text: We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management experts, to assess and enhance our cybersecurity oversight. Our third-party security firms periodically assess our cybersecurity process against the National Institute of Standards and Technology Cybersecurity Framework. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities. We also regularly consult with industry groups on emerging industry trends.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the company or our business strategy, results of operations or financial condition.

companyName: Verve Therapeutics, Inc.

secItem: Item 1C


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have a Vice President, Information Technology, whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and prepare the Company and its employees to address cybersecurity risks. The Vice President, Information Technology has a Master of Science in Information Technology and has implemented cybersecurity programs at four companies in the biotechnology industry over a 20-year career.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems, information and other information technology assets (including those of third parties upon which we rely).

companyName: EVERBRIDGE, INC.


text: The information security function is overseen by our Chief Information Security Officer ("CISO") and is supported by the Information Security and Privacy Committee ("ISPC"), which is made up of members of our executive management team including our Chief Legal & Compliance Officer and Chief Information Officer ("CIO").


text: The information security function works to identify and assess risks from cybersecurity threats by monitoring and evaluating internal and external cybersecurity threats including, for example using automated and manual tools and controls in certain environments and systems, overseeing internal and external audits, conducting vulnerability assessments and penetration tests in certain environments and systems, and facilitating tabletop incident response exercises. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our critical systems, information and assets, including, for example: incident response plan and incident response policy, systems monitoring, vulnerability management policy, third party management program, failover and contingency plans, employee training, cybersecurity insurance, encryption of certain data, dedicated cybersecurity staff, network security controls and data segregation for certain environments and systems, physical security controls, and certain cloud security posture management processes.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, forensic investigators, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other vendors that help us provide critical business services. We have a risk management process to manage cybersecurity risks associated with our use of certain of these third-party providers. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, risk assessments that include a review of security risk and questionnaires.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity and Reliability." Our Board addresses the Company's cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, who has over 20 years of information security experience; our CIO, who has over 20 years of experience in information technology and cybersecurity; our Deputy CISO who has over 20 years of experience in the information technology and cybersecurity industry; and our Chief Legal & Compliance Officer, who has served as chief legal and compliance officer of various companies for the past five years.


text: Our CISO, who reports to the CIO, is responsible for hiring appropriate personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CIO, Chief Legal & Compliance Officer, and others, who help the Company mitigate and remediate cybersecurity incidents of which they are notified and who may further notify the Board in accordance with such policies.


text: Our CIO, CISO, and Chief Legal & Compliance Officer report quarterly to the ISPC and the Board concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have implemented and maintain a cybersecurity program that is aligned with the NIST Framework and reasonably designed to protect our information and to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our senior leadership for overseeing the company's cybersecurity risk management, including the Vice President of Information Technology, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Such members of our senior leadership also report to the Board at least annually on cybersecurity matters, including information security and cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee.


text: Our Audit Committee is responsible for overseeing information security and cybersecurity risk. Senior leadership communicates with the Audit Committee at least quarterly regarding information security and cybersecurity risk and formally reports to the entire Board on information security and cybersecurity risk at least annually.


text: At the management level, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills gained from over 18 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to the Chief Financial Officer.


text: The Vice President of Information Technology receives reports on information security and cybersecurity threats from our Director of Infrastructure and Cybersecurity and in conjunction with management, regularly reviews risk management measures implemented by our company to identify and mitigate information security and cybersecurity risks. A number of experienced information security team members responsible for various parts of the business also report to the Vice President of Information Technology on an ongoing basis. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We have adopted a cybersecurity incident reporting process ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board and other key stakeholders informed and involved as appropriate.


text: Our senior management and representatives from our business units regularly communicate with the Board of Directors on risk management matters, including cybersecurity risks. Senior management conducts regular risk assessments to identify risks that have the potential to significantly affect our business over the short-, medium- and longer term and reviews with the Board of Directors risk mitigation and oversight measures, including prioritization of risk management and allocation of responsibility within our company for the management of a particular risk.


text: We continue to improve our cybersecurity risk assessment program and activities for assessing, identifying and managing cybersecurity risks through industry standard security frameworks and leading practices, including risk assessments and remediations, software and services, continuous systems monitoring, vendor risk management processes, incident response plans, phishing simulations, employee training, tabletop exercises and communication programs, among other measures. We also employ processes designed to assess, identify, and manage the potential impact of a security incident at critical third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use.


text: All employees with a company-provided email receive annual cyber awareness training. In addition, we perform monthly phishing simulations, with remediation training required as necessary.


text: While we have not experienced material cybersecurity threats or incidents, or threats or incidents that are reasonably likely to materially affect us, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Information on cybersecurity risks and threats we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Our business is subject to cybersecurity risks and threats."


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Innovex International, Inc.

ticker: INVX


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management and monitoring of risks arising from cybersecurity threats. The Company's management regularly reviews with the Board and the Audit Committee the measures implemented by the Company designed to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and the Audit Committee receive reports and presentations quarterly, and on an as-needed basis, from members of our team responsible for overseeing the company's cybersecurity risk management, including the head of our IT department, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. In addition, we employ a major international accounting firm to act as our internal audit function and cybersecurity experts from the firm regularly assess the Company's data protection and cybersecurity systems and present the results of its assessments to our Audit Committee. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.


text: Internal Cybersecurity Team Our internal cybersecurity team, led by our IT Director, is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The team includes IT Security staff with over 27 years of collective cybersecurity work experience and the globally recognized Certified Information Systems Security Professional (CISSP) credential. In addition to our internal cybersecurity capabilities, we regularly engage cybersecurity consultants to assess, identify, and manage cybersecurity risks.


text: Our entire management team periodically participates in the review of our cybersecurity systems, processes, threats and incidents with our internal cybersecurity team, including the controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our entire management team also periodically participates in cybersecurity incident response exercises with our third-party cybersecurity firms to review how material incidents will be handled and reported. Our internal cybersecurity team works closely with our Legal department to oversee compliance with legal, regulatory and contractual security requirements.


text: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at key third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use. The Company maintains cybersecurity risk insurance as part of its protection against potential losses arising from a cybersecurity incident.


text: Security Policy and Requirements The Company regularly conducts cybersecurity training for its employees along with ongoing tests such as simulated phishing exercises for its employees. The Company also has its third-party service provider regularly conduct penetration testing and vulnerability scanning.


text: With respect to incident response, we have adopted a Cybersecurity Incident Response Plan that applies in the event of a significant cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats & Incidents Evolving cybersecurity threats have and will continue to pose difficulties in preventing, detecting, mitigating, and remediating cybersecurity incidents. While we have not experienced any material, or reasonably likely material, cybersecurity threats or incidents during the reporting period, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.


text: We rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" under the heading "Risks Related to Cybersecurity and Technology," which should be read in conjunction with the foregoing information.


text: The Company recognizes the critical importance of maintaining the safety and security of its systems to protect its customers, maintain its reputation, and preserve the value of the Company and data and therefore have an enterprise-wide risk management framework for overseeing and managing cybersecurity and related risks. The process is supported by both management and its Board of Directors.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: The Company relies heavily on sensitive information to run daily operations and deliver products and services. To protect the availability, integrity, and confidentiality of sensitive information and sensitive infrastructure, the Board of Directors requires the Company develop and implement a comprehensive Information Security Program, which focuses on the confidentiality, availability and security of information and systems. The Information Security Program defines the strategy that the Company uses to protect and secure its systems and media that process and maintain sensitive information. The program details the governance, management, operations, and assurance of the program, and seeks to identify, prevent and mitigate cyber threats and to respond effectively to cyber threats when they occur.


text: The cybersecurity function, is led by the Company's Chief Information Officer ("CIO"), who reports to The Company's Chief Operating Officer ("COO"). The Chief Information Security Officer ("CISO") reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including threat assessments and detection, mitigation technologies, cybersecurity training, incident response, insider threats and regulatory compliance.


text: The Company has not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to its business or operations. Nevertheless, there are no assurances the Company will not experience such an incident in the future. Such incidents, whether or not successful, could result in the Company incurring significant costs related to, for example, rebuilding its internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, risk of customers moving relationships with the Company to another institution, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually and receive reports on incidents that exceed certain thresholds and updates on responses thereto. The Information Security Committee is directly responsible for oversight of risks related to cybersecurity. The Board receives reports on information security and cybersecurity from the Information Security Committee at least four times a year.


text: The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory requirements, information sharing, third party vendors, internal and external security assessments, and industry periodicals.


text: The risk assessment process identifies areas that are required to be protected and determine if adequate controls are used to safeguard the Company against threats and vulnerabilities. Adjustments required to adhere to regulatory changes are a regular function of the assessment process as well as changes to technologies, processes, and other factors. From the analyses, any additional controls are identified, prioritized and implemented.


text: Security Controls and Continuous Monitoring Security controls and design are critical to mitigating risks. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and applies lessons learned from its defense and monitoring efforts to help prevent future attacks. The Company utilizes data analytics to detect anomalies and monitor for possible cyber threats. The Company's Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques the Company uses to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. The Company's Internal Audit function also conducts information technology and cybersecurity reviews and assessments.


text: Threat Intelligence The Company considers threat intelligence from third party sources to strengthen systems and network preparedness for cybersecurity risks. The Company uses associations, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to stay informed of threat information.


text: Third Party Risk Assessments The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections.


text: The Company has established comprehensive incident response and recovery plans and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management and the Board on its response to a cybersecurity incident.


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically hosts tabletop exercises with management and other employees to practice cyber incident response.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We primarily assess, identify and manage material risks from cybersecurity threats through our enterprise information security program, which is maintained by our Chief Information Security Officer ("CISO") and overseen by our Executive Vice President and Chief Information Officer ("CIO").

companyName: MKS INC

ticker: MKSI


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. Following the ransomware incident we identified in February 2023, we made certain enhancements to our enterprise information security program, including with respect to privileged access management, security monitoring and response, and application backup and recovery. We consider our enterprise information security program to be a key component of our overall risk management system.


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: The information provided by these assessments is used to improve our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, the results of significant assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We have similar processes in place to oversee and identify cybersecurity-related risks posed by our suppliers.


text: Risks from Cybersecurity Threats As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Based on our investigation, we concluded ransomware actors encrypted certain of our systems by deploying malware. This incident required us to temporarily suspend operations at certain of our facilities and had a material impact during the three months ended March 31, 2023 on our ability to process orders, ship products and provide service to our VSD and PSD customers.


text: In addition, based on our investigation of the incident, we became aware that ransomware actors may have exfiltrated personal information from our systems. We provided notifications to individuals and to regulators in accordance with applicable laws, and we may be required to provide additional notifications in the future.


text: We and our third-party administrators, vendors and partners are also subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, we do not believe such threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As provided for in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management has taken to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk. As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Our Board of Directors responded quickly and constituted a special committee of the Board for cybersecurity, which included Gerald G. Colella, the Chair of our Board, Elizabeth A. Mora, the Chair of our Audit Committee, and Peter J. Cannone III and Joseph B. Donahue, each a member of our Audit Committee, to oversee the investigation, recovery, and restoration phases following the incident (the "Special Committee"). The Special Committee held 21 meetings during the first three months following the identification of the incident. At these meetings, our Chief Executive Officer, our Chief Financial Officer, our General Counsel, our Executive Vice President of Operations and Corporate Marketing, and our then-Chief Information Officer reported to the Special Committee on various aspects of the incident, including the information technology forensic investigation, business restoration and recovery activities, and the impact of the incident on our annual audit and assessment of internal controls as well as the filing of our Annual Report on Form 10-K for the year ended December 31, 2022.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO has primary oversight of our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformation, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.


text: Our CIO and CISO provide regular reports to management regarding risks from cybersecurity threats and the prevention, detection, mitigation and remediation of cybersecurity incidents. Within our information technology organization, our CISO and other key members of our information security team provide regular reports to our CIO.


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity. For example, as discussed above, management provided regular reports to the Special Committee on various aspects of the ransomware incident we identified in February 2023.


text: Cyber Risk Management and Strategy At Fulcrum Therapeutics, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we intend to evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Related to Cybersecurity Risks Our Executive Director, IT & Operations, or Executive Director, who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 15 years of experience in information technology, the Executive Director works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.


text: The Executive Director and our Chief Legal Officer participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cyber risks or threats. Our Chief Legal Officer has received the National Association of Corporate Directors CERT Certificate in Cyber-Risk Oversight.


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Executive Director provides annual presentations to the audit committee on our cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.


text: Additionally, we have implemented an enterprise risk management process, which addresses cyber risks. This process is led by our Chief Legal Officer and includes participation by the board of directors, as appropriate. Our Chief Legal Officer reports regularly on the enterprise risk management process to executive leadership and the audit committee.


text: We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan.

companyName: Cerevel Therapeutics Holdings, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify cybersecurity risks to our critical systems, information and our broader enterprise IT environment; • an information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs.


text: The Audit Committee receives periodic reports from our Chief Digital Officer on our cybersecurity risks and risk management program as well as presentations on cybersecurity topics as part of the Audit Committee's continuing education on topics that impact public companies. In addition, management updates the Audit Committee, as necessary, regarding any potentially material cybersecurity incidents.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program through our overall enterprise risk management program, which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks that may affect us, including cybersecurity risks.


text: Our management team, including our Chief Digital Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Digital Officer oversees a team of information security professionals who are responsible for assessing and managing cybersecurity threats on a day-to-day basis. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital Officer has served in the role since 2019 and has experience in application security, intrusion detection, penetration testing, complex threat modeling and unconventional cyber-attack vectors.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors —Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."


text: The Chief Information Officer, or CIO, leads our information security organization responsible for overseeing EverQuote's information security program. Our CIO has over 30 years of industry experience managing risks or advising on cybersecurity matters. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board oversees our enterprise risk management processes directly and through its Audit Committee. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, financial, or competitive in nature, information related to our clinical trials and preclinical studies and information of our employees, or Information Systems and Data.

companyName: Kura Oncology, Inc.

ticker: KURA


text: Our Information Technology, or IT, department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, evaluating threats that are reported to us, using external intelligence feeds, engaging in internal and external audits, and engaging third parties to conduct threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a disaster recover/business continuity plan and information security policy, encrypting certain data, data segmentation, network security controls, access and physical security controls, asset management, tracking and disposal, systems monitoring, employee training, maintaining cyber insurance and using third party threat detection software.


text: The head of our IT department reports to our Chief Operating Officer, or COO, and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section entitled "Risks Related to Employee Matters, Managing Growth and Macroeconomic Conditions."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the head of our IT department. The head of IT is responsible for integrating cybersecurity risk considerations into our overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Materiality Assessment Team, comprised of members of management. In addition, our cybersecurity incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the head of our IT department concerning the measures we have taken to monitor and evaluate our cybersecurity threat environment and any cybersecurity incidents that have occurred.


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external facing ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. The Company will have a third party perform an annual assessment of the Company's cybersecurity risk management program against the NIST CSF. The Company has a Cyber Security Operations Center monitoring our global cybersecurity environment and coordinates investigations and remediation of alerts. We are enhancing our programs for staging incident response drills to prepare support teams in the event of a significant incident. The cybersecurity risk management program includes controls for organizational processes, personnel, physical facilities and equipment, and technological controls.


text: Our VP, Head of Information Technology is the Company's designated Chief Information Security Officer ("CISO") and is responsible for developing and implementing the cybersecurity risk management program and reporting on cybersecurity matters to the Board. The VP, Head of Information Technology has over twenty years of experience leading cybersecurity oversight. Additionally, members of the IT security team have cybersecurity experience and\or certifications, such as the Certified Information Systems Security Professional certification and Certified Information Systems Audit certification. We view cybersecurity as a shared responsibility across our management team, and plan to periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees will be required to complete cybersecurity training at least once annually and have access to more frequent cybersecurity training through online and live events. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training that is documented in our quality management system. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: Our CISO is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The cybersecurity team collectively has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as information obtained from governmental, public, and private sources, including external consultants engaged by the Company on a real time basis. The Company is enhancing its processes for oversight of third-party vendors, including appropriate due diligence for new providers and continuous monitoring following implementation, including ongoing direct contact with vendor personnel. Third-party vendors are re-evaluated at regular intervals as part of our supplier qualification process.


text: The Audit Committee, in addition to the Company's General Counsel and Chief Compliance Officer, oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee and General Counsel and Chief Compliance Officer on the effectiveness of the Company's cyber risk management program, generally on a quarterly basis. In addition, cybersecurity risks will be reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have not experienced any material cybersecurity incidents in the past, and we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in the cybersecurity and resiliency of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Company's Senior Vice President of Information Technology (SVP-IT); • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and • periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; and • monitoring information systems to detect attacks and indicators of potential attacks.


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting and correcting information system flaws, security alerts and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.


text: Our cybersecurity incident management plan includes the following, among other things: • The SVP-IT leads the team in the development, documentation, review and testing of security procedures and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis; • The SVP-IT works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately. • The CIRT team, in consultation with outside experts if needed, is responsible for the following: o Initial containment; o Analysis to establish root cause of incidents, identification and evidence collection;


text: o Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified; o Implementing solutions designed to solve underlying problems and prevent re-occurrence; o Recovery and restoring normal business functionality;


text: o Review after closure of each incident and conducting a post-mortem analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the CIRT evaluates competency and any additional training requirements needed.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected us or our business strategy, results of operations, financial condition and/or cash flows. Moreover, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial condition and/or cash flows. See Item 1A, Risk Factors above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers.


text: We have invested in robust data security and privacy protections. We follow industry-standard recommendations for data security such as those outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-171 and evolving Cybersecurity Maturity Model Certification (CMMC) frameworks. We have developed cybersecurity policies and procedures, including a data classification system to ensure the protection of critical data. In addition to periodic internal review, we also employ external auditors as needed, and cybersecurity testing firms to review our cybersecurity posture.


text: We maintain a CIRT, whose responsibilities are described above. We conduct periodic tests with this team to maintain readiness and resiliency while regularly reviewing its policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.


text: Our Board of Directors receives an update from our SVP-IT twice per year. In addition, our Government Security Committee of the Board of Directors is responsible for reviewing Cybersecurity Posture and overall resilience of the aerospace and defense portion of the network. The Government Security Committee reviews global cybersecurity risk with the SVP-IT at least four times a year. These reviews included standard cybersecurity-related metrics as well as other detailed reviews of sensitive systems. Our SVP-IT has over 25 years of experience in IT, which include various leadership roles at other large corporations and holds an Executive Master in Cybersecurity degree from Brown University.


text: We have established policies and processes for assessing, identifying, managing and disclosing, as necessary, risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: QuantumScape Corp

ticker: QS


text: We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.


text: We devote significant resources and have designated senior management, including our VP of Information Security who reports to our Chief Technology Officer, to manage the cybersecurity and information security risk assessment and mitigation process. We have established an internal security committee that includes members of our information security/technology, internal audit/compliance, finance and accounting, people operations, and legal teams, to instill a thoughtful security culture across our Company. Our employees and contractors are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: The Company deploys multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.


text: We have not experienced a material security breach in our systems, and, to our knowledge, in our third-parties' systems, nor incurred any significant expenses or penalties to resolve or settle any security breach in the past three years. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors – Our Business Risks – Our website, systems, and data we maintain may be subject to intentional disruption, other security incidents, or alleged violations of laws, regulations, or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews cybersecurity and information security risks and mitigation strategies; the audit committee receives periodic updates on information security and privacy, and the full board receives at least an annual update.


text: Our VP of Information Security has many years of experience implementing cybersecurity at technology and research and development companies, and together with our internal information security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Our VP of Information Security periodically provides briefings to our internal security committee and to the audit committee and board of directors on an annual basis regarding our Company's cybersecurity risks and activities, including, as applicable, any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like. We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to a special executive security committee and the chair of the audit committee, among others as needed, to manage the Company's response


text: We assess, identify and manage material risks from cybersecurity threats through various protective policies, procedures and processes. These are embedded into our overall risk management system and extend to risks related to systems hosted by third parties.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: We utilize external standards, such as the Center for Internet Security framework as a starting point for the design and development of our systems that assess risk and mitigation measures. An annual risk assessment is completed and presented to the executive leadership team and the Company's Board of Directors. We discuss changes to our policies, procedures and processes needed to address gaps identified through the assessment.


text: We maintain organizational safeguards that include employee training, business continuity planning and cybersecurity insurance. These safeguards are reviewed on an annual basis or more frequently as the business environment warrants and are adjusted as needed to account for changes in the Company and overall risk environment. Cybersecurity training is provided to employees through both online and classroom instructor led trainings.


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. We also operate a Security Operations Center ("SOC") to manage our real-time end point protection monitoring.


text: We engage in annual corporate-wide internal and external facing penetration tests, employing a battery of hacking tools to map out our assets and to assess vulnerabilities that could be exploited. In addition, we also extend such testing to newly acquired companies and assets as part of the integration process. This penetration testing is performed by a third party and is used to evaluate our current posture towards IT security threats and to make adjustments, as needed, to protect our systems. The results are reviewed with the executive leadership team and the Company's Board of Directors.


text: We have an Incident Response Policy and related processes that outline steps to be taken in the event of a cybersecurity incident across Helios, our partners and third-party hosted systems. All incidents are reported to the Global Head of Information Technology who then reviews significant incidents with a cross-functional working group, inclusive of the Company CFO and General Counsel, to assess the materiality or potential materiality. An Incident Response Team that will determine response actions to be taken and coordinate all necessary communications is formed when an incident is deemed material or potentially material.


text: No risks from IT security threats nor any previous IT security incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, but we cannot provide any assurance that they will not be materially affected in the future by such risks or incidents. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see "Risks Relating to Our Business: Other––Increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services" in Item 1A, Risk Factors.


text: Role of Management Helios Technologies, Information Systems organization is led by the Global Head of Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by the ESG Committee.


text: Helios' Global Head of Information technology is an active member of InfraGard and has formal education in information technology with over 25-years' experience in roles involving management of cybersecurity functions, cyber strategy, and leading and collaborating on information systems and related technologies. The Global Head of Information Technology receives regular updates on cybersecurity developments, results of mitigation efforts and cybersecurity incident response and remediation.


text: Helios IT management is responsible for developing and implementing its cybersecurity policies and is comprised of individuals with either formal education in information technology or cybersecurity or have relevant experience working in information technology and cybersecurity. Additionally, leaders in Helios' information technology function receive periodic training and education on cybersecurity related topics including certifications.


text: Role of the Helios Board The ESG Committee addresses risks related to the global enterprise, including material risks facing the businesses, risks the Company may face in the future, measures that management has employed to address those risks and other information relating to how risk analysis is incorporated into the Company's corporate strategy and day-to-day business operations. As part of this oversight function, the ESG Committee is responsible for overseeing cybersecurity-related risks. The ESG Committee includes cybersecurity topics in its quarterly updates to the full Board, which provides further oversight over our cybersecurity-related risks and the Company's strategies to address such risks.


text: At Graphite Bio, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks.


text: We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Related to Cybersecurity Risks Our Chief Executive Officer, with the assistance of the Company's third-party information technology providers, is responsible for the strategic leadership and direction of the Company's cybersecurity program.


text: The Company's audit committee has oversight over cybersecurity risks. With the input of other members of Company management and the Company's information technology providers, the Chief Executive Officer provides periodic presentations to the audit committee on the Company's cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team composed primarily of members of management, including our Director of IT Operations, that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to maintain, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training — including phishing and malware simulations — of all of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes relevant procedures for evaluating the materiality of identified cybersecurity incidents, and reporting and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats, or provide assurance that our operations, business strategy, results of operations, or financial condition will not be materially affected in the future by such risks or any future material cybersecurity incidents. For additional information about our cybersecurity related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from our management-led Enterprise Risk Management Committee on our cybersecurity risks and mitigation initiatives. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives briefings from senior management on our cyber risk management program.


text: Our information technology management team, along with our externally managed security operations center, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes background in cybersecurity and information technology operations, with a focus on cybersecurity, data privacy, information technology governance, and risk management. The team is proficient in conducting vulnerability assessments, analyzing security logs, and implementing necessary security controls, with knowledge in cloud technologies and computing, database management, DevOps, and quality engineering.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: As one of the critical elements of the Company's overall risk management, our Adviser's cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and Chief Compliance Officer and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.


text: Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser's internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.


text: Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company's and our Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: Our Adviser maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser's evolving information security policies, standards, processes and practices.


text: Our Adviser engages in the periodic assessment and testing of our Adviser's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Adviser adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Adviser. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Adviser, including the Adviser's Director of Information Technology.


text: The Adviser's Director of Information Technology, in coordination with relevant senior management and personnel of the Adviser, which includes our Adviser's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Adviser's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Adviser's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect our ability to pay dividends to our stockholders".


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials("Information Systems and Data").

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our information security function, overseen by our Vice President of IT and Facilities ("VP of IT and Facilities") and supported by members of our IT, Legal and Finance departments, and our third-party IT service providers, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: using manual and automated monitoring tools; subscribing to reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting internal and external audits for certain data and systems; conducting threat assessments for internal and external threats; conducting vulnerability assessments to identify vulnerabilities; penetration testing; and having third parties conduct threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response process; conducting risk assessments; encrypting certain of our data; segregating certain of our data; implementing network security controls; maintaining access and physical security controls; asset management processes for managing, tracking, and disposing of assets; monitoring our corporate systems; providing security awareness training to employees; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our cybersecurity risks.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity consultants, cybersecurity software and hardware providers, outside legal counsel, penetration testing firms, dark web monitoring services, and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We use certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including, for example, requiring our vendors to complete security questionnaires and conducting vulnerability scans related to our vendors' services.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of the third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to significant fines or other liability; regulatory investigations or actions; disruptions of our development programs or business operations; harms to our reputation, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our VP of IT and Facilities, who has over 25 years of IT experience, including 10 years of information security experience, in various IT leadership roles in life sciences companies.


text: Our VP of IT and Facilities is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our VP of IT and Facilities is responsible for preparing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including our President and CFO. Our President and CFO works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives quarterly reports from our VP of IT and Facilities concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company has an enterprise-wide cybersecurity program that is informed by the U.S. Department of Commerce National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity program encompasses the following key capabilities: 24x7 security monitoring, next-generation network security, advanced email and endpoint security, a dedicated enterprise cybersecurity team, third-party managed security services, third-party security assessment services, incident response retainer services, and external risk monitoring services. The Company also maintains cybersecurity risk insurance coverage to defray the costs of potential information security breaches.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: The Company maintains an incident response plan. Our incident response plan coordinates the actions we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to address potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan is updated as appropriate in response to changes within our organization or in response to external factors that may impact us. We test our incident response plan by conducting tabletop exercises on an annual basis.


text: Our associates receive annual cybersecurity training, and we conduct mock phishing campaigns to better enable our associates to recognize phishing emails and other social engineering tactics. We have established reporting processes for our associates if they encounter suspicious activity that may give rise to a cybersecurity incident.


text: Our cybersecurity risk management and strategy processes are led by our Senior Vice President and Chief Information Officer ("CIO") and are supported by the Senior Director of Enterprise Cyber Security. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current CIO has over 25 years of experience in information technology matters, and has over a decade of experience at the Company. Our Senior Director of Enterprise Cybersecurity has over 20 years of expanding leadership experience in information technology and 17 years of experience in information security leading and developing security programs. Our CIO provides regular updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company's enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly updates on the these risks.


text: The CIO typically reported twice a year to the Audit Committee with cybersecurity updates. During such updates, the CIO generally covered topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2023, the CIO reported to the Board of Directors on cybersecurity programs and risk mitigation efforts and enhancements to the incident response plan that were applied in 2023. Starting in 2024, the CIO is scheduled to provide the Audit Committee with cybersecurity updates on a quarterly basis.


text: As part of the above processes, we engage with assessors, consultants, auditors and other third parties, including by (i) engaging third-party managed security services to assist with the operation of certain aspects of our cybersecurity program, (ii) engaging security assessment services to provide assessments on our cybersecurity program, (iii) engaging an incident response retainer service to provide timely cyber incident response support and digital forensics analysis services, (iv) engaging risk monitoring services to help identify emerging cybersecurity risks, and (v) engaging with other information technology and legal subject matter experts to review our cybersecurity program to help identify areas for continued focus, improvement, and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties' information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally contractually require such third parties to manage their cybersecurity risks. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards.