text: Our information systems have been subject to cybersecurity incidents in the past, including a cyber-attack identified and disclosed during the fourth quarter of 2024 (the "Cybersecurity Incident") that temporarily disrupted our business operations, including our ERP systems, and had an impact on manufacturing, order processing, shipping, and other corporate operations. Although we are continuing to work with our insurer to recoup covered losses, we do expect to continue to incur expenses in connection with improving our global cybersecurity infrastructure and cybersecurity posture.


text: As of the date of this Annual Report on Form 10-K, we believe that the Cybersecurity Incident has not materially impacted the Company, our overall financial condition or results of operations, and that the incident is not reasonably likely to materially impact the Company, our financial conditions or results of operations. In addition, we are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition as of the date of this Annual Report on Form 10-K. This includes penalties and settlements, of which there were none. We are seeking reimbursement of costs, expenses and losses stemming from the Cybersecurity Incident by submitting claims to our cybersecurity insurer. The timing and amount of any such reimbursements are not known at this time. As discussed in more detail in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations", the Cybersecurity Incident had a $4.6 million impact on our results for the year ended December 31, 2024.

companyName: ARTIVION, INC.

ticker: AORT

secItem: Item 1C


text: To learn more about the risk and potential impact of cybersecurity threats on our business strategy, operations, and financial condition, including with respect to the Cybersecurity Incident, See Part I, Item 1A, "Risk Factors," "Significant disruptions of information technology systems or breaches of information security systems could adversely affect our business".


text: Cybersecurity is integrated with our overall risk management strategy and is an area of focus for our Board and management, with oversight at the executive level led by our Chief Financial Officer. The Audit Committee, and where applicable, other directors or the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, on our cybersecurity threat risk management and strategy processes, and may meet more frequently in response to specific threats or incidents. These updates, provided by our Chief Financial Officer and/or our global head of Information Technology, cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and select cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.


text: Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer and focus on preventing, mitigating, detecting and remediating cybersecurity incidents, as well as threat risks and related matters. The global head of Information Technology is part of our operating team and is responsible for implementing our cybersecurity risk management and strategy processes and the operation of our incident response and business continuity plan. Management uses information provided by our global head of Information Technology, along with feedback from external experts, the Audit Committee, and our Board, as part of the cyber-specific and enterprise-wide risk management process described above.


text: Our information technology and cybersecurity team has approximately 35 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members' relevant degrees and certifications include but are not limited to Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.


text: PGE considers cybersecurity to be a top enterprise risk and manages the risk by following established practices for assessment, protection, response, and oversight. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk. All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.


text: PGE has a threat intelligence function to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and periodic exercises.


text: PGE engages a third party to attempt to penetrate its systems periodically. The Company also uses a separate third party to conduct an assessment of its cybersecurity program maturity. These assessments allow PGE to upgrade processes and mitigate gaps regularly, rather than having a static program. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet our security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. PGE also has procured cybersecurity insurance.


text: Cybersecurity is a top enterprise risk in PGE's enterprise risk management program. An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors. PGE has a management-level committee, the Integrated Security Executive Committee (ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.


text: The Audit and Risk Committee of the Board of Directors has oversight of cybersecurity risk and receives briefings on a quarterly basis. The briefings are provided either by the cybersecurity team, together with a senior member of management, or are presented as part of the Audit and Risk Committee's regular review of top enterprise risks, in which cybersecurity risk is reviewed annually or more frequently if circumstances warrant. The Audit and Risk Committee briefs the full Board of Directors at each meeting. In addition, the full Board of Directors has participated in cybersecurity exercises. The Audit and Risk Committee is also provided with information about external assessment results and action plans. There is a process in place to notify the Audit and Risk Committee promptly in the event of a material cybersecurity incident.


text: PGE considers cybersecurity to be a top enterprise risk in PGE's enterprise risk management program, and manages the risk by adhering to established security policies and governance, identifying risk through risk assessments, utilizing technology to provide a layered security approach, controlling access, robust security awareness training and conducting resiliency exercises. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk.


text: An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors.


text: PGE has a management-level committee, the Integrated Security Executive Committee ( ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.


text: PGE has a threat intelligence and insider risk program to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and assessments. In addition, cyber security resiliency is enhanced through regular functional and tabletop exercises.


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet the Company's security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. The Company also has procured cybersecurity insurance.


text: All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.


text: PGE engages a third party to attempt to penetrate its systems periodically. These assessments support a continuous improvement initiative, ensuring ongoing enhancements to security posture. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.


text: Process for Assessing, Identifying and Managing Material Cybersecurity Risks The proper function, availability, and security of our and third-party information systems are critical to our business. We have attempted to structure our cybersecurity program and its incident response policies and procedures, including an incident response plan (the "IRP"), around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides best practices to identify, protect from, respond to, and recover from cyber attacks. The cybersecurity program, led by our chief security officer ("CSO"), consists of dedicated internal IT security employees, including the staff of a security operations center, and long-term third-party security service providers. Our IT security staff, led by our CSO, is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. In furtherance of our cybersecurity program, members of our internal security staff participate in industry and governmental cybersecurity cooperative groups, including the Health Information Sharing and Analysis Center ("H-ISAC") and the FBI's InfraGard.

companyName: Encompass Health Corp

ticker: EHC


text: Our CSO, who assumed his current role in 2022, has over 10 years of cybersecurity experience with us and over 27 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 34 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.


text: We maintain an inter-departmental privacy and security committee that oversees our programs and initiatives that seek to protect and secure patient information as well as our data and information systems. This committee is responsible for, among other things, administering our incident response policies and procedures and various training and awareness programs that promote good system security practices by employees. This committee consists of our CSO, CIO, deputy CIO, chief privacy officer, and director of information security and compliance as well as in house attorneys responsible for cybersecurity and securities matters. It currently meets monthly and as warranted by privacy and security events.


text: The IRP sets forth the strategy to prepare for cybersecurity threats and incidents and the processes and procedures to detect, analyze, contain, and recover after any actual or suspected cybersecurity incidents. The IRP also sets forth the internal reporting process for cybersecurity incidents. In the event of the detection of an actual or suspected cybersecurity incident, the IRP provides that our IT security staff score the incident based on established criteria and manage the incident pursuant to the standard operating procedures. Depending on the assessed criticality of the incident and the systems affected, the staff will report an incident to a security triage team, consisting of the security operations incident response lead and several members of the privacy and security committee. Working with our third-party security vendors as needed, the triage team investigates the incident, manages the response, and reports threats and incidents deemed significant to securities counsel. Securities counsel then works with the executive team to assess materiality for the Company. A member of the executive team would inform our board of directors as warranted.


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.


text: Third-party IT Vendor Risk Management Our IT security staff also maintains a third-party IT vendor risk management process. The staff identifies the third parties with whom we contract or otherwise have a relationship involving our network or digital assets that represent an elevated risk based on a detailed rating process. The IT vendor risk management process involves input from various departments, including the affected internal business constituencies, legal, and compliance.


text: Using a platform endorsed by the H-ISAC, the IT security staff performs risk assessments of third parties that appear to represent the greatest risk to our systems and data. Annually, the privacy and security committee reviews and approves our listing of tier one vendors subject to the assessment. The IT security staff then works with the internal points of contact responsible for the applications, software or systems and the vendors to gather the information necessary to assess the associated risks using common cybersecurity standards and frameworks. Any significant risks identified are shared with the vendors and the compensating controls for those risks are documented in collaboration with the vendors. The internal points of contact and other constituencies then review the results of the assessment process in order to assess the associated value of the product or service against the risk.


text: Integration into the Overall Risk Management System Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (the "ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates to assess the most significant risks to the Company as a whole. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. Management presents quarterly the ERM risk assessment, including key risk indicators, to our board of directors.


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience in cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our annual tabletop incident response exercise.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident. As of February 28, 2024, we have not identified any compromise or unauthorized access of our systems or networks. The Change Healthcare incident has not affected our operations, except the submission of payment claims. At this time, we have not determined that this disruption to our submission of claims is likely to materially affect our business strategy, results of operation or financial condition.


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation.


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."


text: Our CSO, who assumed his current role in 2022, has over 11 years of cybersecurity experience with us and over 28 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 35 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Given the extensive practical experience of implementing our IRP and business continuity plan during the Change Healthcare incident, discussed further below, we did not conduct a separate mock tabletop exercise in 2024. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain ongoing engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience to support cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our tabletop incident response exercises.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acted as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident and did not identify any compromise or unauthorized access of our systems or networks. However, the incident did affect our ability to submit any claims for payment for a period of time until we implemented alternative modes for submissions. We have not identified any compromise or unauthorized access of our systems or networks, and the temporary disruption to our submission of claims did not materially affect our business strategy, results of operation or financial condition.


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business vendors and partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."


text: As a leading provider of technology-enabled healthcare and public health services, medical logistics, and readiness enhancement services, we continuously monitor for and defend against cyber threats and advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents As a public company and a government contractor, we are required to comply with extensive security and compliance regulations and standards and we employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity risk management program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and comply with extensive regulations, including U.S. government cybersecurity regulations. Our policies and implemented controls are assessed at least annually by external organizations for compliance with Federal Risk and Authorization Management ("FedRAMP"), Federal Information Security Modernization Act ("FISMA"), Cybersecurity Maturity Model Certification ("CMMC"), and International Organization for Standardization ("ISO") 27001 standards. We also conduct periodic penetration tests, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, as well as our ability to respond to and recover from cybersecurity incidents. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises, including through employee cybersecurity training and ongoing investments in capabilities to protect our assets.

companyName: DLH Holdings Corp.

ticker: DLHC


text: Our cybersecurity risk management program is led by Executive and Senior management, who hold a number of certifications including Certified CMMC Professional ("CCP"), Certified Information Security Manager ("CISM"), and Project Management Professional ("PMP"). Management is responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. The team of senior management officers responsible for our cybersecurity function is tasked with ensuring that potential cybersecurity risks are monitored, appropriate mitigation measures are implemented, and our processes for identifying and assessing cybersecurity risks and reporting cybersecurity breaches and other information security incidents operate as designed and comply with applicable requirements.


text: Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks. Our Cybersecurity, Technology, and Biomedical Research ("CTBR") Committee is chaired by an independent director who is certified in Cybersecurity Oversight. The CTBR Committee receives briefings on our cybersecurity posture and cybersecurity trends and risks from management. Our CTBR Committee regularly briefs our Board of Directors on security posture, planned activities, and cybersecurity risks which may cause a material, adverse impact to the Company's operations, reputation, or value and will report any findings or make recommendations to the Board, as appropriate.


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: We recognize the importance of maintaining the safety and security of our people, systems, and data and have a holistic process, supported by our management and Board of Directors, for overseeing and managing cybersecurity and related risks. As part of AES, we are also supported by AES' cyber risk management program.

companyName: DAYTON POWER & LIGHT CO


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of AES' cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including DPL and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.


text: DPL Inc. and AES Ohio The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of DPL and its subsidiaries to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and PUCO regulation.


text: Our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.


text: We consider cybersecurity as part of the enterprise risk process, including organized and structured reporting protocols. The prioritization of cybersecurity risk is aligned with overall risk management processes.


text: In addition, our management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. Our CEO, CFO and other members of senior management participate in such meetings.


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and our Board. We regularly practice our incident response through executive tabletop exercises.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are informed by frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program addresses threats in a prioritized manner and, in particular, focuses on the following key areas: • gap analysis to identify programmatic opportunities for improvement that can be incorporated into the cyber strategy; • policies and standards that are annually reviewed and communicated; • exceptions management and internal audits that support cybersecurity requirements through assessing control implementation risks; and • monitoring and regular reporting of cyber resilience and posture at operational and strategic levels.


text: We engage assessors, consultants, auditors, or other third parties in connection with any such processes, including: • external vulnerability assessments, including penetration tests; • internal audit reviews; • threat intelligence; • incident management; • audits of NERC-Critical Infrastructure Protection regulated environments by the NERC Registered Regional Entity; and • program development support, as needed.


text: Our risk management program for third-party service providers includes risk-based assessments of their interactions with our data and systems. We implement monitoring and response processes for key third-party service providers.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in training, including phishing exercises, monthly safety meetings, and an annual cybersecurity awareness update. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.


text: DPL Inc. and AES Ohio We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: We recognize the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: MGM Resorts International

ticker: MGM


text: The Company's Internal Audit function conducts an annual Enterprise Risk Management process to identify, assess, monitor and control current and future potential risks facing the Company, which includes cybersecurity risks that are communicated by the Chief Information Security Officer ("CISO"). Significant risks identified during this process are then presented to the Audit Committee. In addition, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. We also routinely perform attack and response simulations at the technical level, and annually execute tabletop response exercises. Each year, special focus is given to maintaining and improving our alignment with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Privacy and Payment Card Industry ("PCI") controls in support of protecting our technology and customer data. We further engage in the periodic assessment and testing of our cybersecurity program.


text: We also utilize external expertise to perform annual assessments of our entire cybersecurity program, including the cybersecurity program maturity. The results of these annual assessments are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, we have a Third Party Risk Management Program designed to assess risks associated with third party providers based on the services they provide and the data they have access to.


text: Cybersecurity risk mitigation processes are integrated into the Company's Code of Conduct that all employees are required to review. Additionally, all employees with network access receive cybersecurity awareness training.


text: The Company's information and data systems have been subject to cybersecurity incidents in the past, including the publicly disclosed September 2023 Cybersecurity Issue. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, there is no guaranty that the Cybersecurity Issue and any further incidents will not have a material impact in the future. See "Cybersecurity litigation, claims, and investigations" in Part II, Item 8, Note 12 to the accompanying consolidated financial statements. Further, policies and procedures designed to manage cyber risks, including those described herein, may not be effective. To learn more about risks from cybersecurity threats, see "Item 1A. Risk Factors - The failure to maintain the integrity of our information and other systems or customer information can result in damage to our reputation, subject us to fines, payment of damages, lawsuits and restrictions on our use of data, and have a material adverse effect on our business, financial condition, and results of operations." Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect the Company's business, financial condition, or results of operations.


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives quarterly reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has 23 years of expertise in cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information technology and information security throughout their career. The CISO holds various professional certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association and the Certified Information Systems Security Professional from International Information System Security Certification Consortium. The CISO holds a Bachelor's Degree in Computer Information Systems and a Master's Degree in Organizational Security Management.


text: Our CISO reports directly to our Chief Legal and Administrative Officer and Secretary. The CISO closely monitors our cybersecurity program, including our strategy and cybersecurity policies and practices, against the cybersecurity threat landscape. As described above, our cybersecurity incident response plan provides a framework for a multidisciplinary team to prevent, detect, mitigate, and remediate cybersecurity-related risks and incidents. This framework also sets forth parameters for the escalation and reporting of cybersecurity risks and incidents to broader groups at the Company, and the CISO reports information about significant cybersecurity risks and incidents to the Audit Committee on a regular basis and more frequently if warranted under the circumstances.


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives regular reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has over 20 years of expertise in technology, cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information security throughout his career. The CISO holds various professional certifications, including Certified Information Security Manager certification from the Information Systems Audit and Control Association and Certified Incident Handler from the International Council of E-Commerce Consultants. The CISO holds a Bachelor of Science Degree in Cyber Security & Information Assurance.


text: The Company maintains a cybersecurity program that is aligned with its business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into its overall risk management processes and governance structure.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: The Company has implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. The Company also maintains third party management processes to identify and manage the cybersecurity risks associated with third party service providers. The Company periodically evaluates its cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, the Company has a Cybersecurity Task Force in place that is comprised of individuals across various departments within the organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance the Company's cybersecurity strategy.


text: The Board of Directors (the "Board") oversees NACCO's risk management. The full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of the Company's cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2023, the Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.


text: The Company's Chief Information Security Officer ("CISO") leads the Company's cybersecurity program and is responsible for the management of its cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO is currently enrolled in an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence ("AI"). The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company has an established process governing its assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to the Company's executive management and/or Board.


text: As of the date of this filing, the Company's business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, we cannot provide assurance that they will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding the Company's cybersecurity risks, please refer to "Item 1A - "Risk Factors" on page 19.


text: Cybersecurity continues to be a key governance priority for us. NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure.


text: We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, we have a Cybersecurity Task Force in place that is comprised of individuals across various departments within our organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance our cybersecurity strategy.


text: Our Board of Directors (Board) oversees NACCO's risk management. Our full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of our cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2024, our Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.


text: Our Chief Information Security Officer (CISO) leads NACCO's cybersecurity program and is responsible for the management of our cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO successfully completed an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence during 2024. The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to our executive management and/or Board.


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, NACCO cannot provide assurance that we will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding our cybersecurity risks, please refer to Item 1A - Risk Factors on page 18.


text: Cybersecurity presents significant challenges to the business community in general, including to the financial services industry. Increasingly, bad actors, both domestic and international, attempt to steal personal data and/or interrupt the normal functioning of businesses through accessing individuals' and companies' files and equipment connected to the internet. Recent incidents have reflected the increasing sophistication of intruders and their intent to steal personally identifiable information as well as funds and securities. These intruders sometimes use instructions that are seemingly from authorized parties but in fact, are from parties intent on attempting to steal. In other instances these intruders attempt to bypass normal safeguards and disrupt or steal significant amounts of information and then either release it to the Internet or hold it for ransom. Regulators are increasingly requiring companies to provide heightened levels of sophisticated defenses. The Company maintains processes and systems with an aim to preventing any such attack from disrupting its services to clients as well as to prevent any loss of data concerning its clients, their financial affairs, as well as Company privileged information.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Our management is actively involved in the oversight of our cybersecurity risk management program, We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.


text: We have a written incident response plan that identifies the steps to be taken in response to a cybersecurity incident that includes investigation, escalation and remediation provisions. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which may include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CIO and the Company's CISO, who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.


text: The CEO meets regularly with the CIO to discuss cybersecurity threats and existing and potentially new technology systems including those related to cybersecurity. The CIO and CISO have a standing monthly meeting with the President and General Counsel to discuss potential vulnerabilities in the cyber environment. The President formerly ran the Information Technology Department at the firm and as a result has significant systems experience including experience related to cybersecurity.


text: The Board of Directors, both directly and through the Audit Committee, oversees Management's responsibility of ensuring proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate cybersecurity risks. The Audit Committee receives a cybersecurity update at each regular meeting of the Board covering cybersecurity risks, cybersecurity staffing and staff development including certifications and training. These updates are given either in person by the CIO and CISO or in written presentations created by them.


text: As of the date of this filing, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company's business strategy, results of operations or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Given the continuing reports of cyber incidents in general, we believe that the Company will most likely continue to be a target of cybersecurity attacks by bad actors.


text: For additional information on how risks from cybersecurity threats may adversely affect the Company see "Item 1A. Risk Factors-Risks Related to Our Business" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our management is actively involved in the oversight of our cybersecurity risk management program. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants and auditors to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which does include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's Chief Information Officer ("CIO") and the Company's Chief Information Security Officer ("CISO"), who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.


text: The Board of Directors, both directly and through the Audit Committee, oversees management's responsibility of ensuring proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate cybersecurity risks. Recently the Audit Committee added a member with significant cybersecurity experience. The Audit Committee receives a cybersecurity update at each regular meeting of the Board covering cybersecurity risks, cybersecurity staffing and staff development including certifications and training. These updates are given either in person by the CIO and CISO or in written presentations created by them.


text: We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic Business Impact Assessments ("BIAs") of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We utilize internal information technology resources for the primary aspects of our cybersecurity program. Our internal team is supported by external service providers and consultants as needed.


text: To minimize the risk to our core systems, we utilize well established enterprise-grade cloud service providers for our management and operational functions. We review Service Organization Control Type 2 audit report results from each of these service providers to ensure that their programs meet our requirements.


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging people, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees and periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.


text: Our cybersecurity strategy and risk management program is a component of our overarching enterprise risk management program and interfaces with other functional areas within the Company, including our business segments, legal, risk, human resources and internal audit departments.


text: While we have experienced cybersecurity incidents in the past, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business or financial condition. However, there can be no assurance that we will not suffer a significant event in the future that could materially affect our business, financial position, results of operations or cash flows. For more information on how cybersecurity risk may materially affect our business, financial positions, results of operations or cash flows, please refer to Part I, Item 1A. Risk Factors hereof.


text: Our Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our CFO. Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity have over 19 and 20 years, respectively, of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.


text: As part of our defined cybersecurity policies and cybersecurity incident response plan, management is regularly updated on the status of the execution of our cybersecurity strategy and daily operations of the program. This includes regular reporting and evaluation of all cybersecurity incidents, not only those that may be deemed material.


text: Our CIO, supported by our Director of Cybersecurity provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any non-material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.


text: In the event of a material cybersecurity incident, communication to the Board is provided pursuant to our cybersecurity incident response plan.


text: We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic business impact assessments of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations. • Periodic penetration testing of our internal and external IT environment to validate the real-world efficacy of our cybersecurity program and mitigate the risks of new cybersecurity vulnerabilities.


text: We utilize third-party service providers to manage portions of our business operations. We have established processes to review, identify and manage cybersecurity risks associated with the use of service providers. Prior to engaging these providers, we review the providers' SOC 2 Type II or other relevant security audit reports to ensure proper security controls are in place. We evaluate the service providers' controls for incident response strategy to identify any significant risks and adapt accordingly. We systematically review these assessments for any significant change throughout the relationship. Our risk management program consistently monitors for risk to our systems and services presented by these service providers and promotes strategies to address any threats identified.


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging our people, external resources, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis. Additionally, we have a retainer for external forensics support if required for a material incident.


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees, periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer ("CEO"). Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.


text: Our CIO, supported by our Director of Cybersecurity, provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.


text: Under our "Cloud First, Cloud Now" strategy, we are increasingly relying on cloud-based technology to enable more innovation, enhance customer service, and keep up with the complex demands of the ever-changing trucking and logistics landscape. We are incorporating cybersecurity into this strategy by investing in key technology and skillset development to help protect the confidentiality, integrity, and availability of our systems and electronic data. In addition, we are committed to using reasonable efforts, given identified or reasonably anticipated threats, to prevent information security breaches. We have not experienced any such breach in any of the three years shown in the financial statements in this filing or in 2024 through the date hereof, and cybersecurity threat risks have not materially affected our business strategy, results of operations or financial condition. Based on our analysis of the current threat environment, we do not believe that any such material impacts are reasonably likely to occur. See Item 1A of Part I of this Form 10-K for a discussion of risks and uncertainties related to our information systems and technology infrastructure.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We employ a dedicated cybersecurity team. In coordination with our Chief Information Officer, the team assesses and manages cybersecurity threat risks with a focus on identity verification, system access and security, and governance, risk, and compliance. Our Chief Information Officer has extensive information technology and strategic leadership experience, including modernizing and securing business applications and technology stacks. Our director of cybersecurity is a certified information systems security professional with broad experience in cybersecurity, much of which was gained working for the U.S. military. Various members of the cybersecurity team hold industry certifications. The Chief Information Officer regularly shares cybersecurity developments and concerns with the Chief Executive Officer and with other executive officers as concerns arise that impact their areas.


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity and policies and procedures related to the protection of Company proprietary and customer information and compliance with data privacy requirements. The Audit Committee receives quarterly updates from our Chief Information Officer. Reports may address evolving trends in cybersecurity, major threat developments, and technologies, solutions, policies, and procedures we use to detect, prevent, mitigate and remediate threats, respond to incidents and crises, and educate employees on information security importance and requirements. The Audit Committee has regular opportunities to suggest adjustments to the Company's cybersecurity practices. It regularly reports to the Board on fulfillment of its responsibilities, which include cybersecurity risk management oversight.


text: To design and update our cybersecurity strategy, including awareness, prevention, detection, response and recovery components, we strive to align with a respected maturity framework, and we periodically, with the help of a third-party, analyze our alignment. We use a variety of tools to help identify anomalous activity on our systems, including without limitation logs, artificial intelligence, software programs, and data analyses. In addition to internal resources, we use third-party services and software to monitor our cyber environment for detected risks, including without limitation risks from cyber-attackers, employees, and third-parties that we allow to access or contribute to our information technology systems, and to block threats. To assess system vulnerability, we periodically simulate threats, and following such exercises, we assess penetration results and determine and implement remediations.


text: Executive management fosters a cybersecurity threat awareness and risk mitigation culture by supporting regular educational phishing simulations and advocating the importance of cybersecurity in communications to employees. We maintain information security policies to promote employee use of our information technology in a safe manner that helps protect our systems and data from cybersecurity events, and we require periodic enterprise-wide security training and testing and analyze test results.


text: Cybersecurity is integrated with our overall risk management program through cyber coverage as an important component of our insurance portfolio. We maintain cyber insurance to help protect against potential loss or expense arising from a cybersecurity incident or data breach. As part of our cyber insurance renewal, we coordinate with our insurance broker cyber experts to assess our cybersecurity program and align our coverages with our risk management framework. Our oversight processes for reviewing threats from third-parties that we allow to access or contribute to our information technology systems are also important to overall risk management. We subject such third-parties to a variety of cybersecurity analyses, which include our use of risk assessments or scorecards and receipt of third-party audit or other reports related to information security.


text: We have a program for organized response in the event of a cybersecurity incident. Our Chief Information Officer receives alerts disseminated via the program and reports to the Chief Executive Officer as deemed prudent. In the event the incident rises to the level of a crisis, the cyber component of our crisis management plan is triggered. The plan guides a cyber crisis management team, including representatives from our legal, information technology, finance and operations areas, in analyzing the type, scope, cause, impact and other details of the crisis. Our analysis includes without limitation identifying affected systems and exposed data, and in making key decisions to abate, mitigate or respond to the crisis, drawing on pre-identified third-party sources of forensic and other expertise as deemed necessary or advisable. Responsive steps include oversight of any warranted or required communications, including without limitation potential outreach to law enforcement, and informing the Board or Audit Committee of the incident as required by the plan. A final step is for the team to review lessons learned during the incident with the purpose of strengthening future crisis response. The team periodically reviews and practices its protocols to enhance its effectiveness.


text: Under our "Cloud First, Cloud Now" strategy, we prioritize usage of cloud-based technologies to foster innovation, enhance customer service, and meet the demands of the evolving logistics landscape. Cybersecurity is integrated into this strategy through investments in technology and skill development to help protect the confidentiality, integrity, and availability of our systems and electronic data. During the period covered by this Form 10-K and through the date of its filing, we have not experienced, to our knowledge, an information security breach or identified cybersecurity threat risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize that cybersecurity threats are continually evolving, as further addressed in Item 1A of Part I of this Form 10-K.


text: Our dedicated cybersecurity team, in coordination with our Chief Information Officer ("CIO"), assesses and manages risks by focusing on identity verification, system access controls, and governance, risk, and compliance processes. The CIO, with extensive information technology ("IT") and strategic leadership experience, is supported by a director of cybersecurity, a Certified Information Systems Security Professional with significant military cybersecurity expertise, and a team holding various industry certifications and having collective cybersecurity experience of over 75 years. The CIO regularly reports cybersecurity matters to the Chief Executive Officer and executive leadership, for alignment with broader organizational goals.


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity, policies and procedures related to the protection of Company proprietary and customer information, and compliance with data privacy requirements. It receives quarterly updates from our CIO on trends, threats, and technologies used to prevent, detect and respond to risks; reviews and provides feedback on employee education initiatives, crisis response strategies, and remediation measures; and reports to the Board on fulfillment of its cybersecurity risk management oversight.


text: We strive to align with the National Institute of Standards and Technology (NIST) cybersecurity maturity framework and leverage a range of tools, including artificial intelligence, software programs, logs, and data analyses, to detect anomalous activity and identify risks across our systems. Threat simulations, such as penetration testing, are conducted periodically to assess vulnerabilities, analyze results, and implement remediations. Additionally, we employ third-party services for monitoring risks posed by cyber-attackers, employees, and third-party vendors accessing or contributing to our systems. Our oversight of such vendors includes requiring them to undergo cybersecurity analyses through risk assessments, scorecards, and audits.


text: Depending on the services performed, we require certain vendor agreements to contain security and privacy addenda and require vendors to report to us cybersecurity breaches on their systems and/or impacts to our data.


text: We place high importance on conducting tabletop exercises to test and enhance our readiness for cybersecurity incidents. These exercises involve our Crisis Management Team, which includes representatives from executive management, legal, information technology, finance, operations, and marketing. The Crisis Management Team focuses on analyzing the scope, impact, and root cause of simulated incidents, while the marketing and legal departments, along with a team of executives, plan the messaging to customers, employees and other stakeholders deemed necessary or advisable in the circumstances. For compliance readiness, we monitor the legal and regulatory landscape associated with cybersecurity incidents. These exercises and activities provide valuable insights to improve transparency, messaging, response protocols, stakeholder confidence and organizational resilience in the event of a cyber crisis.


text: To manage material risks and enhance preparedness, we maintain a cyber insurance program integrated into our overall risk management framework. During insurance renewals, we collaborate with brokers and cyber experts to assess our program and align coverages with identified risks. In the event of a cybersecurity incident, our crisis management plan is triggered, mobilizing the Crisis Management Team to assess the situation and oversee critical decisions related to abatement, mitigation, and response. Responsive steps, each as deemed necessary or advisable and in addition to other elements of the plan, include engaging third-party forensic and other experts, coordinating communications with stakeholders, contacting law enforcement, and reporting incidents to the Board or Audit Committee. In a post-incident review, lessons learned are analyzed for incorporation into future protocols.


text: We foster a culture of cybersecurity awareness through regular phishing simulations, enterprise-wide security training, employee education on safe technology practices, and information security policies. We continue to evaluate cybersecurity risks and enhance our strategy to safeguard our operations and data as part of our commitment to operational resilience and innovation.


text: The Company has implemented policies and procedures that are intended to manage and reduce cybersecurity risks. Material risks from cybersecurity threats are managed across HDMC, HDFS, LiveWire and third-party suppliers and vendors. Cybersecurity risks and threats are monitored by the Company's Corporate Information Security Office and routinely discussed with senior management across the Company. Cybersecurity risks are identified and assessed through third-party assessments, IT security assessments, audits conducted by Internal Audit and risk and compliance reviews. Additionally, as part of the Company's cybersecurity risk management process, tabletop exercises are conducted at the technical and management levels. During these tabletop exercises, cybersecurity incidents are simulated, aimed at ensuring the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cybersecurity program.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The Company takes measures to regularly update and continuously improve its cybersecurity program, including conducting independent program assessments, performing penetration testing and scanning the Company's systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies and monitoring emerging laws and regulations related to information security. The Company also periodically engages third-party consultants to assist in assessing and enhancing its cybersecurity program. The Company has implemented risk-based controls to protect its information, customer information, third-party information, its information systems and its business operations. The Company follows the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has adopted security-control principles based on NIST, other industry-recognized standards and contractual requirements, as required.