text: Together with a third-party, we operate a 24/7 Security Operations Center ("SOC") to monitor the cybersecurity environment and coordinate escalation and remediation of alerts. Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan. This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation. IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required. The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, CAO & Treasurer. The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.


text: We utilize a variety of methods performed both internally and by third-parties to assess the Company's cyber risk management program including penetration tests, risk assessments and evaluation against the NIST CSF. The effectiveness of controls and safeguards are evaluated on an on-going basis to address current and emerging cyber-risks. We engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information. Our Internal Audit function also regularly reviews various elements of our program utilizing third-party subject matter experts in IT and cyber issues to ensure we are complying with our internal controls and staying abreast of best practices in the industry. We incorporate many resources and tools on both an ad hoc and planned cadence to maintain readiness to withstand and respond to a cyber incident including incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training throughout the organization.

companyName: Murphy USA Inc.

ticker: MUSA

secItem: Item 1C


text: Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers. We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate cybersecurity risks associated with third-parties; however, we rely on those third-parties to implement cybersecurity programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. For the 2024 period presented within this Annual Report, Murphy USA is not aware of any threats or cybersecurity incidents that have or are reasonably likely to materially affect our strategy, results of operations or financial condition.


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to a complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: The Company relies on Ashford Inc and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Management provided by Ashford Inc. is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: We understand the importance of identifying and managing cybersecurity risks that could materially disrupt our business operations. We rely on information technology systems to conduct important operational activities and to maintain business and employee records and financial data. Disruption of these systems could adversely impact our ability to conduct business activities.

companyName: Five Point Holdings, LLC

ticker: FPH


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our program incorporates certain guiding principles from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.


text: Our process for managing cybersecurity risk is a collaborative effort that includes key members of our information technology, legal, and finance departments, as well as internal audit and third-party cybersecurity firms. Our cybersecurity program takes into consideration the identification of critical data assets, information technology systems, third party service providers, and business processes that may be susceptible to cybersecurity threats. Potential technology vendor relationships are vetted based on the nature of services or technology being provided, and we continue to evaluate these relationships to determine the ongoing necessity of the services and the vendor's risk management posture.


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls ("SOC") reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.


text: We also maintain insurance coverage for cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We describe the risks from cybersecurity threats that could affect our operations and financial results under the heading "Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive employee or company information." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program and potential material cybersecurity threats. The audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.


text: We have established a security committee, which contains management representation from our information technology, legal, and finance groups. The security committee includes our Vice President – Information Systems, who has more than 15 years of experience in the following information technology areas: compliance, security, auditing, vendor management, and systems and network operations. The security committee oversees our cybersecurity incident response plan and is responsible for assessing and managing cybersecurity threats and evaluating the potential impact of such threats on our business strategy, results of operations, and overall financial condition. The security committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment. Our Vice President - Information Systems is responsible for proposing strategies and tactics to mitigate cybersecurity threats, which are subject to review and approval by the security committee.


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our risk assessment process is modeled after the National Institute of Standards and Technology ("NIST") Guide for Conducting Risk Assessments and is performed annually. We may also elect to perform assessments more often based on material changes in business activities or other factors. The results of our cybersecurity risk assessment aid in identifying potential cybersecurity risks and guiding the adoption of appropriate risk mitigation measures. Our cybersecurity threat defense approach incorporates certain guiding principles from the NIST Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program, potential material cybersecurity threats, and results of the most recent cybersecurity risk assessment. Additionally, t he audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.


text: We assess, identify and manage material risks from cybersecurity threats through the cyber risk management program supervised by our Chief Informational Security Officer ("CISO"). The cybersecurity program utilizes our cloud security backbone along with complementary tools to identify, prevent, detect, respond to, and recover from cybersecurity incidents, including: • regular cybersecurity awareness training for employees and contractors on our policies and emerging risks from cybersecurity threats, as well as regular phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of our information systems and devices; • protective and detective cybersecurity controls built into our systems and applications; • cybersecurity incident monitoring and response efforts, including our security breach incident response plan (the "Incident Response Plan"), to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery and business continuity planning efforts.

companyName: DOC DR Holdco, LLC


text: Our cybersecurity team utilizes a cyber risk management and quantification system ("CRQ"). The CRQ provides intelligence and insights on potential areas of cyber risk and analyzes risk across the major stages of typical cyberattacks and covers a number of entities in our environment, including third party providers. The CISO monitors the CRQ to help ensure that cyber risk assessment and reduction is integrated into the Company's overall risk management system.


text: As part of the above processes, we regularly collaborate with third-party entities to enhance and fortify our cybersecurity risk management program, including through internal and external penetration testing and cybersecurity awareness training. As needed, we require third party service providers to adhere to certain cybersecurity standards and processes and agree to be subject to cybersecurity audits.


text: A discussion of how our business, financial condition, and results of operations could be materially adversely affected by risks from cybersecurity threats is contained under "Cybersecurity incidents could disrupt our business and result in the compromise of confidential information" in Item 1A. Risk Factors.


text: Our Board has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. In connection with its assessment of the Company's risk environment, the Board receives comprehensive updates on cybersecurity risks every quarter from the CISO.


text: The audit committee assists the Board in fulfilling its oversight responsibility with respect to, among other things, enterprise risk management, including information technology and cybersecurity risks. In performing these functions, the audit committee meets regularly with our management to review any significant risks or exposures. Pursuant to the Incident Response Plan, our Incident Response Team is responsible for our incident handling capability, which includes preparation, detection, analysis, containment, eradication, recovery, and follow-up capabilities in response to cybersecurity incidents. The Incident Response Team is led by the CISO and includes management from the Administration, Legal, Information Security and Technology, Physical Security and Facilities Management, Communications and Public Relations and Human Resources fields. When required, or if otherwise appropriate, management informs the Board and/or Board committee of any cybersecurity incidents. The CISO conducts semi-annual meetings of the Incident Response Team to review and document compliance with the Incident Response Plan. In collaboration with the Incident Response Team, the CISO reviews and updates the Incident Response Plan as necessary annually. In addition, the Chair of the Audit Committee conducts an annual review of the Incident Response Plan.


text: The CISO has more than thirteen years of previous professional experience across diverse roles, including managing information security, establishing robust information and cybersecurity programs, crafting business continuity and disaster recovery strategies, and managing complex IT environments as an IT Director, IT Manager, and Senior IT Systems Administrator. He attended the University of Wisconsin Milwaukee for his undergraduate in Management & Information Systems. He has worked in industries such as banking and investments, health care, real estate, private equity, and property management. He is an active member of the Midwest Cybersecurity Alliance and regularly participates in industry cybersecurity meetings and conferences to stay abreast of trends and collaborate with cybersecurity professionals.


text: The members of the Incident Response Team are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the Incident Response Plan processes described above.


text: Cybersecurity is of critical importance to our success. We are susceptible to significant and persistent cybersecurity threats, including data breaches, ransomware, and phishing attacks. These threats, which are constantly evolving, include attempts by malicious actors to breach our security and compromise our information technology systems, as well as those of our vendors and suppliers. A cybersecurity incident impacting us or any third party could disrupt operations, damage our reputation, and result in costly litigation and/or government enforcement action. We are committed to maintaining robust cybersecurity and data protection practices and continuously evaluate cybersecurity threats, considering their immediate and long-term effects on our business strategy, operations, and financial condition.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Under the oversight of our Board of Directors, and the Board's risk committee, our management has established comprehensive processes identifying, assessing, and managing material risks from cybersecurity threats. These processes are integrated into our enterprise risk management program and include proactive measures such as advanced threat monitoring, penetration testing, multi-factor authentication, and team member training. We also align our practices with recognized standards such as the NIST Cybersecurity Framework. Our detailed incident response plan outlines steps for detection, assessment, notification, and recovery, including escalation to management, the Risk Committee, and the Board when appropriate.


text: The risk committee of our Board, chaired by a director with extensive cybersecurity expertise, receives quarterly updates from management on cybersecurity risks and incidents, including those with moderate or higher impacts. Management updates the full board regularly to ensure alignment on mitigation strategies. Our Chief Technology Officer, with more than 35 years of IT experience, leads our cybersecurity efforts, supported by a dedicated team of certified specialists and external consultants.


text: Our third-party vendors and service providers are integral to our operations but pose unique cybersecurity challenges due to their access to data and our reliance on them for critical operations, including supply chain management. To address these risks, we maintain a third-party vendor risk management program that includes pre-onboarding due diligence, regular audits, and ongoing compliance evaluations. Additionally, we assess critical vendors' supply chain security practices to reduce risks from subcontractors.


text: As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition, or results of operations. However, we recognize that no system is immune to breaches. While we maintain cyber insurance coverage for specific risks, such as ransomware attacks and business interruption, the costs of certain incidents could exceed policy limits. We continue to invest in advanced technologies, such as AI-driven threat detection, to strengthen our defenses against evolving threats.


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues" for additional discussion of cybersecurity risks that may materially impact us.


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.


text: The Company has policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. All Company employees are required to complete annual cybersecurity training programs.


text: The Company engages third party vendors to periodically test, monitor and maintain the performance and effectiveness of the Company's cyber risk program. In addition, in 2023 the Company participated in a comprehensive third-party cyber risk review as part of its annual insurance renewal process and consideration of cyber risk coverage.


text: The Audit and Compliance Committee of the Board of Directors oversees the Company's cybersecurity risk program and the process employed to monitor and mitigate cybersecurity risks. Members of the management team provide periodic updates to the Audit and Compliance Committee on the status of the Company's cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors as part of the Company's ongoing enterprise risk management program.


text: As a triple net REIT with no significant consumer facing infrastructure or exposure, the Company faces a limited number of cybersecurity risks in connection with the operation of the business. Risks from cybersecurity threats have not materially affected the Company to date and are not reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. Other than widespread threats generally affecting businesses, the Company has not experienced threats to or breaches of its data or systems, including malware and computer virus attacks. For more information about the cybersecurity risks faced by the Company, see the risk factor entitled "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems" in Item 1A- Risk Factors.


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.


text: The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.

companyName: Guardant Health, Inc.

ticker: GH


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, centralized log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage.


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Head of Information Security and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of our incident response plan. Additionally, our threat intelligence software issues a quarterly report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Our Head of Information Security reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity program takes into account recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees and applicable contractors undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage though it may not be sufficient to cover all costs of a cybersecurity incident.


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates aspects of industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Chief Information Security Officer and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Cybersecurity risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation and testing of our incident response plan. Additionally, our threat intelligence program issues a semi-annual report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Our Chief Information Security Officer reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers have experienced cybersecurity incidents and routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a cybersecurity incident affecting our information technology systems.


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our networks and systems. Our CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.

companyName: Criteo S.A.

ticker: CRTO


text: Our Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to the Audit Committee the responsibility to assist in this task.


text: The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company's auditors, the Company's guidelines and policies with respect to risk assessment and risk management, including the Company's data privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.


text: The CISO helps maintain a comprehensive security program that serves as a governance framework for information security at Criteo, supports the business goals of the company and details, across problem spaces and security core functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.


text: Criteo assesses and manages its cybersecurity risks in part through executive committees. The Governance Risk and Compliance Committee (the "GRCC"), composed of the CISO and certain members of our executive and leadership teams, meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs"). The Information Security Committee (the "ISC"), a security-focused governance body including senior managers across the Company on information security activities, meets regularly to receive updates on KPIs and to review relevant standards and policies.


text: As a member of both the GRCC and the ISC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also build new tools and solutions in an effort to improve our security posture on an ongoing basis.


text: Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the business to manage our security controls, and translate our external requirements into policies, standards, and actions for the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned, or otherwise identified as potentially corrupt.


text: The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization, treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into strategic business risks and incorporated into the ERM program.


text: Cybersecurity Incidents While we have experienced cybersecurity incidents in the past, there have been none to date which have materially affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors – Risks Related to Data Privacy, Intellectual Property and Cybersecurity."


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.


text: Criteo assesses and manages its cybersecurity risks in part through an executive committee referred to as t he Governance Risk and Compliance Committee (the "GRCC"). The GRCC is composed of the CISO and certain members of our executive and leadership teams, and meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs").


text: As a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third- party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. For instance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and integrating solutions to improve our security posture on an ongoing basis.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned or otherwise identified as potentially corrupt.


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats.


text: We rely on third parties, including cloud vendors and consultants, for various business functions. Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. Governance.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security, including cyber security and back-up of information systems, and the steps the Company has taken to monitor and control such exposures and the responsibility to confer with management and the Company's auditors the adequacy and effectiveness of the Company's information and cyber security policies and the internal controls regarding information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 12 years of IT security experience in regulated industries such as government, energy, and biopharma. He has over 20 years of combined IT experience.


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting will include topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends and their potential impact on the Company's risk environment.


text: We rely on third parties, including cloud vendors and consultants, for various business functions. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation and scans or other technical evaluations. Governance.


text: Our Board of Directors has established oversight mechanisms with respect to risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 13 years of IT security experience in regulated industries such as government, energy and biopharma. He has over 20 years of combined IT experience.


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting includes topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on cybersecurity risks, see Item 1A. Risk Factors—"Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of homebuyers and borrowers and information about our employees, contractors, vendors, and suppliers. Our Financial Services business relies heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. As such, we have established information security practices leveraging the National Institute of Standards of Technology (NIST) Cybersecurity Framework to measure our security posture, deliver risk management, and provide effective security controls to protect the privacy and confidentiality of our information. Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. Our program further includes review and assessment by external, independent third parties, who assess and report on our defense posture and internal incident response preparedness and help identify areas for continued focus and improvement.

companyName: Century Communities, Inc.

ticker: CCS


text: Role of Management We have an Information Security team that is led by our Chief Information Officer (CIO). Our CIO has led the Century Communities IT efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.


text: We are a member of the Center for Internet Security (CIS), which assists our management in policy and technical support. Some of the benefits of our CIS membership include direct access to cybersecurity advisories and alerts, vulnerability assessments and incident response for entities experiencing a cyber threat, secure information sharing through the Homeland Security Information Network (HISN) portal, tabletop exercises, and weekly malicious domains/IP reports.


text: The CIO, in his capacity, regularly informs the Corporate General Counsel, Chief Financial Officer (CFO) and Co-Chief Executive Officers (CEOs) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.


text: The CIO and the other members of senior management play a key role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of twice per year. These briefings encompass a broad range of topics, including emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and updates regarding compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and other members of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity field, ensuring the Board's oversight is proactive and responsive. Senior management actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives, and is involved in incident materiality determinations that would trigger cybersecurity incident disclosure obligations. This active involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: Since September 2022, we have engaged a seasoned cyber consultant from the global cybersecurity risk firm, Kroll, LLC, to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to an event compromising information and systems security, working closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber related risks. The Audit Committee, which is comprised of entirely independent directors, oversees our (i) information security policies, including periodic assessment of risk of information security breach, training program, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.


text: As mentioned above, our management team meets with the Audit Committee at least twice a year to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of any potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.


text: The Audit Committee is composed of members with diverse expertise including, risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee has retained and consulted with Kroll to assist the Audit Committee in its cyber security oversight responsibilities. Because the method and sources of cyberattacks change frequently, Kroll provides invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices. Kroll typically attends and presents at two Board meetings each year.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team and Information Security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We utilize the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines 108 subcategories of security controls and outcomes over five functions: identify, protect, detect, respond and recover.


text: In November 2022, Kroll conducted a security maturity assessment of our security system. To perform its assessment, Kroll met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, security road maps and plans. The Century Communities Information Security Team have been working with Kroll to identify potential deficiencies in each category and work to close the identified gaps. With Kroll's assistance, we have implemented several industry leading solutions, policies and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been peer reviewed by Kroll. Additionally, we have retained Kroll to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in September 2023.


text: The company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals.


text: Our Information Security team conducts annual information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees on important topics such as spoof login, impersonation attack, identity theft, stolen laptop, and passwords. Each module contains a video vignette followed by a quick quiz.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers like Kroll.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of homebuyers and borrowers and information about our employees, contractors, vendors, and suppliers. Our Financial Services business relies heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. As such, we have established information security practices leveraging the National Institute of Standards of Technology (NIST) Cybersecurity Framework to measure our security posture, deliver risk management, and provide effective security controls to protect the privacy and confidentiality of our information. Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. Our program further includes review and assessment by external, independent third parties, who assess and report on our defense posture and internal incident response preparedness and help identify areas for continued focus and improvement.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.


text: Our risk management team and information security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We leverage the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines subcategories of security controls and outcomes over five functions: identify, protect, detect, respond, and recover.


text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: Since September 2022, we have engaged a seasoned cyber consultant from a global cybersecurity risk firm to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to events compromising information and systems security, and works closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.


text: In 2024, a Security Posture Assessment was conducted by a leading global cybersecurity firm. To perform its assessment, the consultants met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, and security road maps and plans. When such risk assessments are performed, we work with our CISO-level advisor to review any findings from the risk assessment and to identify potential deficiencies in each category and work to close the identified gaps. With our CISO-level advisor's assistance, we have implemented several industry leading solutions, policies, and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been reviewed by our CISO-level advisor. Additionally, we retain a variety of cybersecurity consulting firms, including our CISO-level advisor, to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in December 2024.


text: The Company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals. We have introduced a third-party vendor risk management solution and professional service to survey and monitor the Company's critical vendors at on-boarding and on a reoccurring basis.


text: Our information security team conducts annual information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees on important topics such as spoof login, impersonation attack, identity theft, stolen laptop, and passwords. Each module contains a video vignette followed by a quick quiz.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact or are reasonably likely to materially impact our business operations, operating results, or financial condition.


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers.


text: If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of Management Our information security team that is led by our Chief Information Officer (CIO) is responsible for implementing and operating our Cybersecurity Risk Management program.


text: Our CIO has led our efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.


text: We are a member of the Center for Internet Security (CIS), which assists our management in policy and technical support. Some of the benefits of our CIS membership include direct access to cybersecurity advisories and alerts, vulnerability assessments and incident response for entities experiencing a cyber threat, secure information sharing through the Homeland Security Information Network (HISN) portal, tabletop exercises, and weekly malicious domains/IP reports.


text: The CIO, in his capacity, regularly informs the Executive Chairman, Chief Executive Officer, Corporate General Counsel, and Chief Financial Officer, of aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.


text: The CIO and the other members of senior management play a key role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of twice per year. These briefings encompass a broad range of topics, including emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and updates regarding compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and other members of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity field, ensuring the Board's oversight is proactive and responsive. Senior management actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives, and is involved in incident materiality determinations that would trigger cybersecurity incident disclosure obligations. This active involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber-related risks. The Audit Committee, comprised fully of independent directors, is responsible for oversight of our (i) information security policies, including periodic assessment of risk of information security breach, training programs, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.


text: The CIO and members of management meet with the Audit Committee on a regular basis to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.


text: The Audit Committee is composed of members with diverse expertise including risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee relies on the CIO and independent feedback from outside advisors, such as our CISO-level advisor, on the current and future cybersecurity program to assist the Audit Committee in its cybersecurity oversight responsibilities. Because the method and sources of cyberattacks change frequently, our outside advisors, including our CISO-level advisor, provide invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices.


text: At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of the program and our environments.


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design an effective layer of controls as a baseline. We regularly conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our systems, networks, and data infrastructure to identify vulnerabilities and potential threats. Our cybersecurity program also includes a dedicated function for third party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives aim to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and regular communications about cybersecurity topics and threats.


text: Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.


text: We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program and our enterprise risk management process, which evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.


text: Our management recognizes the importance of implementing and maintaining robust cybersecurity measures designed to address cybersecurity threats that pose risks to our business and operations. Therefore, we have established a comprehensive framework to identify, protect against, detect, respond to, and recover from cybersecurity incidents ("Incidents"). Our cybersecurity measures are designed to provide a structured approach to managing cybersecurity risks for an effective, efficient, an orderly response to any Incident.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.


text: Increased cybersecurity risk due to the diversification of our data across external service providers and cyber incidents may adversely affect our business by causing a disruption to our operations, compromise our confidential information and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our financial position, results of operations and/or business strategy. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future where we may be unable to implement effective preventative measures in a timely manner.


text: Further discussion of the potential impacts on our business from cyber intrusions is provided in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). The REIT Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: Ladder has a cybersecurity risk management program that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. Our cybersecurity risk management program is also a key component of our overall risk management program.

companyName: Ladder Capital Corp

ticker: LADR


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, and along with the emerging use of artificial intelligence ("AI"), could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel, Chief Compliance Officer and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies.


text: Ladder conducts routine risk assessments to identify cyber threats and vulnerabilities and assess the likelihood of occurrence and severity of the impact of such threats and vulnerabilities on the Company. Ladder regularly updates the risk assessment in order to inform Ladder's cybersecurity program and controls and to prioritize risk mitigation and remediation in an evolving threat landscape. Ladder maintains cybersecurity policies and procedures designed to manage these risks and ensure that the Cybersecurity Team and other relevant employees are informed of cybersecurity incidents in a timely manner. These policies include incident response, data classification, physical and network security polices, remote access, record retention and secure destruction policies. The Cybersecurity Team conducts a formal evaluation of Ladder's applicable policies and cyber risks and mitigants on at least an annual basis. Ladder's outsourced technology firm, as well as internal auditors, participate in this evaluation.


text: Ladder also maintains processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers based on the service provider's risk profile. Ladder does not generally maintain consumer data, and does not extensively leverage third parties to manage or process sensitive data. Most of the third parties that have access to sensitive information belonging to us or our borrowers, clients or other counterparties are lenders, law firms and other third parties that require such access in connection with Ladder's commercial lending activities. These third parties tend to be highly regulated and generally maintain mature cybersecurity programs and data security controls. When Ladder leverages third-party service providers that collect or maintain sensitive information, Ladder conducts initial diligence on such third parties and conducts ongoing monitoring that includes annual due diligence questionnaires and contractual data security protections. In addition to the policies and procedures discussed above, Ladder leverages industry standard third-party technology, tools and services to assist in monitoring, detecting and managing cyber threats, including managed security service monitoring, endpoint detection and response tools. Ladder also maintains other appropriate cybersecurity controls, including: • Annual penetration testing by rotating third-party vendors; • Vulnerability scans; • Company-wide cybersecurity training, including quarterly phishing exercises; • Tabletop exercises; • Vendor cybersecurity diligence; and • Cyber insurance.


text: The Audit Committee, on behalf of the board of directors, is responsible for oversight of the Company's strategies to assess and mitigate cybersecurity risks, as set forth in the Audit Committee's charter. The Audit Committee receives quarterly or as needed updates from the CTO regarding the cybersecurity risks the Company faces based on the current cybersecurity threat landscape, as well as the status of the measures undertaken by the Company to manage those risks.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, along with the emerging use of AI, could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel (the "GC"), Chief Compliance Officer (the "CCO") and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies. The GC helped establish and continues to oversee the Company's cybersecurity risk management framework, including a best practice approach to cybersecurity governance, testing and diligence. The CCO helps ensure adherence to regulatory standards and helps refine our cybersecurity policies and training initiatives.