, Item 1A, "Risk Factors - Risks Related to Cybersecurity and Technology."


text: Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from our internal cybersecurity team on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess and manage our key cybersecurity programs and risks. We also maintain an Enterprise Risk Intelligence Committee (ERIC), a management-level cross-functional group designed to monitor and mitigate risks, including cybersecurity risks, that pose a threat to our strategic objectives. The ERIC is charged with providing guidance and direction for integrating enterprise risk intelligence with important business processes, such as strategic planning, business forecasting, operational management, and investment allocation to ensure consistent consideration of risks in decision making. Finally, we maintain an Enterprise Cybersecurity Governance Committee that presents updates on cybersecurity initiatives, known and emerging issues and risks, and program updates to a cross-section of our senior management.


text: We maintain a cybersecurity program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; • Maintain an operational technology (OT) security program to address cyber risks that are inherent and unique to our industry and manufacturing environment; • Maintain a centralized product security program that unifies company-wide strategy to ensure our customer-facing products and services are secure by design; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.


text: Any changes or additions to our cybersecurity program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates third parties that either host or have access to our data and/or systems to ensure that they are aligned with our security requirements. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.


text: CYBERSECURITY RISK The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity, and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.

companyName: Otter Tail Corp

ticker: OTTR


text: RISK MANAGEMENT AND STRATEGY Our cybersecurity policies and practices, which are based on the Center for Information Security (CIS) Critical Security Controls, are governed by our information and cybersecurity governance program. The CIS Critical Security Controls are a set of 18 cybersecurity-related controls which aid companies in designing an effective control environment and are viewed as best practices by organizations worldwide. A significant number of our cybersecurity policies and practices associated with our electric utility operations are also subject to regulation by multiple governmental and other agencies.


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards, and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.


text: We perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk. As part of our risk assessment process, we incorporate results from procedures performed by third-party consultants. We utilize third-party consultants to complete risk quantification analysis and perform penetration and vulnerability testing and monitoring, as well as overall cybersecurity control testing. Potential risks associated with the use of third-party service providers are monitored and managed through an established service provider management policy. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements, and data disposal commitments.


text: In managing cybersecurity risk, we employ a defense-in-depth strategy and regularly monitor our cyber environment for potential new threats. Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security, and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining, and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating, and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to the Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk review and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks, and a review of any emerging risks. Annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.


text: CYBERSECURITY RISK The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.


text: We perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk. As part of our risk assessment process, we incorporate results from procedures performed by third-party consultants. We utilize third-party consultants to perform penetration and vulnerability testing and monitoring, as well as overall cybersecurity control testing. Potential risks associated with the use of third-party service providers are monitored and managed through an established service provider management policy. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements and data disposal commitments.


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to our Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk reviews and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks and a review of any emerging risks. At least annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.


text: management program, the Board devotes time and attention to cybersecurity and data privacy-related risks, with the Audit Committee of the Board of Directors responsible for overseeing information technology risk exposures, including cybersecurity, data privacy and data security.

companyName: Accenture plc

ticker: ACN


text: The Audit Committee receives reports on cybersecurity and data privacy matters and related risk exposures from management, including our chief information security officer ("CISO"), at least twice a year and more frequently as applicable. In addition, the Audit Committee's quarterly enterprise risk management updates include developments regarding IT security and data protection. Recent topics included evolving generative AI threats, social engineering resistance and deepfake readiness. The Audit Committee regularly updates the Board on such matters and the Board also periodically receives reports from management directly. We have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated within the company and, where appropriate, reported promptly to the Board.


text: Our CISO leads all aspects of Accenture's global cybersecurity program, including security operations, client data protection, cyber risk reduction strategies, incident response, cybersecurity integration of acquisitions and our industry-leading behavioral change program. Our CISO joined Accenture in 1995. Prior to being appointed CISO in 2020, he helped create Accenture's information security capability and led the implementation of information security technology. Previously, he managed large technology transformations for Accenture and for clients in the United States, Japan and Australia. Our CISO reports to our Chief Operating Officer and is supported by a team of over 800 people with expertise in technical architecture and security operations; governance, risk and compliance; client data protection; behavioral change; and cyber incident response, many of whom hold cybersecurity certifications and possess deep technical knowledge and experience.


text: Our information security team maintains an extensive governance network, including formal relationships with other organizations within Accenture through our Situation and Action Committee, which includes representatives from our Markets and Services and the legal, information technology, corporate services and sustainability, data privacy and business resilience services teams. In addition, our cyber incident response efforts are overseen by a cross-functional leadership team including our CISO, our General Counsel and our Chief Marketing Officer.