text: Our Board of Directors are part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.


text: Management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC

secItem: Item 1C


text: Internal Cybersecurity Team The Information Security organization reports into the SVP, IT and includes a dedicated team of centralized information security experts with extensive cybersecurity knowledge and experience to manage the cyber risk under the leadership of the Director of Information Security.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy Network security configurations Risk Management and oversight of third parties


text: We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. Internal reporting and escalation protocols are in place to ensure the involvement of the SVP, IT, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data.

companyName: Twist Bioscience Corp

ticker: TWST


text: Our Chief Information Officer ("CIO") together with our Senior Director of IT Infrastructure, Security and Compliance and other members of the Information and Business Technology ("IBT") Security team, are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our Security Incident Response Policy ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Our cybersecurity program is based on the International Organization for Standardization ("ISO") 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 "Guide for Conducting Risk Assessments" that provide guidelines and principles for information technology security risk management.


text: We have a dedicated Information Security team within the IBT team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including Legal and Finance, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.


text: We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape. We refine and mature our cybersecurity roadmap and strategy based on findings and their risk standing.


text: We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company maintains a formal risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems, or fail to implement new systems and software successfully, our business could be adversely affected. Cyberattacks and security vulnerabilities could lead to reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Board would be informed of an incident by our executive team.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 13 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Our approach to cybersecurity risk is based on processes that monitor threats, adapt our capabilities and services, and align our practices with business goals in order to provide security controls that reduce information security risk to the organization and customers.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: We implement and maintain controls and capabilities for identifying, assessing, and managing risk from cybersecurity threats to the confidentiality, integrity, or availability of our information systems or any information residing therein. We also carry out broad-scope initiatives and project-specific initiatives aimed at continuously improving our cybersecurity posture. Our risk assessments and initiatives include identification of reasonably foreseeable internal and external risks, assessing the likelihood and potential impact that could result from such risks, and planning and implementing risk management controls as applicable. As a result, we adapt safeguards and processes in order to reduce identified risks in our security posture. Our cybersecurity processes form a part of our overall risk management practices and inform our annual enterprise risk assessment conducted by our internal audit team.


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby Millicast in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. We also take part in periodic security audits by our clients and partners.


text: As part of our overall risk management processes, our employees at all levels are trained on foundational cybersecurity practices annually, and periodically participate in various activities aimed at increasing their awareness of cybersecurity threats and reinforcing their understanding of our security policies.


text: Periodically, we engage consultants and other third party service providers in connection with our cybersecurity practices. These service providers assist us in event monitoring, conduct testing and provide feedback on our readiness and compliance, conduct tabletop exercises, and are "on-call" in the event of a significant event. We have implemented a third-party risk management process that we use to evaluate the capabilities and security posture of third-party service providers. As part of that process, we review third-party service providers to ensure that they have implemented appropriate security measures in connection with their work with us. We have not encountered any cybersecurity incident that had a material impact on our operations or financial standing.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, under the heading "Operations".


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee, which has responsibility for overseeing the adequacy and effectiveness of our cybersecurity and information security programs and policies according to its charter.


text: Our CISO is primarily responsible for assessing and managing our risks from cybersecurity threats. Our CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity strategy and operations, incident response, cybersecurity education and awareness, threat management, insider threats and regulatory compliance. Our CISO has over 25 years of experience in technology, with more than 15 years in information security, holding multiple roles including five years as a CISO for a health insurance company. Our CISO reports on cybersecurity risk management and other matters to our CIO, who in turn reports to our Chief Executive Officer. Along with our CISO our security, privacy, audit, risk and compliance council ("SPARC Council"), which is a collection of stakeholders from various functions including cybersecurity, legal, IT, engineering, finance, procurement and audit, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our CISO and our SPARC Council review the results of assessments, including security simulations and tabletop exercises, and discuss and recommend improvements to our policies and processes. In addition to the general reporting structure applicable to our CISO, the other members of the SPARC Council report on those activities through the reporting lines applicable to them, as needed.


text: Our CISO along with our CIO typically provide quarterly briefings to the Audit Committee regarding our company's cybersecurity risks and activities, including recent cybersecurity incidents and strategy development. The findings from our annual enterprise risk assessment are also presented to the Audit Committee by our internal audit team. Our Audit Committee provides regular updates to the Board of Directors on such reports. In addition, our CISO along with our CIO typically provide annual briefings directly to the Board of Directors on cybersecurity risks and activities.


text: Cybersecurity continues to be a particularly acute area of risk for companies of all sizes and in all industries, including us. Our management and board of directors recognize the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Both management and our board of directors are actively involved in our enterprise risk management, and cybersecurity represents an important component of our overall approach to enterprise risk.

companyName: AZEK Co Inc.


text: While we have not experienced a material impact on our business strategy, results of operations or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws, which could have a material adverse effect on our business, results of operations and financial position.


text: We expect risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransomware attacks, other cyber-attacks, or other similar threats, to continue as events of this nature become more sophisticated and potentially more frequent, and the techniques used in such attacks change rapidly.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: We maintain a cybersecurity risk management program that is an important and integrated part of our enterprise risk management function and is designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology cybersecurity framework, or the NIST Framework. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.


text: We deploy a number of safeguards and processes designed to identify cybersecurity risks and protect our information systems from cybersecurity threats. For example, we maintain data encryption, monitoring, data storage, identity / authentication controls, including two-factor authentication tools, and anti-malware and anti-virus solutions. Additionally, for providers of software-as-a-service and other services that hold or process our data, we review and assesses industry standard certifications provided by such third-party service providers. We perform periodic penetration tests to identify and address vulnerabilities and perform cyber simulations to practice our cybersecurity incident response procedures. We train employees on cybersecurity risks at least semi-annually and generate internal phishing campaigns to assess the effectiveness of the training. We also maintain written information technology and cybersecurity policies that are reviewed regularly and are available to employees on demand. In addition to internal resources and expertise across our information technology, internal legal and compliance and internal audit teams, we use a variety of industry standard security products and consultants and other third-party service providers to inform our understanding of the threat landscape and to assist us with protecting our technology infrastructure and data. Such security products cover data security, application security, endpoint security, and other security functions. We utilize third-party service providers to assist with the construction and maintenance of such defense system, as well as for assistance with respect to threat identification, response and, if necessary, remediation. We also engage third-party cybersecurity experts to conduct tabletop exercises to enhance incident response preparedness.


text: To the extent cybersecurity risks are identified, they are responded to by our cybersecurity team. Cybersecurity incidents are managed, evaluated, investigated, and responded to in accordance with our documented Cyber Incident Response Plan.


text: While management is responsible for our cybersecurity program and managing our cybersecurity risks, including our procedures and day-to-day operations, our audit committee oversees our enterprise risk assessment and management program, which includes oversight of cybersecurity risks. In performing its oversight responsibilities, our audit committee receives regular reports from, and meets with, our cybersecurity leaders at least semi-annually, to review our information technology and cybersecurity risk profile and to discuss our efforts to prevent, detect, mitigate, and remediate cybersecurity incidents. Our audit committee, in turn, regularly reports to the full board of directors regarding such oversight. When assessing audit committee membership, our board of directors considers each member's information technology and cybersecurity expertise. Our Cyber Incident Response Plan includes protocols under which cyber-related incidents are required to be escalated to senior management and to the audit committee, with ongoing updates regarding any such incident until it has been addressed. In addition to the above, we recently hired a Chief Digital and Technology Officer to oversee all aspects of our technology system infrastructure and processes and manage our team of internal information technology experts, including our Chief Information Officer. The Chief Digital and Technology Officer is supported by a management-level committee and an experienced cybersecurity team that support our processes to assess and manage cybersecurity risk. Each of our Chief Digital and Technology Officer and our Chief Information Officer has over 25 years of information technology experience, primarily in the manufacturing and consumer goods industries. Our Chief Information Officer also has a degree in Management Information Systems, and both our Chief Digital and Technology Officer and our Chief Information Officer have a Masters of Business Administration. We also currently engage a third-party consultant who reports directly to our Chief Information Officer and provides Chief Information Security Officer, or CISO, advisory services. This consultant has approximately 15 years of experience serving in cybersecurity leadership positions, including as a CISO at other U.S. publicly traded manufacturing companies.


text: The Company maintains a cybersecurity program, with direct oversight from senior management and the Board of Directors (the "Board"), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's cybersecurity program has been developed in light of the nature of the Company's business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company's business to broadly implement its cybersecurity program.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The Company's cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company routinely conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks and conducts at least one annual cybersecurity incident tabletop exercise to refine response plans.


text: The Company's cybersecurity program emphasizes defense, rapid detection, and remediation of cybersecurity threats and incidents, including the use of various security tools and systems based on defense-in-depth and zero-trust principles that are intended to meet control requirements. The cybersecurity program also encompasses crisis incident response guidelines that detail the processes for the detection, response, mitigation, and remediation of cybersecurity incidents, in order to support the effective management of, response to, communication during, and recovery from any such incidents.


text: A key element of the Company's strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company's information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company's servers and computers. The Company's cybersecurity preparedness program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee of the Board within 24 hours of their designation as high-risk by the Technology Risk Management Committee.


text: Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee of the Board as part of our overall risk management process.


text: The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on our Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors," under the heading "Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures."


text: Execution of the Company's cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has nearly 25 years of relevant experience in information security, including 13 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President of Information Systems & Informatics, and they meet periodically with senior leadership and the Board to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts. In addition, the Company's internal audit team conducts periodic audits of its systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.


text: The Company has also established a management-level Technology Risk Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company's Materiality Committee to support timely disclosure of relevant information.


text: Inotiv's cybersecurity risk management framework is grounded in external standards, specifically those of the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). These guidelines provide a strong, structured foundation designed to systematically protect business operations, customer data, and intellectual property in an environment of rapidly evolving cyber threats. We deploy a multifaceted security strategy that includes multi-factor authentication (MFA), advanced malware defenses, and comprehensive endpoint protection supported by Extended Detection and Response (XDR) technology. Additionally, we leverage the expertise of a third-party provider of Managed XDR services, which provides continuous monitoring across our environment to respond swiftly to potential security events.

companyName: Inotiv, Inc.

ticker: NOTV


text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats. By staying aligned with industry standards and engaging expert resources, we continuously adapt Inotiv's cybersecurity practices to meet today's challenges and anticipate future risks.


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures.


text: Governance of Cybersecurity Management Our cybersecurity governance structure is specifically designed to provide a clear chain of responsibility and accountability for assessing, managing, and mitigating cybersecurity risks. The Vice President of Information Security, who reports directly to the Chief Technology Officer ("CTO"), a member of our Executive Committee, leads our cybersecurity initiatives. Together, the Vice President of Information Security and the CTO bring a combined 50 years of technology experience with over 20 years dedicated to IT and security leadership. The Vice President of Information Security is tasked with overseeing cybersecurity risk assessments, implementing strategic security initiatives, and ensuring alignment with evolving regulatory requirements. The Vice President of Information Security provides weekly briefings to the CTO. Additionally, the Vice President of Information Security presents updates to the Executive Committee and the Board of Directors at least annually, although these updates generally occur on a quarterly basis. These presentations cover critical security issues and significant emerging threats.


text: The Board of Directors, through its Audit Committee, is responsible for the oversight of Inotiv's cybersecurity risk management practices. The Audit Committee reviews and assesses our approach to risk management, including risk associated with cybersecurity, against industry standards and regulatory obligations. We believe this governance structure is integral to maintaining high-level visibility and accountability across all levels of leadership. By providing the Board of Directors with regular and detailed updates on cybersecurity initiatives and significant developments in the threat landscape, we foster transparency and maintain cybersecurity as a central priority within the organization.


text: The Board of Directors' involvement in cybersecurity governance underscores our commitment to safeguarding our operations and stakeholders from digital risks. With dedicated oversight from both executive leadership and the Board of Directors, we integrate cybersecurity into our risk management and governance frameworks.


text: To date, there have not been any previous cybersecurity incidents that materially affected, or are reasonably likely to materially affect, us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.


text: The Company has adopted the definitions present in 17 CFR 229.106 for the following cybersecurity terms: • Cybersecurity Incident: An unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through information systems that jeopardizes the confidentiality, integrity, or availability of information systems or any information residing therein. • Cybersecurity Threat: A cybersecurity threat as any potential unauthorized occurrence on or conducted through its information systems that may adversely affect the confidentiality, integrity, or availability of information systems or any information residing therein. • Information Systems: Electronic information resources owned or used by the organization, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support its operations.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats. These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our Information Systems and Data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents. • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:


text: 24/7 Security Operations Center Managed Services ("SOC") to monitor our cyber environment, correlate logs from all technology assets to identify potential signs of compromise and perform threat hunt exercises. Enterprise-grade email security system managed services. Perform penetration tests, vulnerability assessments, and vulnerability scans of our customer-facing sites, among others.


text: Prevention of denial-of-service attacks • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents. • Policies and procedures related to cybersecurity matters, including but not limited to Acceptable Standards of Use of Technology Systems, Confidential/Sensitive Information and Credit Card Handling Policy, encryption standards, antivirus protection, wireless and remote access, multi-factor authentication, access and change control, and physical security. • Employee cybersecurity awareness by performing ongoing phishing exercises, and mandatory privacy and cybersecurity training (including spear phishing and other awareness training) for employees.


text: The Company consistently identifies and evaluates cybersecurity threats that could significantly impact our business strategy, financial condition, and operational results. As of fiscal 2024 year-end, no significant cybersecurity threats or incidents have materially impacted our strategy or operational results.


text: For a description of the risks related to cybersecurity that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Cybersecurity" section of this Report.


text: The Board of Directors plays a crucial role in overseeing the Company's management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Transformation Officer, Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and the Company's response to significant incidents.


text: Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Transformation Officer, Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Transformation Officer has over 30 years of experience in extensive technology and executive leadership experience across diverse industries, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on the Company's cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of sensitive customer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: We assess, identify, and manage material risks related to potential cyber attacks on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, and misuse, and unauthorized access to, or other cyber attacks or vulnerabilities affecting, our data.


text: The assessment of cyber risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our enterprise risk management program. We strive to implement cyber policies, standards, processes, and controls for assessing, identifying, and managing material risks from cyber threats and responding to cyber attacks that are aligned with industry best practices.


text: We have an information technology team, led by our director of information technology, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with our senior management team. We seek to address cyber risks through a cross-functional approach, including relevant training for applicable employees and regular reviews and tests of our cybersecurity program that leverage work done by internal audit.


text: We use processes to oversee and identify material risks from cyber threats associated with our use of third-party technology and systems. We maintain processes to reduce the impact of a cyber attack at a third-party vendor. We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: See Item 1A—"Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Our board of directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. The Audit Committee oversees our overall enterprise risk management program and assists the entire board in fulfilling its oversight responsibility with respect to our information security and technology risks. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports to the entire board on our relevant strengths and opportunities.


text: The Audit Committee receives periodic updates from our director of information technology. These updates include matters such as ongoing changes in our external and internal cyber threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cyber and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness.


text: In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company's risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: We rely on our information technology professionals at the subsidiary level to continuously monitor and update our information technology networks and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry-standard security technologies to protect the Company's and each subsidiary's data and business processes against cyber risks. To enhance our cybersecurity efforts and awareness, we have established an "IT Steering Committee," comprised of a team of information technology professionals from our subsidiaries, who will convene on a quarterly basis to discuss topics including cybersecurity threats, emerging attack methods, and best practices.


text: In fiscal year 2024, the Company engaged a consultant to conduct a cybersecurity risk assessment of our business operations at Live Ventures and each of our subsidiaries. This assessment evaluated both internal and external threats to operations and information handling. The output of this assessment offered a structured approach to understanding, assessing, and prioritizing our cybersecurity efforts. In collaboration with the Audit Committee, management will prioritize and implement appropriate measures.


text: As part of our cybersecurity risk management program, we will work with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.


text: While we are dedicated to cybersecurity, it is not possible to fully mitigate all technology risks. We are currently unaware of any cybersecurity incidents that have, or are reasonably likely to have, a material impact on our business or operations. However, the ever-evolving nature of attack techniques, along with the increased volume and sophistication of these attacks, means that cybersecurity threats - including data breaches, ransomware, and similar threats - could materially impact our future results. Such impacts could include reputational, competitive, operational, or other business harm, as well as financial costs and regulatory action. For further discussion of how risks from cybersecurity threats could materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A "Risk Factors," which is incorporated by reference into this Item 1C.


text: We rely extensively on information technology ("IT") systems, including Internet sites, data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. These systems, like those used by most companies, may be vulnerable to a variety of disruptions, including, but not limited to, those caused by natural disasters, telecommunications failures, hackers, and other security issues. Moreover, these IT systems, like those used by most companies, are subject to the possibility of computer viruses or other malicious codes, and to security breaches, cyber incidents, ransomware attack or phishing-attacks. Cybersecurity is an integral part of risk management at our Company, and we maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, which is part of our overall risk management system and processes.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: We have installed and continually upgrade an array of protections against cyber-intrusions. Our cybersecurity risk management processes are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as various other regulatory requirements and industry-specific standards. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products and related services. These controls include multifactor authentication on all critical systems, firewalls, encryption, anti-virus protections, intrusion detection and prevention systems and identity management systems. We provide mandatory cybersecurity awareness training of threats to associates at least annually and routinely deploy simulated phishing tests to increase security awareness.


text: Our IT team regularly tests our controls through penetration testing, vulnerability scanning, internal compliance assessments, threat-hunting operations and attack simulation.


text: Additionally, in connection with our cybersecurity risk management processes, from time to time, we engage independent third parties to assess our cybersecurity program and to assist us with defining our cybersecurity strategy, uplifting our processes and aligning our objectives. Outside counsel has also advised the Board about legal obligations in managing cybersecurity issues and risks.


text: We maintain a cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across the Company. We also conduct "tabletop" exercises, including exercises facilitated by third parties, during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cybersecurity incident response plan. These exercises are conducted at both the technical level and senior management level and have included participation by members of our Board.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers, including through due diligence of such providers' cybersecurity practices, contractual obligations to operate their IT systems in accordance with certain cybersecurity standards and ongoing monitoring.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our Chief Technology Officer ("CTO") is responsible for assessing and managing our material risks from cybersecurity threats. We have also established a cross-functional Cyber Steering Committee, which includes our CTO, Chief Information Security Officer ("CISO"), General Counsel, certain business leaders on a rotating basis and representatives of human resources and communications. The CISO, supported by inputs from the CTO team leads, delivers quarterly updates to the Committee on key risks and overall security program posture, as well as monthly strategic updates to the CTO on high visibility and key action items. Our CTO regularly reports to our Board and the Audit Committee.


text: Our CTO has served in this role since 2023 and has over 25 years of experience in the technology industry. Prior to his current role, he served as the CTO of Tyson Foods and before arriving at Tyson, he was the Chief Information Officer at Hewlett Packard, and then CIO at Hewlett Packard Enterprise.


text: Board of Directors Our Audit Committee is responsible for the oversight of cybersecurity risks and receives a cybersecurity report from our CTO at least quarterly, and more often as needed, including in the event of a significant cybersecurity incident. The report includes information regarding the nature of threats, defense and detection capabilities, incident response plans and associate training activities. Our Board retains responsibility for the oversight of our overall risk management systems and processes and is briefed our CTO on cybersecurity risks on a quarterly basis.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Tesla, Inc.

ticker: TSLA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, operate a bug bounty program to encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our information technology systems or data, or those of our service providers or customers or users could be subject to cyber-attacks or other security incidents, which could result in data breaches, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: In our business operations, we use information technology, enterprise applications, communications tools, cloud network solutions, and related systems to manage our operations, including to manage our building systems, tenant and vendor relationships, accounting and recordkeeping, and communications, among other aspects of our business.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: We have developed and implemented a cybersecurity risk management program intended to protect our properties, confidential and proprietary data, and information technology and systems, from cybersecurity threats, including unauthorized access or attack. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to the business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our processes for assessing, identifying, and managing risks from cybersecurity threats, including operational risks, financial reporting risks, reputational risks, personal data theft, fraud, and other potential risks, are integrated into our overall enterprise risk management process, and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: • a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment; • the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • a cybersecurity incident response plan, business continuity plan, and established policies governing cybersecurity risk management at the corporate and property levels; • cybersecurity training for employees and key business partners with access to our systems; • a third-party cybersecurity risk management process for service providers and vendors who access our systems; • requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and • cybersecurity risk insurance. We also seek to engage reputable service providers that maintain cybersecurity programs or controls.


text: We have not identified risks from known cybersecurity threats within the prior fiscal year, including as a result of any prior cybersecurity incident, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A, Risk Factors" in this report for additional information about certain ongoing risks related to our information technology that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board of Directors and management.


text: The Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of material risks arising from cybersecurity threats. The Audit Committee regularly receives updates from management and third-party cybersecurity experts about major cybersecurity risks, their potential impact on our business operations, and management's processes to identify, monitor, and mitigate such risks, including, as relevant, the results of assessments or audits of our processes. The Audit Committee periodically provides updates on these matters to the Board of Directors.


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to functionally serve as a virtual chief information security officer ("CISO"), to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. This expert has experience having served as the chief information security officer for an international commercial real estate services company and currently serves as chief information security officer of a cybersecurity firm focused on commercial real estate. He is supported by an internal cross-functional management team of IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training and risk management efforts.


text: Our information security program is managed by a Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Cyber Security Steering Committee, which includes the Chief Executive Officer, Chief Financial Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is periodically evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation. We leverage the National Institute of Standards and Technology Cyber Security Framework 2.0 for measuring overall readiness to respond to cyber threats and the Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management program, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.


text: We perform response simulations, tabletop exercises and recovery tests on a quarterly basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides overall coordination of our response to a major cyber incident as well as a resource engagement plan. As part of our crisis management plan, our cyber crisis communication plan accounts for timely and accurate dissemination of information to stakeholders during the crisis. Other components of our crisis management plan are our business continuity plan, that documents the application of specific strategies and measures to enable core business activities to continue during a cyber event, and our disaster recovery plan, that is designed to restore data and systems to their operational state. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly.


text: With respect to third-party service providers, we perform assessments of their information security capabilities prior to entering into a contractual agreement. We also perform periodic information security capabilities reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.


text: Refer to "A cyber-attack or failure of one or more key information technology systems, operational technology systems, networks, processes, associated sites or service providers could have a material adverse impact on our business and reputation" in Item 1A. "Risk Factors" for information regarding material risks from cybersecurity threats that affect us.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, customer's data, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701), SOC 2, PCI DSS and HIPAA for our corporate and cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.


text: Our assessment and management of material risks from cybersecurity and privacy threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. In addition, the information security team works with management to prioritize our risks that are more likely to have a material impact on our business and our CISO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the technology committee of the board of directors (the "technology committee") and the board of directors. In addition, the audit committee of the board of directors (the "audit committee") oversees our overall enterprise risk management program and receives semi-annual updates on cybersecurity and privacy threat-related risks as part of such program.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, among other things. cybersecurity consultants, cybersecurity software providers, penetration testing firms and other professional services firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and external attack surface scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.


text: For a description of the risks from cybersecurity threats that may have a material effect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or VP of Cybersecurity Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last eight years, has been a chief information security officer for nine years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the Chief Executive Officer, the Chief Financial Officer, the General Counsel, the CIO and other senior members of the Company. Such individuals work with our incident response team to help us assess, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the technology committee of the board of directors for certain cybersecurity incidents.


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our Enterprise Cybersecurity Services ("ECS") team, led by our Chief Information Security Officer ("CISO"), has first line responsibility for our cybersecurity risk management processes. T he ECS team works in partnership with other internal teams to coordinate efforts, priorities and oversight. These include: our Cybersecurity Executive Council (the "Council"), which is composed of key leaders from stakeholder groups throughout the Company, including the CISO and certain members of senior management;


text: our Enterprise Risk Management ("ERM") team, which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk, and advising senior management and the Board regarding our overall risk profile and priorities as they evolve;


text: our Internal Audit Department ("IAD"), which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment; and our Cyber Incident Response Team ("CIRT"), a cross-functional team of subject matter experts from across the Company and certain third-party support providers that we have on retainer.


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their security fitness against our risk posture and request changes as we deem necessary.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" included Governance


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.


text: Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader ERM program. Specifically, under its charter, the Audit Committee is responsible for overseeing our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations to address and resolve any breaches or issues related to the protection or privacy of our data. Management (including our Chief Information Officer ("CIO") and our CISO) reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel. The Audit Committee chair reports to the full Board on these risk discussions as appropriate. At least annually, the Board meets with members of our ERM team to review and discuss our ERM program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.


text: Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk register and oversees the security awareness program.


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has over 20 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.


text: As noted previously, our CISO is a member of the Council, which meets at least quarterly to provide operational direction to the ECS team considering the evolving risk landscape. The ECS team and the Council, through ongoing communication, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit Committee, as appropriate. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee.


text: Incyte is committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess and manage such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: INCYTE CORP

ticker: INCY


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify, manage and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments using the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We engage third party experts to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. These outside experts are utilized on a rotating basis to enable us to receive multiple viewpoints on the security of our technological resources. Additionally, from time to time, our internal audit function, reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on our vendors and other third party service providers in our clinical development activities as well as to manufacture and deliver our products, and a cybersecurity incident at a vendor or other third party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit and Finance Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit and Finance Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.


text: Incyte's Chief Information Security Officer (CISO) runs our cybersecurity program. Our CISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports in to our Chief Information Officer (CIO). Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit and Finance Committee or the Board of Directors on our cybersecurity program and our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.


text: We manage risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, through our overall enterprise risk management process, which is overseen by our Board. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Marriott's policies, procedures, and processes generally follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with key third-party service providers, hotel owners, and other companies with whom we do business.


text: With respect to incident response, we maintain a Global Information Security & Privacy Incident Response Plan ("IRP"), which applies to information security incidents involving properties owned, leased, or managed by Marriott, as well as our above-property business locations. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.


text: For properties that are not owned, leased, or managed by Marriott, the franchisees, licensees, or other applicable counterparties are generally responsible for information security at such properties and the systems and business processes related to information security that are under their direction and control. Franchisees and licensees are typically required to comply with Marriott brand standards relating to information security, which include an obligation to report relevant information security incidents to us.


text: In the 2024 fourth quarter, we reached final resolutions with the FTC and the AG Offices in relation to the Data Security Incident. The resolutions with the FTC and the AG Offices include various ongoing requirements relating to our data privacy and information security programs.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. However, there can be no assurance that we, our hotel owners, our third-party service providers, or other companies with whom we do business, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. See the discussion about the Starwood Data Security Incident under the "Litigation, Claims, and Government Investigations" caption in Note 7 to our financial statements, the discussion of the same in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations," and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors."


text: Our Board has established a Technology and Information Security Oversight Committee ("TISOC") to assist the Board in providing oversight of matters pertaining to technology, information security, and privacy, including risks from cybersecurity threats; management's efforts to monitor and mitigate those risks; and significant cybersecurity incidents. The TISOC meets at least four times per year and typically receives reports from our Chief Information Security Officer ("CISO") and other members of management about these matters. The Board's Audit Committee receives reports regarding information security and technology-related audits conducted by our internal audit department. Risks from cybersecurity threats are also discussed with the full Board as part of regular legal updates and management presentations, the Board's oversight of enterprise risk management, and periodic education sessions.


text: To establish, implement, and evaluate our risk management policies and practices with respect to cybersecurity threats, and to facilitate the communication of such matters to the Board, the TISOC, and the Audit Committee, as applicable, we have established a number of management committees, several of which include senior leaders and direct reports of the Company's President and CEO, that serve as our policymaking and management-level governing bodies with respect to our information security and data privacy programs; oversee the implementation of our information security and data privacy risk management strategy; and identify, consider, and escalate information security and data privacy issues that may arise in our business.


text: Our global information security team led by our CISO works in coordination with these management committees and other cross-functional teams and is principally responsible for overseeing our information security strategy, working collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents when they arise. Our information security program is operated on a 24/7 basis to address risks from cybersecurity threats and to respond to cybersecurity incidents globally.


text: Our CISO and other members of senior management responsible for our information security program have extensive experience assessing and managing risks from cybersecurity threats, including decades of experience in information technology and information security positions; serving in information technology leadership positions at other large public companies; and having other significant experience in the areas of risk management, information technology, and information security. Our CISO has more than 27 years of experience in information technology and/or information security, including more than 13 years in such positions in the hospitality industry.


text: We manage cybersecurity risk through three core teams: cybersecurity engineering, data privacy, and a security operation center. These teams are responsible for overseeing data safety during new system and infrastructure deployments, maintaining appropriate cybersecurity controls, and monitoring, documenting and investigating any anomalies affecting employees, suppliers, and customers. Our IT security controls are designed to align with the NIST (National Institute of Standards and Technology) standards and are tested on an ongoing basis. These controls and procedures include processes that oversee and identify cybersecurity risks associated with third-party service providers that we engage, as described below. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. To support our internal risk management structure, we use third-party specialists to monitor for emerging threats, conduct vulnerability scans and analysis including simulated hacker attacks, and audit our cybersecurity framework. We also maintain an information security risk insurance policy in the event of a security breach. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Leadership receives training on how to respond to ransomware events and participates in breach simulations at least once a year. Additionally, employees throughout the organization support LII's risk management efforts by participating in mandatory cybersecurity training at least once a year, ongoing awareness campaigns, and quarterly simulated phishing attempts.