text: Risk Management and Strategy We have established an Information Security Management System ("ISMS") comprised of policies, procedures, and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall enterprise risk management systems and processes. Our ISMS is aligned to generally accepted security standards and is certified by third-party auditors according to ISO/IEC 27001 standards. We routinely assess cybersecurity risks for materiality, including assessing any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: QUALYS, INC.

ticker: QLYS


text: We routinely conduct risk assessments to identify cybersecurity threats and weaknesses, as well as risk assessments of events that could potentially materially change our business practices and affect our information systems that could be impacted by cybersecurity threats and vulnerabilities. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

secItem: Item 1C


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Security Operations Center ("QSOC") and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The QSOC and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.


text: We routinely evaluate the risks posed by third-party providers and engage with those whom fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.


text: We engage assessors, consultants, auditors, and other third parties in order to obtain external validation for effectiveness and adequacy of our security posture in compliance with regulatory requirements. These service providers attest to our organization-wide design and implementation of cybersecurity policies and procedures, and annually monitor such policies and procedures from a safety perspective.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.


text: Our board of directors, with assistance from management, monitors and assesses strategic risk exposure, and our management team is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit and Risk Committee of our board of directors ("Audit and Risk Committee").


text: Our CISO and our Security Steering Committee, which includes members from management across all company functions such as security, IT, human resources, sales and marketing, engineering, legal, and finance, are primarily responsible for assessing and managing cybersecurity threats. Our CISO is a cybersecurity industry expert with over two decades of experience in cybersecurity, including work at multi-national technology companies and for a U.S. state government. He holds several industry certifications including CISSP, OSCP, CCSP, and GCFA and is also a graduate of the Carnegie Mellon University's Chief Information Security Officer Executive Program. Our CEO is also a cybersecurity industry expert who has deep insight and over two decades of experience in cybersecurity, technology and information security.


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is committed to notifying the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Cybersecurity Fusion Center and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The Cybersecurity Fusion Center and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.


text: We have also established a Product Security Incident Response Team ("PSIRT") that identifies, assesses, and responds to security incidents, risks, and vulnerabilities associated with Qualys' commercial products. The Qualys PSIRT investigates vulnerabilities and incidents across the entire Qualys product portfolio. PSIRT coordinates product impact assessments and fixes based on industry standards such as the Common Vulnerabilities and Exposure ("CVE") and Common Vulnerability Scoring System ("CVSS"). PSIRT operates in alignment with relevant requirements and industry standards and coordinates its activities with the CSIRT.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT and PSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is required to notify the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.


text: The Company maintains a robust Information Security Program that sets forth the Company's commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing, and protecting sensitive information including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA). The Company uses or adheres to relevant standards and frameworks from the Federal Financial Institutions Examination Council (FFIEC) and National Institute of Standards and Technology (NIST), among others, to assess information security risks and controls, as well as to assess the maturity and effectiveness of the Information Security Program.

companyName: Beacon Financial Corp

ticker: BBT


text: The Board of Directors and Executive Management are responsible for ensuring that the Information Security Program within Enterprise Risk Management identifies, measures, monitors, controls, and reports risk according to significance. If risks are determined to be undesired and beyond stated and aggregated Risk Appetites, the Board of Directors and Executive Management take appropriate action to ensure that excessive risk is mitigated or eliminated, which may include reducing risk exposure. The Board of Directors has final responsibility, after consultation with management, for ensuring the Information Security Program aligns with the overall business strategy and provides oversight to protect the Company from ongoing and emerging threats, including those related to cybersecurity.


text: The Information Security Program is overseen by the Company's Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer. The CISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.


text: The Company maintains a robust Third-Party Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments to ensure sensitive information is safeguarded appropriately.


text: The Company has a dedicated internal Security Operations Center ("SOC") and a Managed Detection and Response ("MDR") third party service that provides 24/7/365 monitoring of its environment to investigate and respond to security alerts. Log sources are mapped to the MITRE ATT&CK framework to ensure appropriate security monitoring and gap analysis to detect and respond to attacks. Threat intelligence is used with contextual risk approaches to identify threats and prioritize response. Threat hunts operate both proactively and reactively to look for relevant behaviors and indicators of compromise from cybersecurity events or zero-day vulnerabilities. An Incident Response Plan is in place to ensure the timely and effective handing of security incidents. This includes providing the Company with a detailed outline of how to respond to a security incident, team responsibilities, contact information for key resources, definitions for determining the severity and escalation of security incidents, and pre-built playbooks to respond to the most common types of security incidents including ransomware. Incident response and escalation plans are tested and reviewed for improvements at least annually. An incident response retainer with an approved third party is contracted to assist in responding to security incidents and to conduct forensic investigations involving the potential compromise of sensitive data or information assets. All employees are required to complete privacy and information security awareness training upon joining the Company and on an annual basis. This includes incident response training on how to communicate potential or actual incidents.


text: The Company continues to face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, or reputation. Although such risks have not materially affected us, we have experienced threats to and breaches of our data, including breaches caused by human error or breaches affecting third parties of the Company. For more information about the cybersecurity risks we face, see Item 1A-RISK FACTORS.


text: The Information Security Program is overseen by the Company's Information Security Officer ("ISO"), who reports directly to the Chief Risk Officer. The ISO has held this position with the Company since May, 2024, and has worked at the Company in cybersecurity for almost 12 years and in the information technology industry for more than 16 years. The Chief Risk Officer has held the position at the Company since October 2016, when he joined the Company from the FDIC where he was employed for 24 years and held multiple positions including Senior Risk Examiner for the Division of Risk Management Supervision and Acting Regional Manager for the Division of Insurance and Research. During his tenure with the FDIC, the CRO served from time to time as the Examiner-in-Charge for Berkshire Bank and numerous other banks throughout New England. The ISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.


text: The Company continues to face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, or reputation. Although such risks have not materially affected us, we have experienced threats to and breaches of our data, including breaches caused by human error or breaches affecting third parties of the Company. For more information about the cybersecurity risks we face, see Item 1A-Risk Factors.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, to enhance our cybersecurity oversight.

companyName: CURIS INC

ticker: CRIS


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management, including our head of information technology, regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards. Our head of information technology, who has 25 years of information technology management experience, reports to our chief financial officer, oversees and manages the day-to-day functions of our cybersecurity risks, and works with an incident response team to evaluate security and privacy incidents and the implementation of appropriate actions.


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data, as our customers trust our technology to deliver the highest levels of security, privacy, performance, compliance and availability at scale.

companyName: Salesforce, Inc.

ticker: CRM


text: Management is responsible for the day-to-day administration of the Company's cybersecurity policies, processes, practices and risk management. The Board, including through its dedicated Cybersecurity and Privacy committee (the "Committee"), oversees the various cybersecurity risks facing the Company and the Company's efforts to mitigate those risks.


text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in efforts to protect customer data. We aim to provide the most secure and compliant enterprise cloud platform on the market and we work to build trust and in-depth defense into all of our systems. Among other things, we employ a diverse, experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to enable our customers to focus on their business, knowing their data is safe and accessible as needed.


text: We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including SOC 1, SOC 2, SOC 3, ISO 27001, 27017 and 27018, CSA STAR and others.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.


text: Board Oversight and Governance As mentioned above, the Board established the Committee to provide dedicated oversight of cybersecurity-related management, strategy, initiatives, risks, threats and remediation activities. The Committee receives regular presentations, reports and updates from the Company's Chief Trust Officer ("CTrO") and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics. After each quarterly meeting of the Committee, the Board receives a report from the Chair of the Committee with an update on the Company's oversight of cybersecurity risks and mitigation efforts. The Committee also receives periodic reports from an experienced outside consultant with information security expertise providing insights on key focus areas to aid in the Committee's oversight of the Company's cybersecurity program.


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. The Company's policy is for the Board and the Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data.


text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Items 1A-C, "Risk Factors."


text: Cybersecurity Risk Management and Strategy When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in their efforts to protect their data. We aim to provide a secure and compliant enterprise cloud platform and we work to build trust and in-depth defense into all of our systems. Among other things, we employ an experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to help enable our customers to focus on their business, knowing their data is safe and accessible as needed.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results and evolving industry practices. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. In between meetings, the Board and the Committee receive information regarding relevant cybersecurity risks (including cybersecurity incidents) that meet pre-established reporting thresholds, as well as ongoing updates regarding any such risks.


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering & Customer Success Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to help protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are able to be informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of a cybersecurity incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks and incidents to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize cybersecurity incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.


text: Risk management and strategy Cybersecurity risk for all Registrants is managed at the enterprise-level. Management of material risks from cybersecurity threats is integrated into the Registrants' overall risk management processes and is monitored as an enterprise risk. Exelon's Chief Information Security Officer (CISO) and cybersecurity management team regularly hold meetings with senior management of each Registrant, facilitated by Exelon's enterprise risk management team, to discuss issues pertaining to cybersecurity risk management, including changes in the nature and origin of threats, threat actor and risk mitigation activities, and regulatory developments. Exelon Legal and compliance professionals engage with the CISO and cybersecurity management team to address tactical and strategic cybersecurity risks. Exelon monitors cybersecurity risks through key risk indicators to identify potential changes in risk exposure and provide the Board of Directors with information about the monitoring of key risks in connection with its oversight of the Registrants' enterprise risk management system.

companyName: EXELON CORP

ticker: EXC


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, develop and deploy new technologies, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.


text: In assessing the effectiveness of its cybersecurity risk management program, the CISO makes use of external perspectives from regulatory compliance audits and inspections, external audits of the Registrants' financial systems, and third-party incident response and detection analytics. Cybersecurity risks associated with the Registrants' use of certain third-party service providers are evaluated and managed through CISS' Third Party Security team that leverages security risk assessments, contractual terms and conditions, and security awareness training for such providers. Additionally, those providers are required to report cybersecurity incidents, including the unauthorized use or disclosure of Registrants' confidential information to Exelon's security operations center. Third Party Security investigates certain third-party cybersecurity events as part of Exelon's incident response program.


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the 2022 Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 25 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 23 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment; risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.


text: Exelon maintains a single, centralized cybersecurity incident response program and plan that aligns with NIST CSF by integrating the identify, determine/classify, escalate and respond functions (which track the lifecycle of an event or incident). Security threats and incidents are identified and assessed to determine potential impact and escalated to senior cybersecurity management and the CISO. The CISO directs the security incident response team to contain, eradicate, and recover from an active threat. Exelon leverages the expertise of dedicated incident response vendors that can provide timely and specialized support to respond and recover from an event. The CISO and a cross-functional team convene as needed to evaluate cybersecurity events, including third-party events. The legal and compliance departments provide incident response support to the CISO, manage cybersecurity-related legal and compliance issues, and direct materiality evaluations using both qualitative and quantitative factors for each Registrant.


text: Although the Registrants have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect each Registrant's business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "The Registrants are subject to physical and cybersecurity risks" in ITEM 1A. of this report.


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 26 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 24 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment;


text: risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.


text: Cyber Risk Management and Strategy We rely on digital technology to conduct our business operations and engage with our clients, business partners and employees. The technology that we, our clients, business partners and employees rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising the due care necessary to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

companyName: ALLIANCEBERNSTEIN L.P.


text: Through a combination of security, risk and compliance resources, AB implements Information Security through a dedicated Information Security Program ("ISP") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.


text: Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another later of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. Our security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments and our internal audit function includes certain cyber risk audits as part of its overall risk audit. We review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of our ISP, we also perform cyber risk assessments on our critical and material third party vendors during onboarding, then periodically thereafter.


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including those discussed in Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. the full Board is updated on an as needed basis. In the event of an immediate cyber threat to our business operations, our ISP would involve our General Counsel, who would promptly notify the Chairperson of the Audit and Risk Committee, as to the nature, timing and extent of the threat and our applicable contingency plans would go into effect. Our CRO, in collaboration with our CISO, is responsible for notifying the Audit and Risk Committee of world events or of other significant external events that may pose cybersecurity threats or material risks to our business continuity.


text: While our Board provides oversight of our cybersecurity risk environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. Our CISO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our ISP within the organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. Our CISO has years of applied experience in actively managing cybersecurity and information security programs for large global publicly traded companies with complex and evolving information systems. Management oversight of our ISP is provided by various governance committees including the Operational Risk Oversight Committee, the Information Security Risk Oversight Subcommittee and the Financial Crimes Control Oversight Subcommittee.


text: Cyber Risk Management and Strategy Through a combination of security, risk and compliance resources, AB implements information security through a dedicated Information Security Program ("ISP ") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.


text: AllianceBernstein Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The defense-in-depth strategy manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) periodically assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) essential business functions remaining available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers, as appropriate, impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments to identify, assess, manage, and as appropriate, mitigate and respond to cybersecurity risks, and our internal audit function includes certain cyber risk audits as part of its overall risk audit. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of our ISP, we also perform cyber risk assessments on our third party vendors where we deem appropriate based on our risk assessment of such vendors, then periodically thereafter.


text: As of the date of this report, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations. However, there can be no assurance that the Company will not be materially affected by such risks. See Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks for a discussion of cybersecurity risks.


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. The full Board is updated on an as needed basis. In addition, management updates the Audit and Risk Committee, as appropriate, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: Cybersecurity is an important component of our overall risk management program. Our cybersecurity policies and practices are integrated into our risk management program and are based on recognized frameworks. ON24 is certified under ISO 27001:2013 and 27701:2019, which sets forth a strict framework for managing security and privacy risks, including the necessary internal process and policies to deal with cybersecurity risks and incidents.

companyName: ON24 INC.

ticker: ONTF


text: Risk Management and Strategy Our cybersecurity program focuses on the following key areas: • Governance: Our Chief Information Officer ("CIO") leads our cybersecurity risk management program, with oversight from our board of directors. Our CIO closely collaborates with Information Security and Legal/Privacy leaders with the support of other members of management and teams comprised of personnel with a broad range of experience in the technology industry. • Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention, data leak prevention and detection systems, anti-malware functionality and access controls. • Incident Response and Recovery Planning: We have established and maintain comprehensive cybersecurity incident response and recovery plans, including legal obligations to report incidents, which we test and evaluate from time to time. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors and customers, that could adversely impact our business in the event of a cybersecurity incident affecting third-party systems. • Education: We provide regular, mandatory training for staff regarding cybersecurity and privacy awareness.


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures.


text: Our board of directors oversees cybersecurity as part of its risk oversight function. Our board of directors receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.


text: Our CIO and other leaders work collaboratively across our organization to protect our information systems from cybersecurity threats and to promptly respond to incidents in accordance with our incident response plan, including the necessary steps to ensure remediation. Through ongoing communications, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our board of directors when appropriate.


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles of which he spent the last ten years specifically leading security programs at late-stage SaaS companies.


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures. As of December 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, although we are unable to provide any assurance that such risks will not become material in the future.


text: Our board of directors oversees cybersecurity as part of its risk oversight function. The audit committee also assists our board of directors in fulfilling its responsibilities with respect to oversight of our cybersecurity programs, including assisting with reviewing the adequacy and effectiveness of our cybersecurity policies and practices and receiving regular presentations and reports from management. The audit committee provides regular briefings to our board of directors as appropriate. We follow an incident response plan that includes reporting prompt and timely information regarding material cybersecurity incidents, remediation, and related matters.


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles, including leading the security programs at SaaS companies for over a decade.


text: Risk Management and Strategy We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. We have aligned our cybersecurity program to the NIST Cybersecurity Framework and we assess our program against this standard annually. We are regulated by the Transportation Security Administration (TSA) as a pipeline infrastructure company and are required to comply with all TSA cybersecurity regulations. We use industry standard metrics to assess the criticality of software, data assets and operational technology.

companyName: NuStar Energy L.P.


text: We conduct periodic cyber risk assessments and assessments of our operational-technology network. We use these risk assessments together with risk-based analysis and judgment to determine which security controls to use to address identified risks. We also complete internal and external testing of software, hardware, defensive capabilities and other information security systems as advised by industry standards, and we use the test results to address identified vulnerabilities. We regularly conduct cyber threat exercises, which help us identify and address any gaps in our incident response plan. These exercises also help us practice sound decision-making skills to enhance our ability to react effectively during a material cyber event.


text: We rely on third-party software, third-party service providers and third-party applications to run certain aspects of our business and to aid in the development, implementation and maintenance of our security measures and controls. We regularly conduct third-party security audits and use vendor management programs to ensure that third-party software, service providers and applications comply with our vendor management program.


text: We consider the following factors, among others, to identify and manage material risks: (i) the likelihood of a risk occurring; (ii) the impact of a risk on us and others, including the likelihood of enforcement actions alleging potential regulatory violations, sanctions, litigation and other legal risks; and (iii) the controls we have applied to mitigate a risk's likelihood and impact. When selecting controls, we consider the likelihood and impact of identified risks, regulatory and other legal requirements, the feasibility of implementing a control and the potential impact of a control on our operations.


text: We use the following controls, among others, to mitigate the material cyber risks that we face: endpoint threat detection and response (EDR), identity and access management (IAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, a vendor management program (VMP) and vulnerability and patch management.


text: We use third-party security firms to provide or operate certain controls and technology systems. We use third parties to conduct assessments, such as monitoring vulnerability scans and penetration testing. We address cybersecurity threats related to our third-party technology and services through several processes, including pre-acquisition due diligence, contractual obligations and performance monitoring.


text: We have a written incident response plan and we conduct tabletop exercises to enhance incident response preparedness. We use business continuity and disaster recovery plans to prepare for a potential disruption in the technology we rely on. We train our employees on cybersecurity awareness when they are hired and conduct additional training annually thereafter.


text: Our executive management team has the day-to-day responsibility of assessing and managing our overall risk exposure, and our Board of Directors oversees those efforts. We have integrated cybersecurity risk into our overall risk management systems and processes. Our full Board has direct oversight over our cybersecurity risk management. The Board interfaces regularly with management and receives periodic reports on our areas of risk, including cybersecurity. Management interacts regularly with our Cyber Risk Governance Committee (CRGC), which meets regularly and oversees the effectiveness of our cybersecurity program. We make additional disclosures regarding our assessment, identification and management of cybersecurity risks below under the caption "Governance," and we hereby incorporate by reference those disclosures into this discussion of "Risk Management and Strategy."


text: We (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as designed or intended. We use a risk-based approach and the judgment of our CRGC, management and third parties with extensive expertise in cyber risk management to determine which security controls we implement. It is possible we may not implement appropriate controls if we do not properly identify or inadvertently underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate but not fully eliminate risks. Further, when security tools or third parties detect events, it may take us and our third parties time to analyze and understand the risks — and to determine the proper procedural steps to mitigate the effects of such risks — before we can effectively act upon the events. Impacts of Material Risk.


text: Pipeline operators have faced and continue to face risks from threat actors that focus their attacks on critical infrastructure assets and disruption to operations. We also face risks from ransomware groups that steal data, encrypt systems and demand a payment. We have cybersecurity protocols and procedures in place—and we rely on third-party software, hardware and vendors—to manage critical aspects of our operations. While we have controls in place to address these risks, if these risks occur, the impact could be material, such as in the event of a cybersecurity incident causing the loss of operational control, disruption of our operations, a demand for ransomware payment or physical damage to our assets or the environment.


text: Additionally, in Item 1A. "Risk Factors" under the caption "Risks Related to our Business," we discuss forward-looking cybersecurity risks that could have a material impact on us. Our disclosures in Item 1A. "Risk Factors" should be read in conjunction with this Item 1C.


text: Our Board of Directors has direct oversight over key risks that are broadly applicable across NuStar's businesses, including cybersecurity risk management. At each regularly scheduled meeting of the Board, the Board receives reports from our President and Chief Executive Officer (CEO) and Senior Vice President–Chief Information Officer and Controller (CIO) regarding our cybersecurity program. These reports include (i) regulatory updates, which include information on regulatory initiatives promulgated by governmental agencies and our compliance with such initiatives, and (ii) quarterly metrics and data, which include information on employee training, threats, incidents, preventive practices (e.g., patch installation), tabletop exercises, cybersecurity policies and cybersecurity program resources, risks and controls.


text: Our CIO is the management position with primary responsibility for the development, operation and maintenance of our information security program. He reports directly to our CEO. Certain of the CIO's direct reports have extensive expertise in the area of cyber risk management.


text: Our CRGC is composed of management representatives from key functions across our company. Our CIO serves as the Chair of the CRGC. The CRGC meets regularly and oversees the effectiveness of our cybersecurity program. The CRGC operates to deliver management-level oversight of cybersecurity matters. The CRGC reports regularly to our executive management team. The Chair of our CRGC reports regularly to our Board of Directors.


text: We use governance, risk and compliance tools to assess, identify and manage cybersecurity risks. To address potential cybersecurity events, we have developed an incident response plan that defines protocols and processes for effectively managing our response to an event, including protocols for the escalation of critical information to management, key company personnel and the Board.


text: NiSource has implemented and maintains a comprehensive cybersecurity program that includes a variety of security controls and measures designed to identify, assess, and manage material cybersecurity risks. The program is a part of NiSource's enterprise risk management strategy. The enterprise risk team and the Risk Management Committee review material risks to any NiSource operating company based on perspectives from external experts, peer surveys, and the potential impact to NiSource's enterprise assets and strategic objectives.

companyName: NISOURCE INC.

ticker: NI


text: Risk events are classified based on both the timing of impact and NiSource's ability to preventatively mitigate the risk. For the cybersecurity risks that can be preventively mitigated, the enterprise risk team gathers quarterly updates on mitigation gap closure from risk owners. The Risk Management Committee reviews any mitigation gaps identified by risk owners and approves or rejects the pace of mitigation activities as a statement of risk tolerance and then directs that mitigation activities be included in budgets and the business plan as appropriate.


text: Risk assessment NiSource regularly assesses its cybersecurity risks to identify and prioritize the most significant threats. The risk assessment process considers a variety of factors, including those specific to the utility/energy industry, the types of data NiSource collects and stores, and the threats posed by known vulnerabilities. NiSource engages third parties to perform independent assessments of its cybersecurity program, provide intelligence about the threat environment, and to provide operational assistance in managing the program. Annually, a third-party independent assessment is performed to evaluate NiSource cybersecurity maturity against a framework of cybersecurity controls. NiSource also performs bi-annual penetration testing and social engineering assessments performed by a third-party.


text: Third-party risk management: NiSource performs cyber assessments periodically on third-party vendors and service providers with whom NiSource shares data, relies on for critical business functions, or provides access to the NiSource network or systems. NiSource's Supply Chain function works with legal counsel and the Cyber function to periodically update cybersecurity contractual provisions in its vendor agreements, with deviations from such provisions requiring approval from the Legal Department and Cyber function. NiSource's Supplier Code of Business Conduct requires, among other things, that suppliers ensure safe and secure use of information assets, comply with applicable law relating to personal information, and adhering to standards relative to the use and protection of Company information, including that of our employees, customers, vendors and other stakeholders. In addition, all vendors and contractors that have access and/or connectivity to the NiSource environment must complete cybersecurity training annually.


text: Security controls: NiSource has implemented a variety of security controls to mitigate cybersecurity risks. These controls include technical controls, such as firewalls and intrusion detection systems, as well as administrative controls, such as employee training and security awareness programs. To ensure cybersecurity controls, NiSource Operational Technology (OT) within the electric business adheres to the North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP). Within the natural gas business, cybersecurity controls are managed and monitored based on the Transportation Security Administration (TSA) Security Directives.


text: Incident response: NiSource has a comprehensive incident response plan in place to respond to cybersecurity incidents. The plan includes steps for detection, analysis, containment, eradication, and recovery from incidents, as well as steps for notifying affected individuals and regulators.


text: The NiSource Board of Directors' Audit Committee has responsibility for oversight of the cybersecurity program and risks from cybersecurity threats. The Audit Committee meets quarterly to review NiSource's cybersecurity posture and make recommendations for improvement. The Chief Information Security Officer (CISO) regularly briefs the Audit Committee on cybersecurity risks and the efforts to address them. In addition, the Board of Directors is briefed regularly, through written reports and updates by the Audit Committee, about key and emerging cybersecurity risks.


text: At the management level, the CISO leads the cybersecurity program and is responsible for assessing and managing cybersecurity risks. Our CISO has expertise and experience in cybersecurity derived from over 15 years of cyber related work experience and possess several certifications including Certified Information Systems Security Professional (CISSP), Certified


text: Risk assessment. NiSource regularly assesses its cybersecurity risks to identify and prioritize the most significant threats. The risk assessment process considers a variety of factors, including those specific to the utility/energy industry, the types of data NiSource collects and stores, and the threats posed by known vulnerabilities. NiSource engages third parties to perform independent assessments of its cybersecurity program, provide intelligence about the threat environment, and to provide operational assistance in managing the program. Annually, a third-party independent assessment is performed to evaluate NiSource cybersecurity maturity against a framework of cybersecurity controls. NiSource also performs bi-annual penetration testing and social engineering assessments performed by a third-party.


text: Third-party risk management. NiSource performs cyber assessments periodically on third-party vendors and service providers with whom NiSource shares data, relies on for critical business functions, or provides access to the NiSource network or systems. NiSource's Supply Chain function works with the Legal and Cyber functions to periodically update cybersecurity contractual provisions in its vendor agreements, with deviations from such provisions requiring approval from the Legal and Cyber functions. NiSource's Supplier Code of Business Conduct requires, among other things, that suppliers ensure safe and secure use of information assets, comply with applicable law relating to personal information, and adhering to standards relative to the use and protection of Company information, including that of our employees, customers, vendors and other stakeholders. In addition, all vendors and contractors that have access and/or connectivity to the NiSource environment must complete cybersecurity training annually.


text: Security controls. NiSource has implemented a variety of security controls to mitigate cybersecurity risks. These controls include technical controls, such as firewalls and intrusion detection systems, as well as administrative controls, such as employee training and security awareness programs. To ensure cybersecurity controls, NiSource OT within the electric business adheres to the NERC CIP. Within the natural gas business, cybersecurity controls are managed and monitored based on the TSA Security Directives.


text: Incident response. NiSource has a comprehensive incident response plan in place to respond to cybersecurity incidents. The plan includes steps for detection, analysis, containment, eradication, and recovery from incidents, as well as steps for notifying affected individuals and regulators.


text: The NiSource Board of Directors' Audit Committee has responsibility for oversight of the cybersecurity program and risks from cybersecurity threats. The Audit Committee regularly reviews NiSource's cybersecurity posture. The CISO briefs the Audit Committee on cybersecurity risks and risk mitigation initiatives and actions. In addition, the Board of Directors remains informed of key and emerging cybersecurity risks and receives updates by the Audit Committee after each of its regularly scheduled meetings.


text: At the management level, the CISO leads the cybersecurity program and is responsible for assessing and managing cybersecurity risks. Our CISO has expertise and experience in cybersecurity derived from over 15 years of cyber related work experience and possesses several certifications including CISSP, CRISC, and CISA. The CISO is supported by the NiSource


text: Cyber Risk Management and Strategy We have implemented a number of technical and organizational safeguards designed to manage our risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents. These include employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms. Additionally, we engage a third-party cybersecurity firm to assist with security features such as network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare, to respond and to recover from cybersecurity incidents. We have processes designed to triage, assess severity, investigate, escalate, contain and remediate an incident. We also have processes to comply with potentially applicable legal obligations and mitigate brand and reputational damage. As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes include assessing cybersecurity risks associated with our use of third-party service providers in the normal course of business, including those in our supply chain or who have access to our customer and employee data or our systems. Additionally, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Governance Related to Cybersecurity Risks The Company's Global Director, Information Security (Security Director) directs the Company's cybersecurity team. He reports to the Company's Global Director of Information Technologies (IT Director), who reports to the Chief Executive Officer of the Company. The Security Director is responsible for assessing and managing the Company's cyber risk management program, informing senior management, as appropriate, regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts generally by the cybersecurity team. Our Security Director is a Certified Information Systems Security Professional (CISSP) and has over 20 years of experience in cybersecurity in a broad range of industries. Our IT Director has a master's degree in information systems and has prior experience managing global security efforts. Our Security Director manages a team of cybersecurity professionals with relevant experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: In addition, the Company's IT Steering Committee (ITSC) considers, among other IT matters, risks relating to cybersecurity and applicable mitigation plans to address such risks. The ITSC is comprised of certain members of the Company's senior management. The IT Director and Security Director attend each ITSC meeting. The ITSC generally meets quarterly during the year with the IT Director and Security Director to review risk mitigation activities as well as updated status of global security operations and metrics, including the prevention, detection, mitigation and remediation of cyber incidents. The IT Director, Security Director and ITSC monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in the cybersecurity risk management and strategy processes, including the operation of the Company's incident response plan. The Company has an established process led by our Security Director governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Our Board of Directors (the "Board") is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risks, risk management process and the risk trends related to cybersecurity at least annually, which includes a review of key performance indicators, recent threats and the Company's management of such threats. The Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. The Security Director and IT Director brief the Audit Committee on information security and cybersecurity annually and as necessary in response to certain incidents.


text: Although risks from cybersecurity incidents and threats have to date not materially impacted us, our business strategy, results of operations or financial condition, we have from time to time and will continue to experience threats to and security incidents related to our and our third party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001. Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil's Lei General de Prote o de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).


text: Technology is a key component of our business operations, and cybersecurity is a significant consideration for the firm. T. Rowe Price has a holistic firm-wide approach to risk management including material risks from cybersecurity threats. The firm's overall risk management activities are designed to identify, assess, report, and manage risks that could affect the firm in achieving its objectives and goals. This risk management framework operates across our business lines and integrates business operational resiliency and technology related risks such as cybersecurity threats. As part of the firm's risk identification and assessment framework, key risks from cybersecurity threats specific to our environment are identified and assessed for adequacy of controls. Management identifies risk inherent to cybersecurity threats, estimates the significance of the risks, assesses the likelihood of their occurrence, establishes acceptable risk tolerance levels, and implements appropriate measures to monitor those risks. Action plans may be developed for identified control issues and management is responsible for addressing these issues.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Although management is responsible for the firm's day to day cybersecurity operations, the Board of Directors oversees the firm's cybersecurity program. The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm's activities and make recommendations or provide advice to the Board. Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm's technology and operations as well as our continuing investment in and development of our cybersecurity program.


text: Our Chief Executive Officer and President (CEO) has ultimate responsibility for developing strategy and overseeing execution to meet the firm's objectives. The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution. The COO has several leaders within the COO organization who develop and oversee the firm's risk management, technology, and information security practices. These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.


text: The firm's Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO). The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats. The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Firm-wide Compliance to provide risk assurance activities.


text: Enterprise Risk is primarily responsible for reporting risks from cybersecurity threats to executive leadership and our Enterprise Risk Management Committee (ERMC). The ERMC supports the efforts of the CRO in providing corporate-wide oversight of our firm's risk management efforts and provides a path for risk escalation. This committee monitors risk management activities, including cybersecurity matters, and reports periodically and more frequently as necessary, to our Board of Directors and Audit Committee. Cybersecurity risk management practices operate enterprise-wide, across T. Rowe Price legal entities, including Oak Hill Advisors (OHA). In addition, OHA has established an independent risk committee, which includes responsibilities for prompt escalation of key risks and incidents such as Cybersecurity to the T. Rowe Price CRO.


text: T. Rowe Price maintains documented Enterprise Incident Management and Reporting Policies and Procedures, outlining responsibilities and requirements for escalation of various types of incidents, including cybersecurity threats and incidents. Our process is designed to investigate incidents efficiently, identify root cause, communicate with the affected parties as appropriate, spot trends, and recommend improvements to mitigate risk. These procedures incorporate incident materiality determination within senior executive levels and operate firm-wide.