text: We maintain a layered security architecture as a key part of our infrastructure design and utilize our employees and managed third-party service providers to help ensure a secure environment and safeguard against a variety of threats including malware, systems intrusions, unauthorized access, data loss and other security risks. We have implemented various technology products and associated procedures, including, among others, the following: Firewall protection, operating system security patches, and multi-factor authentication; System security agent software, which includes encryption, malware protection, patches and virus definitions; Monitoring of computer systems for unauthorized use of or access to sensitive information; Web content filtering; Web and network vulnerability assessments and penetration testing; Monitoring emerging laws and regulations related to data protection and information security;


text: Hosting in-house production systems in geographically dispersed locations that are backed up to alternate locations; and Employee cybersecurity awareness training that includes regular phishing simulations.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS

secItem: Item 1C


text: As part of the above processes, we engage various professional services firms that use external third-party tools to assess our internal cybersecurity programs and compliance with applicable practices and standards. Our use of these third parties allows us to leverage specialized knowledge, insights and industry best practices.


text: The Company's processes to identify material risks from cybersecurity threats associated with our use of third-party service providers are included within our service provider management policy. The policy provides guidelines in performing cyber risk assessments on our critical and material third party service providers during onboarding and periodically thereafter.


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors in the event of a material cybersecurity incident.


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect, our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition which are further discussed in Item 1A. "Risk Factors—Risks Related to our Industry, Business and Operations—We and our third-party service providers rely on numerous technology systems and any business interruption, security breach, or system failure could negatively impact our business and profitability" of this Annual Report on Form 10-K, which should be read in conjunction with the information in this section.


text: Our Board of Directors ("Board") oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross- functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.


text: Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO. Our CISO has over 25 years of experience in the information technology and cybersecurity field and is a Certified Information Systems Security Professional.


text: We maintain a cybersecurity and information protection program that is supported by policies and procedures designed to protect our systems and assets and the Company's sensitive or confidential business information, including that entrusted to us by our clients and business partners. Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management ("ERM") processes. Our ERM processes consider cybersecurity threat risks alongside other company risks as part of our overall management activities. Cybersecurity risks related to our business are identified and managed through a multi-faceted approach utilizing various systems, controls, and processes. Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO.


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors ("Board") in the event of a material cybersecurity incident.


text: Our Board oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross-functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: SYNOPSYS INC

ticker: SNPS


text: We maintain a cybersecurity program and incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.


text: Synopsys' cybersecurity program is designed to leverage multiple industry-recognized frameworks including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/IEC 27001 Information Security Management Framework, and are assessed regularly by our internal audit department. We track our NIST CSF implementation through periodic third-party maturity assessments that provide the basis for establishing performance goals for the coming period.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.


text: Since 2015, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See our risk factor disclosures in Part I, Item 1A of this Annual Report.


text: Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors (the Board), which considers these areas as essential for the success of our company and the broader technology industry in which we operate.


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee of our Board, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks. Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. Our CISO has over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CISO holds a Bachelor's of Science in Information Technology and a Master of Business Administration, and is also a Certified Information Systems Security Professional. He oversees our cybersecurity program and chairs a cross-functional committee that spans information security, IT, product security, physical security, and legal.


text: Our CISO and other members of senior management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers, and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including mandatory yearly training for all employees, additional training for all Information Technology and Information Security personnel, and regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.


text: Synopsys' cybersecurity policies and procedures are intended to align with multiple industry-recognized frameworks, including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/International Electrotechnical Commission (IEC) 27001 Information Security Management Framework. In addition, some Synopsys products are ISO 27001 and/or SOC2 Type 2 certified. Our internal audit department regularly assesses our conformity with these frameworks. We track our NIST CSF implementation through regular third-party maturity assessments, which provide the basis for establishing performance goals for the coming period. We also closely monitor the ever-changing landscape of related laws and regulations and regularly update our policies and processes to promote continued compliance.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.


text: Since 2015, Synopsys is not aware of any material information security breaches and has not made any associated penalties/settlements, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. During the same time period, while some of our suppliers have experienced security breaches, none of these breaches have had a material impact on Synopsys.


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks.


text: Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and data related to our customers, consumers and employees. Our cybersecurity risk management program leverages the National Institute of Standards and Technology Cyber Security Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our cyber security team regularly reviews enterprise risk management-level cybersecurity risks, and key cybersecurity risks are incorporated into our Enterprise Risk Management program. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include cyber security guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the Internet, social media, email and wireless devices.

companyName: Fossil Group, Inc.

ticker: FOSL


text: Our Chief Information Security Officer ("CISO"), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level with third-party experts, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. Further, we conduct regular external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function and has delegated to our Audit Committee responsibility for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee of the Board. Our CISO has two decades of experience leading cyber security oversight with ten years in a multinational company environment. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our General Counsel. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives reports quarterly from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our Board of Directors also receives periodic reports from our CISO or Audit Committee regarding our overall cybersecurity program.


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. Our CISO has a decade of experience leading cyber security oversight. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, periodic tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Interim Chief Financial Officer and our Chief Legal Officer. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level.

companyName: Cornerstone Building Brands, Inc.


text: We maintain an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the Board of Directors and the Company's management. The program is designed to (i) identify and assess risks most critical to the Company's success including through detailed analysis of the likelihood of occurrence and potential impact of each risk, (ii) assign individual executives the responsibility of managing those risks, and (iii) align those management assignments with appropriate board-level oversight.


text: Our General Counsel and Assistant General Counsel – Compliance drive the program. The executive leadership team, including our Chief Executive Officer, and the Company's management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing managing and mitigating risks. With respect to cybersecurity risk, our legal and compliance team works closely with our IT leaders to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: External experts supplement our internal expertise as necessary. Risks identified as significant risks are communicated to the Board of Directors, who ultimately oversees the program both directly and indirectly through Board Committees, such as the Audit Committee.


text: Risk management, including risks related to cybersecurity is also incorporated into the review and approval process for our project management organization ("PMO").


text: Our cybersecurity risk management program includes enterprise-wise monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on the Company's assets, systems, resources or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Depending upon the nature and severity of the risk, cybersecurity monitoring and identification can result in automated processes to immediately block and remove undesired risks, cybersecurity team review and action, or both. The Cybersecurity Incident Response Plan provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, which could include activating crisis, or business continuity recovery plans, as appropriate. These plans are regularly reviewed and updated by our Chief Information Officer and communicated to appropriate stakeholders.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes managed services, team augmentation, independent audits, vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: Because we are aware of the risks associated with third-party service providers, such as suppliers, software and cloud-based service providers, and cybersecurity partners, the Company implements processes to oversee and manage these risks. We assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. We require third parties to maintain security controls to protect our confidential information and data and notify us of breaches that may impact our data. Third parties that interact with our information or have access to our systems may have additional security requirements depending on the levels of risk. When new third-party risks are identified, we require those impacted to implement appropriate remediations or controls. Identified risks are documented and tracked along with general ongoing monitoring of third parties external risk posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third party service providers.


text: During the last year we have not identified cybersecurity threats or challenges that have materially impaired our operations or financial condition. Our monthly baselines for cybersecurity are closely tracked and show a continual improvement and reduction of risk over the last three years. Similarly, incident investigations over the same period have reduced in severity and frequency. These internal metrics are consistent with our third-party risk scorecard subscriptions which similarly show a year-over-year improvement in our risk posture over the last three years. See Risk Factor, "Damage to our computer infrastructure and software systems and issues relating to the incorporation of artificial intelligence ("AI") solutions into our systems, could harm our business."


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors have delegated to the Audit Committee oversight over cybersecurity risk.


text: The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors through the Board-approved escalation protocol.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cybersecurity has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.


text: The Director Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director Cyber Security leads a team of Cybersecurity Engineers and manages vendor relationships and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering committee, which is comprised of senior executives are kept updated on any material incidents, Cybersecurity initiatives and strategic roadmap.


text: Risk Assessments The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level.


text: Third-Party Engagement Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes managed services, team augmentation, independent audits, vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: Learning from Threats/Incidents During the last year we have not identified cybersecurity threats or challenges that have materially impaired our operations or financial condition. Our monthly baselines for cybersecurity are closely tracked and show a continual improvement and reduction of risk over the last three years. Similarly, incident investigations over the same period have reduced in severity and frequency. These internal metrics are consistent with our third-party risk scorecard subscriptions which similarly show a year-over-year improvement in our risk posture over the last three years. See Risk Factor, "Damage to our computer infrastructure and software systems and issues relating to the incorporation of artificial intelligence ("AI") solutions into our systems, could harm our business."


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors has delegated to the Audit Committee oversight over cybersecurity risk.


text: Governance – Conveying Risks to the Board of Directors The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in keeping the Audit Committee apprised of cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors, as appropriate, through the Board-approved escalation protocol.


text: Governance and Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cyber Security has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.


text: Management Oversight Our Director, Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director, Cyber Security leads a team of cybersecurity engineers, manages vendor relationships, and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering Committee, which is comprised of senior executives are kept updated on any material incidents, cybersecurity initiatives and the Company's cybersecurity strategic roadmap.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge, and testing; using a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, as needed. We had no material cybersecurity incidents in 2023.


text: Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a Third-Party Risk Management program to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and cyber incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our management-level Disclosure Committee, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Chief Information Officer, Chief Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Our board-level Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Risk Committee is engaged, as needed, in accordance with our Cybersecurity Incident Response Plan.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our Information Security department, which is our first line of defense, operates under our Chief Information Security Officer, who manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches At least annually, the first line conducts mandatory teammate training on information security and provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, and escalate cyber threats. We also have a business risk manager within our first line of defense whose role is to focus on evaluating, managing, and escalating technology risks. The escalation process includes a weekly escalation report of problem incidents, including cybersecurity threats, which allows for collaborative threat management by the first and second lines of defense.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our management-level Technology and Operational Risk Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Chief Information Security Officer and is co-sponsored by the Chief Information Officer and the Chief Risk Officer. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of 10 years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team, as well as our Head of Business Risk, who operates within our first line of defense.


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.


text: The cybersecurity threat landscape is volatile and dynamic, requiring a robust and resilient framework to reduce and mitigate cybersecurity risk. Our cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: leveraging the National Institute of Standards and Technology framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover; maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge, and testing; managing a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and using a comprehensive Cybersecurity Incident Response Plan intended to provide a documented framework to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, as appropriate.


text: We had no material cybersecurity incidents in 2024. While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Attacks are increasingly sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Accordingly, risks related to a cybersecurity event, including litigation and enforcement risks, are elevated due to the dynamic nature and sophistication and frequency of these threats, and the expanding use of Internet banking, mobile banking and other technology-based products in our industry. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: We devote significant resources to cybersecurity and risk management processes and continue to expand investments in information security and cybersecurity by attracting and retaining top talent, fostering continuous education and improvement, and leveraging advanced technology and innovative solutions, including partnerships with third-party vendors, to strengthen our information security and cybersecurity capabilities. W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements, industry guidelines, and best practices. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a Third-Party Risk Management program to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements with our service providers that include requirements related to cybersecurity and data privacy, however, we cannot guarantee that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: Through established governance structures, including our problem and incident management process and Cybersecurity Incident Response Plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures help enable our three lines of defense and management to identify, protect, detect, respond, and recover from cybersecurity risks, monitor threats, and provide for further escalation to executive management, our management-level Disclosure Committee, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes, but is not limited to, risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Chief Information Officer, Chief Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our Information Security department, which is our first line of defense, operates under our Chief Information Security Officer, who manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. Our Chief Information Security Officer has 28 years of cybersecurity experience, with 13 years servicing financial institutions in senior leadership or executive security roles. At least annually, the first line of defense conducts mandatory teammate training on information security and provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials. The first line of defense also conducts regular exercises that simulate mock cyber-attacks and provide lessons learned that continuously improve our incident response plans. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, and escalate cyber threats. We also have a business risk manager within our first line of defense whose role is to focus on evaluating, managing, and escalating technology risks. The escalation process includes regular escalation reports of problem incidents, including cybersecurity threats, which allows for collaborative threat management by the first and second lines of defense.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our management-level Technology and Third-Party Risk Committee, which governs our technology and third-party risk tolerances, including cybersecurity. This committee includes the Chief Information Security Officer and is co-sponsored by the Chief Information Officer, the Chief Risk Officer, and the Director of Vendor Risk Management and Sourcing. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of ten years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team, as well as our Head of Business Risk, who operates within our first line of defense.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: We leverage guidance from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides an outline of enterprise security processes and controls, to inform the design and assessment of our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is overseen by a cross-functional team comprised of our business-functional and IT employees. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • evaluations of our readiness to assess, respond and, as applicable, recover from potential cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity training to educate our employees (including senior management and incident response personnel), consultants, and other users about their individual responsibilities regarding protecting our IT systems and data; • a third-party risk management process for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Market and Other External Risks—Failure to protect our information technology systems against security breaches, service interruptions, or misappropriation of data could disrupt operations, compromise sensitive data, and expose us to liability, possibly causing our business and reputation to suffer."


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO") through our Information Security Committee ("ISC"), which includes a cross-functional group of senior leaders who are responsible for the dissemination and promotion of our cybersecurity strategy, implementation of cybersecurity objectives and top-down communication and monitoring of the risk management program as described above. Our ISC is responsible for the regular oversight of cybersecurity risk, information security and technology risk and assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our ISC facilitates communications between executive, business/process level and the implementation/operations level to coordinate the implementation of our cybersecurity risk program. The ISC team meets on a regular basis, at least quarterly and more frequently as needed, to discuss significant initiatives, critical metrics and address certain risk responses.


text: Our ISC members includes our CIO and our Director of IT Security, Risk and Compliance who have a combined 20 years of risk management experience encompassing cybersecurity and technology security, such as threat assessments, risk management, cybersecurity insurance, incident response, end user awareness and vulnerability management.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. On a quarterly basis, our Audit Committee receives updates from our CIO with respect to the status of our cybersecurity initiatives to strengthen our cybersecurity risk management. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee discusses the potential impact of cybersecurity risks on our financial condition, results of operations or our reputation. Our Audit Committee periodically reports to the Board regarding its activities, including those related to cybersecurity. The Board also periodically receives briefings from management on our cyber risk management program. Board members receive periodic presentations on cybersecurity topics from our CISO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity risk management program is led by our Chief Information Officer (" CIO ") through our Information Security Committee ("ISC"), which includes a cross-functional group of senior leaders who are responsible for the dissemination and promotion of our cybersecurity strategy, implementation of cybersecurity objectives and top-down communication and monitoring of the risk management program as described above. Our ISC is responsible for the regular oversight of cybersecurity risk, information security and technology risk and assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our ISC members includes our Chief Information Security Officer ("CISO") and our Director of IT Security, Risk and Compliance who have a combined 20 years of risk management experience encompassing cybersecurity and technology security, such as threat assessments, risk management, cybersecurity insurance, incident response, end user awareness and vulnerability management.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. On a quarterly basis, our Audit Committee receives updates from our CISO with respect to the status of our cybersecurity initiatives to strengthen our cybersecurity risk management. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee discusses the potential impact of cybersecurity risks on our financial condition, results of operations or our reputation. Our Audit Committee periodically reports to the Board regarding its activities, including those related to cybersecurity. The Board also periodically receives briefings from management on our cyber risk management program. Board members receive periodic presentations on cybersecurity topics from our CISO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: We have implemented a comprehensive cyber risk management program that adheres to industry standards, specifically the National Institute of Standards and Technology's cybersecurity framework and risk management standards. This program is maintained by a dedicated security operations team at the Company (the "Security Operations Team"). This process includes annually assessing and categorizing existing and emerging threats to Asure's business operations and its information systems. Identified risks are assessed for severity and probability of impact and then risk treatments are identified and implemented. Additionally, Asure has implemented a vendor risk management program to continually assess and monitor risks posed by vendors and partners of the Company.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: We maintain a comprehensive listing of controls that includes those risk treatments which are continuously monitored and assessed by the Security Operations team. These controls are derived from the risk assessment process and include physical, logical and environmental security, vulnerability management, secure development and change management, fraud detection, and privacy. We also maintain a security awareness program (the "Security Awareness Program"), which is designed, implemented and maintained by our VP of Information Security. Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect our resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. Additionally, we provide specialized security training for certain employee roles, such as application developers.


text: We conduct periodic tests to assess our processes and procedures and the threat landscape, which are designed with the goal of implementing and maintaining a robust cybersecurity program. Where appropriate, we take additional and ongoing steps intended to strengthen our cybersecurity capabilities and mitigate the risk of a breach or incident. Our security program and IT-related controls are regularly examined by internal auditors, external auditors and various regulators who regularly assess the design and effectiveness of our control framework. As part of those assessments, Asure maintains both SOC1 Type 2 and SOC2 Type 2 certifications specifically evaluating the security, confidentiality, and availability of its systems and information. Additionally, state examiners audit our IT-related controls as part of our Money Transmitter Licensing requirements.


text: Although we have designed its cybersecurity program and governance procedures noted above to mitigate cybersecurity risks, we continue to face unknown cybersecurity risks, threats and attacks. To date, these risks, threats and attacks have not had a material impact on our operations, business strategy or financial results; however, they may have a material impact in the future.


text: Please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.


text: Our Security Operations team, led by the VP of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the executive management team. In addition, cybersecurity risks, emerging and existing threats and Asure's current security posture are presented to the board of directors quarterly. Our VP of Information Security holds a high-level certification relating to information security, Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium, and has 17 years of information security, risk management, application security, security operations, and incident management experience. Our Executive Management receives regular monthly reports from the VP of Information Security.


text: Our Security Operations team has implemented a continuous monitoring program that provides real time feedback to security events that are triaged and remediated. Critical incidents are escalated in accordance with Asure's Incident Response Policy. Critical incidents are reported to the board of directors as required by Asure's Incident Response Policy.


text: Although we have designed its cybersecurity program and governance procedures noted above to mitigate cybersecurity risks, we continue to face unknown cybersecurity risks, threats and attacks. We have had no material cybersecurity incidents, and these risks, threats and attacks have not had a material impact on our operations, business strategy or financial results; however, they may have a material impact in the future.


text: Our Security Operations team, led by the VP of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the executive management team. In addition, cybersecurity risks, emerging and existing threats and Asure's current security posture are presented to the board of directors quarterly, as the board of directors is generally responsible for our risk management. Our VP of Information Security holds a high-level certification relating to information security, Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium, and has 18 years of information security, risk management, application security, security operations, and incident management experience. Our Executive Management receives regular monthly reports from the VP of Information Security.


text: The SERC Committee is responsible for reviewing the overall adequacy of, and providing oversight with respect to, the Company's safety, environmental and regulatory compliance policies, programs, procedures, initiatives and training in light of applicable legal requirements and governmental and industry standards in the jurisdictions in which the Company and its subsidiaries conduct business. We also have several working groups responsible for collaborating on cybersecurity policies and standards. The Global Chief Information Officer and the Global Chief Information Security Officer report to the SERC Committee quarterly on the Company's cybersecurity program, and to the Board of Directors, as necessary. In the event of a cybersecurity incident, our Global Chief Information Officer and Global Chief Information Security Officer, and others serving in similar capacities, will assess the incident and activate an incident response plan. These officers will escalate review of the incident to business unit leaders and/or members of our executive leadership team, as appropriate. We have a cybersecurity program to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company. Our cybersecurity program has a formalized framework that is informed by domestic and international laws, regulations and industry best practices and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to safeguard the confidentiality, integrity and availability of our information and systems. Our Information Security Program serves as the foundation of our cybersecurity program and our Acceptable Use Policy also provides governance in this area. We partner with other companies, industries and law enforcement to communicate information about the latest cybersecurity threats and leverage threat modeling insights. We conduct cybersecurity assessments against industry cybersecurity frameworks to better enable us to prioritize actions and investments to enhance our cybersecurity capabilities. Our cybersecurity teams work diligently to safeguard Company and customer data by applying layered and defensive mechanisms to proactively provide the security needed to detect and defend against cyber-attacks and to withstand potential impacts. We periodically conduct tabletop exercises and penetration testing to test our defenses. In addition, we provide new hires and employees with cybersecurity training, which is monitored and tracked on an annual basis. We also issue routine phishing campaigns to educate employees on social engineering techniques and informal security awareness exercises are conducted throughout the year.

companyName: UGI CORP /PA/

ticker: UGI


text: The Audit Committee is responsible for reviewing periodically the effectiveness of the Company's information and technology security policies and the internal controls regarding information and technology security and cybersecurity. We also have several working groups responsible for collaborating on cybersecurity policies and standards. The Global Chief Information Officer and the Global Chief Information Security Officer report to the Audit Committee quarterly on the Company's cybersecurity program, and to the Board of Directors, as necessary. In the event of a cybersecurity incident, our Global Chief Information Officer and Global Chief Information Security Officer, and others serving in similar capacities, will assess the incident and activate an incident response plan. These officers will escalate review of the incident to business unit leaders and/or members of our executive leadership team, as appropriate. We have a cybersecurity program to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company. Our cybersecurity program has a formalized framework that is informed by domestic and international laws, regulations and industry best practices and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to safeguard the confidentiality, integrity and availability of our information and systems. Our Information Security Program serves as the foundation of our cybersecurity program and our Acceptable Use Policy and Information Security Program Policy also provides governance in this area. We partner with other companies, industries and law enforcement to communicate information about the latest cybersecurity threats and leverage threat modeling insights. We conduct cybersecurity assessments against industry cybersecurity frameworks to better enable us to prioritize actions and investments to enhance our cybersecurity capabilities. Our cybersecurity teams work diligently to safeguard Company and customer data by applying layered and defensive mechanisms to proactively provide the security needed to detect and defend against cyber-attacks and to withstand potential impacts. We periodically conduct tabletop exercises and penetration testing to test our defenses. In addition, we provide new hires and employees with cybersecurity training, which is monitored and tracked on an annual basis. We also issue routine phishing campaigns to educate employees on social engineering techniques and informal security awareness exercises are conducted throughout the year.


text: The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: Primo Water Corp /CN/


text: The Company's Global Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified Information Security Manager and Certified Information Systems Security Professional certifications from ISACA and ISC2, respectively, two leading independent cybersecurity associations.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to Primo's cyber risks, threats, and protections and provides updates throughout the year, as warranted.


text: We have processes and a risk-based approach that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. The CISO reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. This review aids in the identification of material breaches at other companies, including our third-party service providers. The CISO also discusses trends in cyber risks and our strategy to defend our information against cybersecurity incidents with our Audit Committee and executive leadership team on a regular basis, in addition to the annual review and discussion with the full board. In addition to our dedicated information security and technology teams monitoring our daily operations, we engage independent third-party cybersecurity providers for managed systems security, endpoint detection and response, and threat and vulnerability management. Regular communication with these providers aids in the identification and remediation of potential threats, and we regularly review our relationships with and services from these providers against industry standards and evolving cybersecurity threats.


text: We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness trainings and supplemental trainings as needed. All employees undergo annual training and there are additional trainings for certain roles and functions. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks.


text: Securing the Company's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our various stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational, financial and legal risks.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: We have developed a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information we own or process against risks from cybersecurity threats. Using a risk-based prioritization approach, the cybersecurity team focuses on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and maturing the compliance processes to protect the Company's operations and data.


text: We have implemented policies, programs and controls and invested in cybersecurity technologies that focus on assessing, monitoring, and managing our cybersecurity risks. These include, but are not limited to: maintaining comprehensive cybersecurity policies and practices; augmenting our organization with a global cybersecurity operation center that monitors cyber threats 24-hours a day on a year-round basis; new surveillance technologies to proactively identify threats and improve the Company's cyber defense capabilities; implementing enterprise-wide cybersecurity training, anti-phishing and awareness programs for our employees and crew members; and conducting cyber simulations with various teams across the Company as well as with management to evaluate our response approach. We have also implemented comprehensive processes designed to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which include security assessments on our suppliers and vendors and continuous monitoring of cyber threats. Our cybersecurity program is based on recognized best practices and standards for cybersecurity, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We conduct regular third-party assessments of our cyber risk management program.


text: We also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM). This assessment includes an evaluation of the Company's processes to identify and respond to cyber risks and the effectiveness of the Company's lines of defense. Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence (including assessors, consultants, and other third parties) to evaluate our cyber risks and to properly adjust our risk mitigation approach. We also maintain controls and procedures that are designed to evaluate cyber risks on an ongoing basis. These processes include prompt communication of certain cybersecurity incidents to the Company's executives, internal committees and the Board as needed, so that any needed external reporting can be made by management and the Board in a timely manner.


text: Our policies require each of our employees to contribute to our data security efforts. We regularly educate our employees about the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on the Company, refer to Item 1A. Risk Factors - "We are exposed to cyber security attacks and data breaches and the risks and costs associated with protecting our systems and maintaining data integrity and security."


text: Our cybersecurity program is led by our Chief Information Officer (CIO) and the Chief Information Security Officer (CISO). They are supported by Information Security Officers who work closely with our operational teams. Our CIO and CISO have more than 35 years of collective experience in the cybersecurity field. The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO has served in similar roles at three major public companies and is a recognized cybersecurity leader. He regularly engages with peer CISOs, cybersecurity experts and organizations, including the Cloud Security Alliance (CSA) and the NIST, to stay informed on the latest industry developments. The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk framework. This also helps ensure that the highest levels of management are kept abreast of our cybersecurity posture and potential risks.


text: Our Board, in coordination with the Audit Committee, is actively engaged in reviewing management's processes for assessing and managing cybersecurity risks. The Board reviews cybersecurity at least annually. The Audit Committee directly oversees the Company's management of cybersecurity risks. On a quarterly basis or as needed, the Audit Committee receives updates from management (including the CIO and CISO) on cybersecurity risks resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. In addition, the Chair of the Audit Committee regularly informs the Board of the outcome of the Audit Committee's reviews at scheduled Board meetings.


text: We have implemented policies, programs and controls and invested in cybersecurity technologies that focus on assessing, monitoring, and managing our cybersecurity risks. These include, but are not limited to: maintaining comprehensive cybersecurity policies and practices; augmenting our organization with a global cybersecurity operation center that monitors cyber threats 24-hours a day on a year-round basis; new surveillance technologies to proactively identify threats and improve the Company's cyber defense capabilities; implementing enterprise-wide cybersecurity training, anti-phishing and awareness programs for our employees and crew members; and conducting cyber simulations with various teams across the Company as well as with management to evaluate our response approach. We have also implemented comprehensive processes designed to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which include security assessments on our suppliers and vendors and continuous monitoring of cyber threats. Our cybersecurity program is based on recognized best practices and standards for cybersecurity, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: We conduct regular third-party assessments of our cyber risk management program, and also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM). This assessment includes an evaluation of the Company's processes to identify and respond to cyber risks and the effectiveness of the Company's lines of defense. Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence to evaluate our cyber risks and to properly adjust our risk mitigation approach. We engage third parties to perform periodic assessment of our cyber program maturity against the NIST framework, to perform penetration testing, and to audit our capabilities from time to time. We also maintain controls and procedures that are designed to evaluate cyber risks on an ongoing basis. These processes include prompt communication of certain cybersecurity incidents to the Company's executives, internal committees and the Board as needed, so that any needed external reporting can be made by management and the Board in a timely manner.


text: Our policies require each of our employees and crew members to contribute to our data security efforts. We regularly educate our employees about the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Our cybersecurity program is led by our Chief Information Officer (CIO) and the Chief Information Security Officer (CISO). They are supported by Information Security Officers who work closely with our operational teams. Our CIO and CISO have more than 35 years of collective experience in the cybersecurity field. The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems, and data. The CISO has served in similar roles at three major public companies and is a recognized cybersecurity leader. He regularly engages with peer CISOs, cybersecurity experts and organizations, including the Cloud Security Alliance (CSA) and the NIST, to stay informed on the latest industry developments. The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk framework. This also helps ensure that the highest levels of management are kept abreast of our cybersecurity posture and potential risks.


text: Buckle is committed to earning and maintaining the trust of its guests, teammates, vendors, and shareholders. This commitment, as it relates to technology and data, requires a focus on protecting business operations and preserving the confidentiality, integrity, and availability of information by preventing, identifying, and mitigating cybersecurity threats and effectively responding to any security incidents when they occur. The Company's commitment to cybersecurity is integral to its business strategy, operational integrity, and brand reputation.

companyName: BUCKLE INC

ticker: BKE


text: Leading the Company's cybersecurity risk management and strategy at the management level is our Senior Director of Information Security, who reports directly to the Vice President of Information Technology. The Senior Director of Information Security has been with the Company for over 18 years, serving in various capacities with deep understanding of the underlying architecture, technologies, and systems utilized by the Company. The Senior Director of Information Security and his team are responsible for designing and implementing the Company's strategies, policies, and processes to assess, identify, and manage risk related to cybersecurity threats, along with threats associated with our use of third-party service providers. A combination of industry-leading tools, relationships with external experts, in-house expertise, and in-house technologies are integral to the Company's strategy for managing cybersecurity threats. The Company executes ongoing assessment and testing of processes and practices through regular teammate training, phishing exercises, network and endpoint monitoring, penetration testing, vulnerability scanning, and attack simulations. The Company's incident response plan is based on recognized industry best practice security standards and control frameworks, such as the National Institute of Standards and Technology Cybersecurity ("NIST") Framework. Third parties are also engaged to perform assessments and validate the Company's cybersecurity measures, including information security maturity assessments and independent reviews of the operating effectiveness of the information security control environment.


text: While the Board of Directors is ultimately accountable for risk management, the Audit Committee oversees management's processes for identifying, implementing, and mitigating cybersecurity threats. On at least a quarterly basis, the Senior Director of Information Security provides the Audit Committee with updates regarding the Company's ongoing cybersecurity program. These updates regularly cover the latest in the Company's evolving approach to managing cybersecurity risks, reviewing key metrics on the effectiveness of the program, and discussing recent developments, key strategic initiatives, the current threat environment, and outcomes from specific evaluations and tests.