text: Cybersecurity Risk Management and Strategy 8x8 maintains a global cybersecurity risk management program aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This program is integrated and embedded within the Company's overall enterprise risk management, or ERM, process and designed to proactively identify, assess, and manage cybersecurity threats that could materially affect our business operations, financial condition, or reputation.


text: Key components of the program include: • Continuous threat monitoring and intelligence, with real-time detection capabilities across cloud and on-premise environments. • Periodic risk assessments and threat modeling, covering internal assets and supply chain exposure. • Third-party penetration testing, security audits, and independent assessments conducted at least annually. • A vulnerability management lifecycle to identify, prioritize, and remediate security flaws in infrastructure and applications. • Employee cybersecurity training and phishing simulations, tailored by role and location.

companyName: 8X8 INC /DE/

ticker: EGHT

secItem: Item 1C


text: 8x8 engages reputable external security firms and consultants to support ongoing evaluations, and has obtained certifications and attestations across various jurisdictions and industries (including ISO/IEC 27001, CyberEssentials Plus et al, and compliance with frameworks applicable to communications and cloud service providers).


text: To date, the Company has not experienced any cybersecurity incidents that have materially impacted its operations or financial condition. Nevertheless, cybersecurity threats continue to evolve, and the Company has developed and implemented a comprehensive Incident Response Plan to effectively manage cybersecurity incidents. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.


text: The Company's board of directors, through its Technology & Cybersecurity Committee, oversees 8x8's cybersecurity risk management strategy. This committee meets quarterly and receives briefings from senior leadership on cybersecurity risk trends, controls testing and efficacy, compliance posture, and incident management preparedness. The full board of directors is informed at least annually on cybersecurity matters, with additional updates as needed.


text: The Company's Chief Information Security Officer, or CISO, leads the cybersecurity program and reports functionally to the Chief Legal Officer, and periodically to the CEO, the Executive Risk Management Committee, and the board of directors. The CISO has over 25 years of global cybersecurity, information security, disaster recovery, and business continuity experience, including leadership roles across UK national infrastructure and global Fortune 100 and 500 companies. The CISO holds an M.S. in Information Technology Security (with distinction), and is a Certified Information Security Manager, or CISM, and Certified Information Systems Security Professional, or CISSP.


text: While the board of directors has not formally designated a cybersecurity expert under SEC regulations, the Technology & Cybersecurity Committee includes directors with backgrounds in technology, data governance, and risk oversight, and all directors participate in training sessions to continue to enhance their understanding of cybersecurity issues and their implications for the Company.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continuously assess and strategically invest to improve the resiliency of our information security systems in a dynamic cybersecurity landscape. Our assurance practices are based on internationally recognized standards as implemented by our Global Information Security Team, which is responsible for managing our Security Operations Center. Our cybersecurity risk management program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with our third-party service providers and vendors. We engage internal and external assessors, consultants, auditors, and other third-party experts, to identify opportunities for improvements to our cybersecurity risk management program.

companyName: COTY INC.

ticker: COTY


text: The Global Information Security Team has implemented processes to manage and report various security threats, including escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to our Cybersecurity Special Committee, Audit and Finance Committee ("AFC") and Board of Directors. We conduct cybersecurity incident simulations on a regular basis, including involvement of the Cybersecurity Special Committee, along with various tabletop exercises designed to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: Cybersecurity training and safety are fundamental pillars to our overarching global information security strategy. The Global Information Security Team periodically shares security tips and best practices for all employees to raise awareness around digital security and routinely conducts phishing simulations and testing scenarios to complement required employee trainings on cybersecurity fundamentals, awareness, common threats and data loss prevention.


text: As of the date of this report, we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We may face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. See "Risk factors related to our information technology and cybersecurity systems" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. Our Board of Directors has delegated to the AFC oversight responsibility for cybersecurity and data privacy, including periodically evaluating the Company's cybersecurity and privacy programs and receiving information on cybersecurity and privacy compliance. The chair of the AFC reports to the full Board of Directors following its regularly scheduled meetings.


text: Our Board of Directors also has a dedicated Cybersecurity Special Committee that is empowered to manage the Company's response to major cybersecurity incidents and enable the integration of crisis management and business continuity processes. The Cybersecurity Special Committee, led by our Chief Information and Business Services Officer and two Board members (including the Chair of the AFC), consists of executive members from various corporate functions, including information technology, digital operations, corporate affairs, legal, compliance, human resources and finance. Outside cybersecurity experts periodically present to the Board on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: At the management level, our Global Information Security Team monitors alerts and informs relevant global senior management of all incidents and related mitigation and remediation, and escalates to the Cybersecurity Special Committee as needed. Global senior management monitors initiatives to prevent, detect, mitigate, and remediate cybersecurity risks and incidents.


text: Our Board of Directors also has a dedicated Cybersecurity Special Committee that is empowered to manage the Company's response to major cybersecurity incidents and enable the integration of crisis management and business continuity processes. The Cybersecurity Special Committee, led by our Chief Information, Digital Innovation and Business Services Officer and two Board members (including the Chair of the AFC), consists of executive members from various corporate functions, including information technology, digital operations, corporate affairs, legal, compliance, human resources and finance. Outside cybersecurity experts periodically present to the Board on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks.

companyName: W. P. Carey Inc.

ticker: WPC


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape, effective Board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: As part of the Board's oversight of risk management, the Board reviews our cyber-risks with management and the actions we are taking to mitigate such risks. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees. Board oversight of risk is also performed as needed between meetings through the Audit Committee and communications between management and the Board. The Board receives periodic education around cybersecurity risks and best practices.


text: Additionally, the Audit Committee, which consists solely of independent directors, is responsible for overseeing cybersecurity risks and related initiatives. The Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.


text: Our information technology team is led by our Chief Information Officer who has extensive experience working with information security systems. Our information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with senior management, our cybersecurity governance committee, the Audit Committee and the Board. Our cybersecurity governance committee, comprised of our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of our information technology team are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents and (3) containing, eradicating, recovering from and reporting cybersecurity events.


text: Prevention and Preparation We employ a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.


text: Our information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program. For example, in January 2023, our information technology team held a tabletop exercise with senior management to consider different cybersecurity scenarios. Our information technology team also recently worked with various third-party consultants to update our incident response plan.


text: In addition, our information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our service delivery program to ensure they have an established cybersecurity program. We have also engaged our managed security provider to manage a supply chain defense subscription that will help obtain clear visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the appropriate business partners thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our managed cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible, consistent with the procedures in the incident response plan. Containment procedures may include shutting down systems; disconnecting systems from a network, disabling specific ports, protocols, services, functions, etc., disabling access to compromised systems; examining code in a controlled environment and making forensic backups of affected systems for possible legal action for third party forensic analysis.


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state, confirming that the affected systems are functioning normally and implementing, as necessary, additional monitoring to look for future related activity.


text: We have relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.


text: In the event of a cybersecurity incident, we intend to follow the steps outlined in our incident response plan, including notifying our senior management, as appropriate.


text: Following the conclusion of an incident, we, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and our Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams. For a discussion of these risks, see Item 1A. Risk Factors — The occurrence of cyber incidents, or a deficiency in our cyber security, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of employee training programs, multiple resources to manage and monitor the evolving threat landscape, Board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: As part of the Board's oversight of risk management, the Board reviews our cyber-risks with management and the actions we are taking to mitigate such risks. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees. Board oversight of risk is also performed between meetings through the Audit Committee and communications between management and the Board. The Board receives periodic education around cybersecurity risks and best practices.


text: W. P. Carey 2024 10-K – 20 Additionally, the Audit Committee, which consists solely of independent directors, is responsible for overseeing cybersecurity risks and related initiatives. The Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.


text: Our information technology team is led by our Chief Information Officer who reports to our Chief Financial Officer and has extensive experience working with information security systems. Our information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with senior management, our cybersecurity governance committee, the Audit Committee and the Board. Our cybersecurity governance committee, comprised of our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of our information technology team are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies.


text: Our information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.


text: In addition, our information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for employees and our Board to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our service delivery program to ensure they have an established cybersecurity program. We have also engaged our managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our managed cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is responsible for containing the cybersecurity incident, consistent with the procedures in the incident response plan.


text: W. P. Carey 2024 10-K – 21 Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.


text: In the event of a cybersecurity incident, the incident response team is responsible for following the steps outlined in our incident response plan, including notifying our senior management, as appropriate.


text: Following the conclusion of an incident, we, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and incident response plan, identify potential adjustments as appropriate and report to our senior management and our Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A. Risk Factors — The occurrence of cyber incidents, or a deficiency in our cyber security, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: KILROY REALTY CORP

ticker: KRC


text: Our overall cybersecurity program includes, amongst other things: • security tools, technologies and processes, control reviews, policy reviews, penetration tests and investments in our security infrastructure; • cybersecurity awareness training exercises for our employees, including phishing simulations to raise awareness of spoofed or manipulated electronic communications and other critical security threats; • annual review of System and Organization ("SOC") reports for our core third-party providers based on our assessment of their respective criticality and risk profile; and • a Cybersecurity Incident Response Plan that provides a framework and guidelines for responding to cybersecurity incidents that may compromise the confidentiality, integrity and availability of our critical systems and information.


text: Our Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee receives periodic reports from management on our cybersecurity risks.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See "Risk Factors – We face risks associated with perceived or actual security breaches through cyberattacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems or those of our critical service providers."


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity risk oversight. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President, Chief Administrative Officer, Senior Vice President, Corporate Counsel and Vice President, Enterprise Applications as part of the Board's continuing education.


text: Our cybersecurity risk management team - including our Executive Vice President, Chief Administrative Officer, Senior Vice President, Chief Accounting Officer and Controller, Senior Vice President, Corporate Counsel and Senior Vice President, Information Technology - is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel, our retained external cybersecurity consultants, and the simulated exercises of our Cybersecurity Incident Response Plan, conducted at least annually to ensure our team is prepared to respond to any future cybersecurity incidents. The team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel, publicly available information about cybersecurity risks and threats and through alerts from security tools deployed in our IT environment.


text: Our Vice President, Enterprise Application's experience includes a Certified Information Systems Security Professional ("CISSP") certification, which is designed for security professionals with extensive knowledge in contemporary cybersecurity and information security practices. In addition, our Chief Executive Officer has broad expertise in overseeing cybersecurity programs, incident response teams and information technology departments.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our overall cybersecurity program includes, amongst other things: • security tools, technologies and processes, control reviews, policy reviews, penetration tests, and investments in our security infrastructure; • cybersecurity awareness training exercises for our employees, including phishing simulations to raise awareness of spoofed or manipulated electronic communications, and other critical security threats; • annual review of System and Organization ("SOC") reports for our core third-party providers based on our assessment of their respective criticality and risk profile; and • a Cybersecurity Incident Response Plan that provides a framework and guidelines for responding to cybersecurity incidents that may compromise the confidentiality, integrity, and availability of our critical systems and information.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with perceived or actual security breaches through cyberattacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems or those of our critical service providers."


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity risk oversight. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President, Chief Administrative Officer, Executive Vice President, General Counsel and Secretary, and Vice President, Enterprise Applications as part of the Board's continuing education.


text: Our cybersecurity risk management team - including our Executive Vice President, Chief Financial Officer and Treasurer, Executive Vice President, Chief Administrative Officer, Executive Vice President, General Counsel and Secretary, Senior Vice President, Chief Accounting Officer and Controller, Senior Vice President, Information Technology, and the Vice President, Enterprise Applications - is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel, our retained external cybersecurity consultants, and the simulated tabletop exercises of our Cybersecurity Incident Response Plan, conducted at least annually to ensure our team is prepared to respond to any future cybersecurity incidents. The team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel, publicly available information about cybersecurity risks and threats, and through alerts from security tools deployed in our IT environment.


text: Our Vice President, Enterprise Application's experience includes a Certified Information Systems Security Professional ("CISSP") certification, which is designed for security professionals with extensive knowledge in contemporary cybersecurity and information security practices. In addition, our Chief Executive Officer has broad expertise in overseeing cybersecurity programs, incident response teams, and information technology departments.


text: The Company maintains a cyber risk management program designed to assess, identify, manage, mitigate, and respond to cybersecurity threats and incidents. The cyber risk management program is integrated into the Company's overall enterprise risk management ("ERM") program. The ERM program is designed to provide cross-functional board and executive insight across the business to identify and monitor risks, opportunities and emerging trends that can impact the Company's strategic business objectives.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: The Company also maintains several processes intended to safeguard our information systems, protect the integrity of our data and respond to cybersecurity incidents. These processes include a formal information security training program for all employees, training on matters such as phishing and email security best practices, annual disaster recovery exercises, targeted access controls, and multi-factor authentication logins. The Company maintains a cybersecurity incident response process to help ensure a timely and consistent response to actual or attempted cybersecurity incidents impacting the Company.


text: The Company engages third-party service providers to aid in monitoring and safeguarding critical assets from cybersecurity attacks. Through these partnerships, the Company leverages specialized knowledge, insights, and practices to enhance the effectiveness of its cybersecurity strategies. Key third-party services include 24/7 active and passive monitoring and mitigation of the Company's network, endpoints, and data. Additionally, the Company has contractual obligations in place with third-party service providers to adhere to specific information security standards and to promptly notify and collaborate with management in the event of qualifying cybersecurity incidents.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, due to the evolving nature of cyber threats and their increased sophistication, there remains the potential for adverse impacts on the Company should a cybersecurity incident occur. These impacts could include reputational damage, competitive harm, operational disruptions, financial costs, and regulatory actions. Please refer to the risk factor titled "Cybersecurity attacks may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance." See Part I, Item 1A for further information regarding cybersecurity risks and potential impacts on our business and results of operations.


text: Management's responsibility The Company's senior executive team, which includes our Director of Information Systems, is responsible for providing input and oversight of our ERM program, including assessing and managing our material risks from cybersecurity threats. The senior executive team is informed about and oversees the prevention, detection, mitigation, and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes. The senior executive team provides an in-depth annual report and quarterly updates on our enterprise risks, including cybersecurity risks, to present to the full Board.


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board maintains principal oversight responsibility for our enterprise risk management, including cybersecurity. The Board has responsibility for, among other things, oversight of the Company's information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats and the steps management has taken to monitor and mitigate such risks. The Board reviews and discusses with management, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks and to remediate the effects of any cybersecurity incidents that may occur.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, due to the evolving nature of cyber threats and their increased sophistication, there remains the potential for adverse impacts on the Company should a cybersecurity incident occur. These impacts could include reputational damage, competitive harm, operational disruptions, financial costs, and regulatory actions. Please refer to the risk factor titled "Cybersecurity incidents may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance." See Part I, Item 1A for further information regarding cybersecurity risks and potential impacts on our business and results of operations.


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board maintains principal oversight responsibility for our enterprise risk management, including cybersecurity. The Board has responsibility for, among other things, oversight of the Company's information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats and the steps management has taken to monitor and mitigate such risks. The Board reviews and discusses with management, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures; • the assessment of risks and threats to our information technology systems; • the internal controls regarding information technology security and cybersecurity; and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks and to remediate the effects of any cybersecurity incidents that may occur.


text: Information security is essential to our mission and our institutional strategic goals. Under the leadership of our Chief Information Security Officer ("CISO"), we have developed and implemented a comprehensive risk-based information security program that meets regulatory requirements and encompasses a cybersecurity program that is based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This framework enables identifying and evaluating cybersecurity risks, enabling risk management decisions, and responding to emerging threats. The Information Security Program and all applicable cybersecurity policies, processes, and controls apply to all of our operations and all of our employees.

companyName: PACIFIC PREMIER BANCORP INC


text: Our cybersecurity risk management strategy employs an in-depth, layered, and defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. As such, our cybersecurity risk management program includes but is not limited to regular employee cybersecurity training and communications; the use of preventative, detective, alerting, and defensive in-depth technologies; internal and third-party program oversight; policies and procedures regularly reviewed and designed with regulatory and industry guidance; an incident response plan to respond to cybersecurity incidents; and a threat intelligence program designed to assess the latest changes to the threat landscape. In addition, cybersecurity policies, procedures, and controls have been developed and implemented to protect against unauthorized access to consumer and customer information and to safeguard the information that is exchanged with third parties in accordance with applicable laws and regulations.


text: Integration with Overall Risk Management. Cybersecurity is a major component of our overall risk management approach. The Company's cybersecurity risk management program is integrated into our overall enterprise risk management processes. This integration helps ensure that cybersecurity considerations are an integral part of our decision-making processes across the organization. Our risk management team works closely with our Information Security and Information Technology departments to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We continually evaluate cybersecurity risks as part of our overall risk management strategy. Cybersecurity risks are assessed, identified, and managed through various ongoing and scheduled processes, technologies, and techniques, including, but not limited to periodic IT Risk Assessments, vulnerability scanning, penetration testing, employee cybersecurity awareness testing, and threat intelligence analysis. The Company receives cybersecurity alerts and threat intelligence from Open Source Intelligence ("OSINT") threat intelligence feeds, the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), and government agencies, among other sources. The Company also continuously monitors its systems and networks. Management regularly reviews the evaluation of risks through these and other methods to mitigate risks and allocate resources in alignment with the overall risk management strategy.


text: We conduct regular cybersecurity education through a security awareness, training, and education program. All employees are required to participate in interactive training at least annually on information security and data privacy. As part of this training program, security campaigns are launched to test the effectiveness of the training provided, and all employees receive periodic security bulletins and updates on a periodic and as-needed basis.


text: We have created and regularly update our Incident Response Plan, which guides our response to a cybersecurity incident and outlines processes for forensic analysis, crisis communications, and required notifications. Disclosure of significant cybersecurity incidents are reported promptly to senior leadership and the Board of Directors. We test our Incident Response Plan through tabletop exercises. The Bank also maintains a business continuity program that addresses crisis management, business impact, and data and systems recovery.


text: Engagement of Third Parties in Connection with Cybersecurity Processes. We regularly engage various third parties to assess, test, or assist with the implementation of our cybersecurity processes. We engage independent third parties to conduct risk assessments, penetration tests, vulnerability scans, and tabletop exercises. Although our internal audit department is responsible for auditing our cybersecurity programs, we also engage an independent, external firm with expertise in information security to conduct annual audits of our cybersecurity program.


text: Third Party Risk Management. We maintain a process to identify and evaluate cybersecurity risks and incidents related to key third-party service providers. We assess key third-party service providers' information security controls through an established due diligence process. We also require contracts with such service providers to maintain certain security controls to safeguard our data, and to notify the Company of cybersecurity incidents experienced by the service providers that affect our data.


text: The Board of Directors maintains oversight responsibility over the enterprise risk management program, including risks related to cybersecurity threats and incidents, and approves the information security program. The Enterprise Risk Committee of the Board of Directors assists the Board in evaluating enterprise risks and performing the Board's oversight responsibilities. As part of our integrated enterprise risk management process, cybersecurity risks and key metrics are evaluated by the Enterprise Risk Committee and reported to the full Board quarterly. In addition, the Enterprise Risk Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks and the overall risk management strategy. Our CISO, in coordination with our Chief Information Officer ("CIO") and Chief Risk Officer ("CRO"), briefs the Enterprise Risk Committee on a quarterly basis, concerning cybersecurity risks, the effectiveness of our cybersecurity risk management efforts, and updates and changes to our cybersecurity risk management program. In addition, the CISO and/or other members of senior management brief the entire Board concerning the cybersecurity risk management program on a semiannual basis and as requested.


text: The CISO is responsible for assessing, implementing, and monitoring our Information Security Program and cybersecurity controls, and works closely with the CIO and the CRO in managing our Information Security Program. Our CISO is a Certified Information Security System Professional with over 20 years of technical and cybersecurity leadership experience, including with large financial services companies. The CISO maintains a dedicated cybersecurity staff comprised of certified security professionals with expertise in various disciplines including threat detection, governance risk and compliance, security architecture and engineering, incident response, and third-party risks. Our CISO regularly updates our management-level Enterprise Risk Management Committee concerning cybersecurity risks and the effectiveness of our risk management efforts. The Enterprise Risk Management Committee is composed of members of executive management.


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. From time to time, we also experience or are subject to a variety of cybersecurity incidents in the ordinary course of business that do not have a material adverse effect on the Company, including a previously disclosed July 2023 cybersecurity incident experienced by one of our third-party vendors related to an unknown (i.e., zero-day) vulnerability in a popular file sharing software that the vendor used called MOVEit Transfer. As of the date of this report, we have not experienced any material cybersecurity incidents to our knowledge, and we know of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, please see Item 1A. Risk Factors.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, along with personal data and other sensitive information, including our trade secrets, data we may collect about trial participants in connection with clinical trials, and other sensitive data ("Information Systems and Data").

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our Senior Director of IT Infrastructure & Security also functions as our information security officer ("ISO"). The ISO (as part of our security function), along with our management committee and broader internal cybersecurity, IT infrastructure, and digital technology automation functions, as well as third-party service providers, all help identify, assess and manage our cybersecurity threats and risks. Our security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, responding to proactive outreach from CISA and FBI, internal and/or external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to help manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a corporate security incident response plan, a vulnerability management policy, a vendor risk management program, incident detection and response processes, IT systems disaster recovery procedures, risk assessments, reasonable implementation of security controls in accordance with applicable security standards/certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer. We also rely on third-party vendor backup/restore, disaster recovery and business continuity procedures as stated in the respective SOC 1 and SOC 2 reports if provided by such vendors as they pertain to certain of our managed services.


text: Our procedures for assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is evaluated as a component of our broader enterprise risk management program, identified in our risk register and monitored and managed more specifically by our Corporate Security Incident Response Team (CSIRT); (2) the security function works with the CSIRT to help prioritize our risk management processes and help mitigate cybersecurity threats that we believe are more likely to lead to a possible material impact to our business; (3) our ISO evaluates material risks identified from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors (the "Audit Committee"), which reviews and discusses with senior management our overall risk assessment and management.


text: We use third-party managed service providers to assist us in identifying, assessing, mitigating and managing potential risks from cybersecurity threats. In addition, we engage other advisors from time to time to help identify, assess, mitigate and manage new or developing risks in a changing threat landscape. Such ongoing services and periodic services include professional services from providers such as legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, and forensic investigators (as needed).


text: We use third-party service providers to perform a variety of functions throughout our business, such as application service providers, software-as-a-service providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources. We have a vendor risk management program to help manage cybersecurity risks associated with our use of these providers. This includes risk assessment for each vendor, review of security assessments, supplemental security questionnaires (as needed), security assessment calls with the vendor's security personnel, and imposition of certain information contractual obligations on the vendor. In addition, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing and discussing with management our cybersecurity risk assessment and management processes, including our oversight and the steps we take to monitor and help control risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our ISO, who has over 20 years of experience in information security. Our ISO oversees a global team of information security professionals consisting of multiple full time equivalent employees in multiple countries.


text: Our ISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our ISO (in coordination with our CSIRT) is also responsible for other functions, including preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our CSIRT reviews, approves and prioritizes information security and cybersecurity policies, projects and initiatives. Executive management is responsible for prioritizing initiatives and approving budgets to allocate funding for the foregoing based on feedback from the ISO, the CSIRT and the Audit Committee.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our ISO. The ISO works with our CSIRT to help us mitigate and remediate cybersecurity threats or incidents of which they are notified. The ISO is responsible for designing and promoting general security awareness and training, as well as defining and training relevant participants on our incident response processes. Our security and incident response processes include escalation and reporting to the CSIRT, Disclosure and Risk Committee, senior management and Audit Committee for certain information security incidents, as warranted under the circumstances.


text: The Audit Committee receives periodic reports from the ISO concerning our significant cybersecurity threats and risk, and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries of reports or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management Strategy OFG has a comprehensive framework in place to assess, identify and manage material risks from cybersecurity threats. Our Information Security Officer ("ISO") is responsible for overseeing and implementing the Company's cybersecurity risk management framework as part of our broader Information Security Program approved by the Board. Our cybersecurity risk management framework is integrated into the Company's broader risk management system with a focus on monitoring key risk indicators within a defined risk tolerance set by our Board.

companyName: OFG BANCORP

ticker: OFG


text: Our cybersecurity risk management framework is focused on the following key areas: • Regular cybersecurity risk assessments; • Design and implementation of controls to mitigate any identified cybersecurity risks; • Continuous evaluation of the effectiveness of such controls; and • Implementation of an incident response plan that includes procedures for responding to cybersecurity incidents.


text: In addition, our cybersecurity risk management framework incorporates three lines of defense, each with defined roles and responsibilities. OFG conducts an annual cybersecurity maturity assessment to (a) evaluate its cybersecurity risk management practices and (b) develop action plans for improving its cybersecurity risk management program.


text: The cybersecurity risk management framework also establishes standards or controls for the design of our cybersecurity infrastructure, including with respect to monitoring and preventing cybersecurity incidents, authenticating the identity of persons authorized to access critical information resources, and assessing safeguards that must be implemented by our external vendors and service providers.


text: OFG uses external consultants and other third-party service providers to monitor our information systems for any cyberattacks, impersonators or unauthorized releases of sensitive customer data, as well as performing investigations and penetration testing, identifying system vulnerabilities and required software patches, monitoring and managing firewalls, and advising on systems and cloud architecture. OFG also conducts due diligence of third-party software and related services and reviews cybersecurity reports from technology services providers to ensure that our cybersecurity infrastructure can respond to evolving cybersecurity risks relevant to our business. Pursuant to our cybersecurity risk management framework, our Information Security team develops an annual information security awareness plan to educate employees as to the Company's standards, processes and practices with respect to information security, potential cybersecurity threats and proper use of information security resources entrusted to them, with the goal of minimizing possible employee security risks. Our Information Security team engages third-party consultants to assist us in the evaluation of our cybersecurity risk management practices to identify risks, perform social engineering exercises, and provide annual cybersecurity training.


text: Our Board is responsible for overseeing OFG's cybersecurity efforts and approving the Information Security Program, which sets forth OFG's policy regarding the confidentiality, integrity and availability of its information assets. The Board's Risk and Compliance Committee more directly oversees the implementation of the Information Security Program and receives quarterly reports on any cybersecurity risks.


text: Our ISO, under the supervision of the Chief Risk Officer, leads the development and implementation of the Information Security Program. In addition, our Information Technology Department ("IT") also has a dedicated cybersecurity team under the supervision of our Chief Information Officer. Members of our Information Security and IT cybersecurity teams have over 50 years of combined experience in information technology systems and cybersecurity risk management and include a team member that has a ISACA Certified Information Systems Auditor certification and two team members each with a master's degree in cybersecurity.


text: Our ISO provides quarterly reports to our Executive Risk and Compliance Team, which is comprised of several executive officers of OFG. In addition, our Chief Risk Officer reports to the Board's Risk and Compliance Committee and, when necessary, the Board.


text: Any identified cybersecurity incidents must be reported to the ISO and the mitigation and remediation thereof is performed by the Incident Response Team, which is led by the ISO and composed of key executives, with identified call trees and key service providers to support the coordination of a rapid response.


text: In the last three fiscal years, OFG has not experienced any material cybersecurity incidents, and expenses incurred from any cybersecurity incidents were immaterial. For more information on the risks to the Company of future cybersecurity threats or incidents, see "Item 1A, Risk Factors — Operations and Business Risks."


text: Cybersecurity Risk Management Strategy OFG has a comprehensive framework in place to assess, identify and manage material risks from cybersecurity threats. Our Information Security Officer ("ISO") is responsible for overseeing and implementing OFG's cybersecurity risk management framework as part of our broader Information Security Program approved by our Board. Our cybersecurity risk management framework is integrated into OFG's broader risk management system with a focus on monitoring key risk indicators within a defined risk tolerance set by our Board.


text: OFG uses external consultants and other third-party service providers to monitor our information systems for any cyberattacks, impersonators or unauthorized releases of sensitive customer data, as well as performing investigations and penetration testing, identifying system vulnerabilities and required software patches, monitoring and managing firewalls, and advising on systems and cloud architecture. OFG also conducts due diligence of third-party software and related services and reviews cybersecurity reports from technology services providers to ensure that our cybersecurity infrastructure can respond to evolving cybersecurity risks relevant to our business. Pursuant to our cybersecurity risk management framework, our Information Security team develops an annual information security awareness plan to educate employees as to OFG's standards, processes and practices with respect to information security, potential cybersecurity threats and proper use of information security resources entrusted to them, with the goal of minimizing possible employee security risks. Our Information Security team engages third-party consultants to assist us in the evaluation of our cybersecurity risk management practices to identify risks, perform social engineering exercises, and provide annual cybersecurity training.


text: Our ISO, under the supervision of our Chief Risk Officer, leads the development and implementation of the Information Security Program. In addition, our Information Technology Department ("IT") also has a dedicated cybersecurity team under the supervision of our Chief Information Officer. Members of our Information Security and IT cybersecurity teams have over 50 years of combined experience in information technology systems and cybersecurity risk management and include a team member that has a ISACA Certified Information Systems Auditor certification and two team members each with a master's degree in cybersecurity.


text: We prioritize the effective management of cybersecurity risks through a strategy focused on identifying, assessing, and responding to cybersecurity vulnerabilities, threats and incidents. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents.

companyName: CELESTICA INC

ticker: CLS


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee (described under "Governance" below). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats, including technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy include the following:


text: Multidisciplinary Coordination: Our IT Security Team, which includes IT Site Managers, an IT Risk & Compliance Team, a Global Information Security Team and Cybersecurity Incident Managers, has first-line responsibility for our cybersecurity risk management processes, and is responsible for implementing cybersecurity policies, procedures and strategies. This team is led by our Vice President, Security, Infrastructure & Site IT (VP Security), who reports to our Chief Information Officer (CIO), who in turn reports to our Chief Operations Officer (COO). The IT Security Team is subject to oversight from several cross-functional teams, including our Executive Leadership Team, our IT Security Council and our Compliance Council. Our IT Security Council, a global IT security strategy team, meets monthly to discuss IT security roadmaps and strategies, control enhancements, compliance matters and customer requirements. Our Compliance Council includes representatives from, among others, our legal, compliance, ethics, internal audit, operations, security, and supply chain teams to assess the Company's risk exposures, mitigation strategies and policies, and meets quarterly to discuss risks, policies and compliance issues, including with respect to cybersecurity.


text: Internal Audit: Our Internal Audit department performs audits, and our IT Risk and Compliance Team, which reports to the VP Security, monitors certain IT systems controls that are integrated into our larger internal control environment.


text: Cyber Incident Response: We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols, which is evaluated and tested on a regular basis. The Company has a process for employees to report suspected or confirmed cybersecurity threats or incidents. Generally, if a suspected or confirmed breach is identified, a Cybersecurity Incident Manager from the Global Information Security Team is assigned to evaluate and escalate the issue as needed to the VP Security. The Company's response to cybersecurity incidents (which includes prompt steps to protect our systems and information by containing and mitigating the impact of any incident) is managed by the VP Security, in consultation with the CIO, and when appropriate, with the CFO, COO, CEO and our Chief Legal Officer. These leaders will assess the materiality of a particular incident (alone or in combination with other factors), and the Chief Legal Officer will determine whether any reporting or notification responsibilities have been triggered. The CEO is responsible for informing our Board and the Audit Committee regarding any significant incidents, and coordinates management's recommendations concerning materiality.


text: Continuous Evaluation: We update our information security management system periodically and employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks.


text: We provide cybersecurity and information security compliance training for our employees once per year, track completion, and require attestations. We conduct monthly mock phishing attacks to all employees, and cater training specifically to our needs, based on industry trends and potential threats. Select members of our IT Security Team participate in security training focusing on emergency preparedness and remediation, including annual table top exercises to test our security protocols and response times.


text: Outside Consultants: Third party experts are engaged to conduct National Institute of Standards and Technology (NIST) CSF (Cyber Security Framework) Audits to measure the Company's cybersecurity maturity level, in addition assistance with our cybersecurity risk management and strategy. Other third-party providers provide us with ongoing assistance including threat monitoring, mitigation strategies, and updates on emerging security trends and developments while we have others engaged on retainer to provide targeted assistance forensic expertise as needed.


text: In 2023, we implemented a Third-Party Risk Management Program to perform IT security controls assessments for our third-party suppliers and vendors and measure the IT security rating of Celestica and these entities through an external security rating solution platform. Through this program, our IT Risk and Compliance team assesses, monitors, and mitigates potential cybersecurity risks from our third-party suppliers and vendors. In addition, an external service is used to assess the cybersecurity risk rating of third party suppliers and vendors.


text: Certain of our manufacturing sites are certified to ISO 27001 (an international standard focused on information security), and we continue to perform assessments of our A&D sites and systems that support A&D data under U.S. NIST 800-171 Enhanced Cybersecurity Measures for Government Contractors.


text: While we have invested, and continue to invest, in the protection of our data and IT infrastructure, we regularly face attempts by others to access our information systems in an unauthorized manner, to introduce malicious software to such systems or both, and while we have not been materially impacted by computer viruses, malware, ransomware, hacking incidents, outages, or unauthorized access to data, we have been (and may in the future be) the target of such events. However, to date, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see Item 1A, Risk Factors — "Our operations and our customer relationships may be adversely and materially affected by disruptions to our IT systems, including disruptions from cybersecurity breaches of our IT infrastructure" in this Annual Report.


text: As part of its oversight responsibilities, which include the identification of the principal risks of the business and ensuring the implementation of appropriate systems to manage such risks, the Board devotes significant time and attention to information security and risk management, including cybersecurity, and regulatory compliance, supported by the Audit Committee.


text: The Audit Committee is responsible for evaluating Celestica's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's Mandate also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from management, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats.


text: In addition, in accordance with its Mandate, the Board receives a quarterly report from management regarding the principal risks inherent in the business of the Corporation, including appropriate crisis preparedness, business continuity, information system controls, cybersecurity and information security, and disaster recovery plans. These reports address a range of topics, including industry trends, benchmark and assessment reports, information security projects and updates on cyber related metrics, technology modernization, policies and practices, and specific and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our IT Security Team is composed of several support teams (including our IT Site Managers, our Cybersecurity Incident Managers, our Global Information Security Team, and our IT Risk and Compliance Team) that address and respond to cybersecurity risks and incidents, including risks related to security architecture and engineering, identity and access management and security operations. As noted above, our IT Security Team is led by our VP Security, who has 15 years of experience in leading global security and compliance functions and strategies and holds several certifications including Certified Information Systems Security Professional (CISSP), Information Systems Security Management Professional (ISSMP), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CIO has 20 years of experience in leading security, compliance and digital forensics functions. Collectively, the other members of our IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. In addition, we invest in regular, ongoing cybersecurity training for our IT Security Team. Risks are updated by management each quarter, based on findings from external assessments and internal cybersecurity metrics.


text: Management (including our VP of Internal Audit) reports quarterly to the Audit Committee on information security. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel.


text: Management takes several steps intended to mitigate the impact of cybersecurity and information security risks and incidents, including an annual management risk assessment (including cybersecurity risk), continued enhancement of information security and data loss prevention controls, maintenance of a robust crisis response plan, engaging an external consultant (described above), and ensuring that the Company maintains cybersecurity insurance coverage deemed appropriate. Management oversight procedures include: (i) a methodology to ensure cybersecurity events are promptly escalated and that appropriate internal and external reporting occurs; (ii) a monthly Information Security Governance Council meeting with site IT managers; and (iii) quarterly meetings between senior executives and our Internal Audit department to discuss the outlook for the following year, focusing on the current risk environment.


text: In the ordinary course of business, our information systems on which we run our business operations and store confidential or proprietary data, such as PII about our customers and our employees, are subject to potential cyber-attack. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology ("IT") systems. We have implemented security measures that are designed to detect and protect against cyberattacks. In particular, we seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment:

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments and testing of our cybersecurity safeguards are conducted by independent third-party cybersecurity experts. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks. We use a variety of layered applications to alert us to suspicious activity.


text: A security information and event management process ("SIEM") has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan within our SIEM that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct annual reviews of our cyber incident response plan.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees who access our systems are required to undergo annual cybersecurity training and, each year, employees are required to test their understanding of our cybersecurity policies. Further, our employees that handle personally identifiable information are required to undergo training, including phishing exercises and awareness programs on the appropriate management, use and protection of that information.


text: We have endeavored to implement physical access controls to prevent access to endpoints that may leave Company data vulnerable to attack. We have also sought to implement systems to prevent encrypted information from bypassing certain Company-defined information control mechanisms and have also sought to purge or wipe information from certain Company-defined endpoints after consecutive, unsuccessful logon attempts or other indicators of unauthorized access.


text: Finally, we have implemented encrypted virtual private networks in an effort to enhance the integrity of remote connections and have endeavored to protect wireless access points to our systems using authentication of users and/or devices. Segmented networks and user access controls are used to limit unauthorized access to sensitive information and systems. Employees are required to use multi factor authentication and regularly update their passwords.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have a program in place to monitor our retained data by identifying PII and ensuring it is not stored outside of approved locations and systems. We have endeavored to use strong, up-to-date encryption algorithms and to regularly update and patch systems in an effort to guard against vulnerabilities. Similarly, we have sought to manage encryption keys with use of a secure key management system and rotation of keys after use. We have implemented secure protocols, including, e.g., HTTPS for web traffic and SFTP for file transfers.


text: Processes designed to monitor for cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access. These services are designed to monitor for both internal and external threats.


text: Finally, we have implemented encrypted virtual private networks for remote connections. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered as an important component of our enterprise-wide risk management approach.


text: As of the date of this Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Processes designed to monitor for cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access, extraction, and deletion of certain sensitive data, large quantities of data, and other anomalous network traffic. These services are designed to monitor for both internal and external threats. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Board of Directors oversees risks from cybersecurity threats. The Board of Directors delegates oversight of our operations risk, including quarterly reviews of cybersecurity and data protection, to the Finance/Risk Management Committee, and delegates compliance with cybersecurity policies to the Audit Committee. Both the Finance/Risk Management Committee and the Audit Committee report to the full Board of Directors on cybersecurity matters. Additionally, on an annual basis, management reviews results from tests of key cybersecurity systems with the full Board of Directors and the steps taken to mitigate new cybersecurity risks which have been identified.


text: The Finance/Risk Management Committee oversees the formal process to identify risks company-wide, allocate them to the appropriate committee of the Board of Directors, and ensure that risk mitigation activities are being followed. At each of its meetings, the Finance/Risk Management Committee receives presentations from our Chief Information Officer (the "CIO") on cybersecurity and information security risk, as well as our cybersecurity initiatives.


text: The Audit Committee oversees compliance with cybersecurity policies with guidance from members of management, including the Vice President of Internal Audit, who informs the Audit Committee on the audit results of cybersecurity controls.


text: Management's Role in Assessing and Managing Cybersecurity Threats Our IT and Security team, which is headed by our CIO, is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. Our CIO and various members of the IT and Security team, meet regularly with members of management to address key security and privacy issues. Our CIO has more than 24 years of infrastructure and cybersecurity experience and holds various relevant certifications. We also have formed a cyber event incident team, composed of our CIO, Chief Financial Officer, Corporate Controller, Chief Legal Officer and vice president of Internal Audit, who upon the occurrence of a cybersecurity incident, would convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer and the Board of Directors. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks In the ordinary course of business, our information systems on which we run our business operations and store confidential or proprietary data, such as PII about our customers and our employees, are subject to potential cyber-attack. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems. We have implemented security measures that are designed to detect and protect against cyberattacks. Our processes and procedures align with the National Institute of Standards and Technology Cybersecurity Framework. I n particular, we seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment


text: Incident Identification and Response A security information and event management process ("SIEM") has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan within our SIEM that is designed to provide for action to contain the incident, mitigate the impact and restore normal operations efficiently. We conduct annual reviews of our cyber incident response plan.


text: Training and Awareness Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees who access our systems are required to undergo annual cybersecurity training and, each year, employees are required to test their understanding of our cybersecurity policies. Further, our employees that handle PII are required to undergo training, including phishing exercises and awareness programs on the appropriate management, use and protection of that information.


text: Finally, we have implemented encrypted virtual private networks in an effort to enhance the integrity of remote connections and have endeavored to protect wireless access points to our systems using authentication of users and/or devices. Segmented networks and user access controls are used to limit unauthorized access to sensitive information and systems. Employees are required to use multi-factor authentication and regularly update their passwords.


text: Encryption and Data Protection Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information and other confidential data. We also have a program in place to monitor our retained data by identifying PII and ensuring it is not stored outside of approved locations and systems. We maintain policies that govern the deletion of PII to limit the information exposed to a potential cyberattack. We have endeavored to use strong, up-to-date encryption algorithms and to regularly update and patch systems in an effort to guard against vulnerabilities. Similarly, we have sought to manage encryption keys with use of a secure key management system and rotation of keys after use. We have implemented secure protocols, including, e.g., hypertext transfer protocol secure for web traffic and secure file transfer protocol for file transfers.


text: Processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access. These services are designed to monitor both internal and external threats.


text: We engage several third-party consultants in connection with our risk assessment and risk management, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties.


text: Impact of Risks from Cybersecurity Threats As of the date of this Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access, extraction, and deletion of certain sensitive data, large quantities of data, and other anomalous network traffic. These services are designed to monitor both internal and external threats. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Management's Role in Assessing and Managing Cybersecurity Threats Our IT and Security team, which is headed by our CIO, is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. Our CIO and various members of the IT and Security team, meet regularly with members of management to address key security and privacy issues. Our CIO has more than 25 years of infrastructure and cybersecurity experience. We also have formed a cyber event incident team, composed of our CIO, Chief Financial Officer, Corporate Controller, Chief Legal Officer and vice president of Internal Audit, who, upon the occurrence of a cybersecurity incident, convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer, the Finance/Risk Management Committee, the Audit Committee and the Board of Directors. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks.


text: FirstEnergy seeks to protect its customers, employees, facilities and the ongoing reliability of the electric system. FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security risks, exchange information, and put safeguards in place to comply with strict reliability and security standards. From a security standpoint, the electric utility sector is one of the most regulated industries.

companyName: FIRSTENERGY CORP

ticker: FE


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the Audit Committee, the Operations and Safety Committee, and the FE Board, as described in greater detail below.


text: Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats. FirstEnergy's policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated. FirstEnergy aims to align its cyber security program with national standards. For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards. FirstEnergy also complies with various state laws and regulations on cyber security.


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year, which are based on nationally accepted standards. These can include annual compliance required assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.


text: To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks. FirstEnergy is also currently evaluating its current third-party vendors to identify which vendors have similar access to personally identifiable information and expects to complete its analysis by the end of 2024.


text: FirstEnergy conducts cyber security exercises and training. For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates the personnel on FirstEnergy's policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems. FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy's utility and business functions. FirstEnergy's management also holds executive cyber security incident tabletop exercises to train on cyber security incident response.


text: Additionally, FirstEnergy leverages third-party security firms in various capacities to assist with various aspects of FirstEnergy's cyber security program, including risk assessments, vulnerability scans, and penetration testing. FirstEnergy uses a variety of processes to address cyber security threats related to the use of third-party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of FirstEnergy's process to continuously improve its cyber and information security programs, FirstEnergy also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs. In addition to the aforementioned efforts, FirstEnergy also strongly considers cyber security risks as a part of its overall strategy and invests heavily in sophisticated and layered security measures that use both technology and hard defenses to protect critical transmission facilities and its digital communications networks. For example, security enhancements to FirstEnergy's transmission infrastructure, such as enhanced cyber security monitoring and alarming are a key component of FirstEnergy's transmission investment program.


text: Despite the security measures and safeguards FirstEnergy has employed, including certain measures implemented pursuant to mandatory NERC Critical Infrastructure Protection standards, FirstEnergy's infrastructure may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to information technology systems may be made. Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.