text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee oversees cybersecurity and other risks through reporting from management, including the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA

secItem: Item 1C


text: In addition, the Audit Committee of the Board monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with the Audit Committee for review of information security matters, as needed.


text: The CISO is responsible for assessing and managing material cyber risks. The CISO's expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. The CIOO, the CISO, and others, report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.


text: The Risk Committee receives information on cybersecurity risk, including risk appetite utilization, breaches and emerging risks, and the control environment, directly or indirectly, from various sources, including the CIOO, CISO, and each of the Management Committees. Additionally, the Risk Committee reviews BancShares' information security policy and program with a focus on whether they are appropriate to protect data, records, and proprietary information of BancShares as well as that of its customers and employees.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes the VP of IT, reviews enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: The VP of IT is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VP of IT has over two decades of experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least quarterly and assess the vendor-provided System and Organization Controls (SOC) 1 or SOC 2 report on an annual basis. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit and Risk Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit and Risk Committee performs an annual review of the Company's cybersecurity program and the Company's overall risk assessment, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit and Risk Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives regular cybersecurity updates, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Business Continuity Plan, which covers, among other things, potential cybersecurity incidents, and potential impacts to data privacy and compliance. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, the Board has hosted an outside expert to discuss developments in the cybersecurity threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced potential threats to and incidents related to our data and systems, including malware and phishing attempts. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other technology assets (and the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third parties, or an inability to effectively upgrade such systems and assets, including operating system integration of acquired companies, could cause a significant disruption to our business and have a materially adverse effect on our results of operations" in Item 1A- Risk Factors.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The VPs of IT are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VPs of IT have extensive experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants, which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Office ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.

companyName: M/I HOMES, INC.

ticker: MHO


text: Members of senior management are notified by our Information Security Committee if any cybersecurity incident leads to a breach or loss of any data. These members of senior management are responsible for promptly determining if such an incident is material and notifying our CEO, CFO and our Board of Directors of the material incident and the impact that the incident has had, and is expected to have, on the Company's reputation, results of operations, financial condition, and business strategy. The Company engages third-party auditors and consultants to evaluate and assist the Company in responding to cybersecurity threats and incidents, and, if necessary, monitoring any exposure of confidential company or customer data. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies, procedures and strategy, assess our security status, and align our cybersecurity practices with current and emerging cybersecurity risks.


text: We conduct thorough security assessments of all third-party service providers before engagement and perform regular monitoring of the third-party service providers' hosted applications designed to ensure compliance with our cybersecurity standards. This occurs through annual assessments by our internal audit function of the third party's System and Organization Controls ("SOC") 1 or SOC 2 report or through additional user access reviews by the internal business owner if a SOC 1 or SOC 2 report is unavailable.


text: Our CIO and his security management team possess primary responsibility for identifying, assessing, monitoring, and managing our cybersecurity risks. Our Board of Directors directly oversees cybersecurity risks, which includes conducting an annual review of the Company's cybersecurity risks, management's actions to identify and detect threats, management's action plans for response and recovery situations, and review of recent enhancements to the Company's defenses and strategic cybersecurity roadmap. In addition, the Audit Committee receives quarterly cybersecurity updates, which include a review of new processes implemented to monitor cyber risks, and a summary of any recent threats and the Company's response to those threats.


text: Our CIO has over 30 years of experience in information technology, including a deep understanding of information technology governance, regulatory compliance and familiarity with the software, tools and programs used by his security management team to identify vulnerabilities, investigate incidents and implement appropriate security measures. In addition, our security management team maintains appropriate and relevant levels of education and certifications, such as Certified Information Security Manager (CISM) and Certified Ethical Hacker (CEH). Furthermore, all employees are required to complete a biannual security awareness training course focusing on data protection, phishing prevention, and credential protection.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we face a number of cybersecurity risks in the normal course of our business and, from time to time, experience threats to our data and systems, including malware and computer virus attacks. Notwithstanding the extensive measures we employ to address cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that would be reasonably likely to materially affect us. Although we maintain cybersecurity insurance, the costs we incur related to cybersecurity threats or disruption may not be fully insured. See "Item 1A. Risk Factors" in Part I of this Annual Report on Form 10-K for more information regarding the risk factors associated with cybersecurity risks.


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants), which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The Company has integrated cyber security into its annual risk assessment process. This process identifies critical assets and assesses those assets for potential threats and vulnerabilities. Risks are prioritized based on their impact and likelihood. Controls are assessed to ensure the Company's controls are appropriate to mitigate risks. It also allows us to identify any gaps that we need to focus on. These gaps are typically part of the Information Security Committees risk register. The Information Security Committee meets quarterly and continuously monitors and re-evaluates risks through this risk register, which was initially developed using the NIST CSF framework. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats, and is committed to the prevention, detection, and timely response to cybersecurity threats that may impact the confidentiality, integrity, and availability of its information systems and information assets.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Company has an Information Security Risk Management Program and a Technology Risk Management Program under its Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.


text: The Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the Chief Information Security Officer. On average, the Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. All information security managers have attained a bachelor's degree in a related field of study, with several also having a related master's degree.


text: Zero trust principles" drive the Company's information security architecture, and the Company deploys a "defense in-depth" strategy to protect against cybersecurity threats, layering multiple levels of information security and technology controls within business processes for information assets and relationships with third parties based on the National Institute of Standards and Technology Special Publication 800-53 Framework. The Company's information systems and risk management are also subject to regulatory requirements and examination by federal banking regulators.


text: The identification of control weaknesses and vulnerabilities affecting information assets and/or relationships with third parties allows the Company to mitigate risk from, and respond to, cybersecurity threats. Initial risk assessments are performed upon the acquisition, or as part of the development of, information assets in order to evaluate the inherent risk associated with network and host environments and assess the adequacy of implemented technology operation processes and controls. Risk and control self-assessments are conducted on an annual basis to identify gaps resulting from any process changes that occurred during the year, and to evaluate whether the levels of cybersecurity risk remain within the tolerance set in the Company's Risk Appetite Statement or whether a risk needs to be mitigated.


text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool and the Center for Internet Security Critical Security Controls.


text: Because cybersecurity threats continue to evolve, thereby increasing inherent risk, the Company's Corporate Information Security team is augmented by contracted external managed security service providers, who collectively work 24/7 to monitor cybersecurity threats through processes such as endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties test the Company's cyber capabilities and audit its cloud security. The Company regularly tests its systems to discover and address any potential vulnerabilities. Senior and Executive management also participate in cybersecurity industry collaboration and information-sharing forums and utilize the information gained to drive protective and detective cybersecurity strategies and tactics.


text: The Company requires information security education, training at the time of hire, and annually thereafter, by its employees (including contractors and other third parties for training purposes), designed to mitigate accidental information security incidents. Phishing simulation activities are regularly conducted to assess employees' competency at identifying potential threats. Employees are assigned incremental training requirements should they fail to identify simulated phishing emails through the initial training.


text: The Company's Corporate Information Security team members are also responsible for completing additional mandatory annual training to understand the processes, procedures, and technical requirements for securing information assets across the enterprise. The Company also offers ongoing practice and specialized education for Corporate Information Security team members to stay up to date with emerging trends in cybersecurity threat protection, detection, and response.


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the Chief Information Security Officer, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response Team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.


text: Cybersecurity threats that are identified and deemed material are escalated and communicated directly to Senior and Executive Management and the Risk Committee of the Board of Directors. Materiality determinations are made under the Company's Disclosure Controls and Procedures to ensure timely cybersecurity incident disclosure notification in accordance with securities laws and/or regulations.


text: Material Cybersecurity Threat Risks. The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2023. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.


text: Oversight of information security risk and information technology risk is the operational responsibility of the Information Risk Committee, which is a management committee, with additional oversight from the Enterprise Risk Management Committee, which is also a management committee, and the Risk Committee of the Board of Directors.


text: Additional information regarding the Company's risk management framework, including management-level and Board-level committee experience and expertise, oversight responsibilities, and information risk governance, can be found under the section captioned "Risk Management Framework" contained in Item 1. Business.


text: The Company has a Technology Risk Management Program (First Line), including Cyber and Information Risk Management, and an Information Risk Management Program (Second Line) under its Enterprise Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Cyber and Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.


text: The Cyber and Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the CISO and the CIO. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management. She has numerous industry certifications, including Certified Information Systems Security Professional and Certified in Risk and Information Systems Controls certifications. She is a member of ISACA's global Governance of Enterprise Information & Technology Advisory Group and Securing AI Certification Working Group. Our CIO has over 25 years of relevant experience in large scale digital transformation, strategic planning, talent development, global technology delivery, and operational experience. Our CIO has deep expertise across the financial services industry and in leading organizations through change. He is a member of the CNBC Technology Executive Council, where he contributes to ongoing discussions and insights on the latest trends and challenges in technology. In addition, he is a member of the Wall Street Journal CIO Network, a collective community of leading technology experts from the world's most influential companies. Both our CISO and CIO also participate in various financial services industry committees and cybersecurity advisory boards.


text: On average, the other Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. For most of these certifications, there is a continuing professional education requirement to maintain a consistent level of learning by completing certain professional activities, such as attending conferences and workshops, completing online training courses, and participating in professional association meetings, throughout the certification cycle to maintain an active credential. Further, each employee is responsible for an effective cybersecurity defense which is enforced with mandatory cyber awareness training, periodic newsletters, and security updates.


text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the National Institute of Standards Cybersecurity Framework, the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls.


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels to validate roles and responsibilities and response protocols respective to cybersecurity threats. The outcomes of these tabletop exercises are reviewed annually at the Board of Directors level.


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the CISO, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.


text: Material Cybersecurity Threat Risks. Risks from cybersecurity threats have not materially affected the Company, its business strategy, results of operations, or financial condition for the year ended December 31, 2024. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.


text: Oversight of information security risk and information technology risk is the responsibility of the Information Risk Committee, a management committee, with additional oversight from the Enterprise Risk Management Committee, a management committee, and the Risk and Technology Committees of the Board of Directors. On at least a quarterly basis, the Corporate Information Security team provides reports on updates to the Company's information risk profile, emerging risks and threats, results of examinations, status of remediation plans and/or results of remediation activities, risk reports and risk assessment results, and risk metric results to the Information Risk Committee, who then provides such information to the Enterprise Risk Management Committee and the Risk Committee of the Board of Directors. In addition, on at least a quarterly basis, this information, along with updates on key cybersecurity initiatives, is shared with the Technology Committee of the Board of Directors, who provides oversight on information security and information technology strategy and governance.


text: Cybersecurity Risk, Strategy and Governance The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: The Company's Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has significant experience in information technology and many of our information technology team members hold qualifications in technology security positions. We maintain a cross-functional Cybersecurity Committee, as well as a Global Security Committee consisting of the information technology professionals and security managers from each country in which we have operations.


text: We have both policies and procedures that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. Our CIO, together with our Global Security Committee, reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.


text: We also endeavor to apprise employees of emerging risks and require them to undergo regular security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with third-party vendors to perform external penetration testing, which identifies potential threats and reduces the impact and/or likelihood of these threats. Our employees perform similar intrusion tests and internal and external scans to help improve and harden the company's security posture. We also conduct security assessments of our IT vendors and certain business partners and maintain cyber incident response plans that are periodically reviewed and updated by our IT Security and Cyber Defense Teams and leveraged table top exercised performed by our IT teams. The incident response plan ties into our Cybersecurity Committee processes for review to ensure the required reporting of material incidents to the Board of Directors, as applicable.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks as part of its risk management oversight. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports from the CIO regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business as an owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.

companyName: EQC Liquidating Trust


text: The Company employs a number of cybersecurity measures intended to reduce the likelihood that cybersecurity incidents materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they have had cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing onboarding and other periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We have also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.


text: The Company has created and maintains processes that provide a playbook in the event of a cyber incident. These processes provide assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics and legal providers and law enforcement in the Company's response plan. The Company also has instituted a variety of safeguards to counter ransomware threats.


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel, as well as similar processes in case of a crisis-related event at our portfolio properties. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats, including any past cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. There can be no assurances, however, that we or our third-party service providers will not experience a future system disruption, attack or security breach that materially impacts the Company, our business strategy, results of operations or financial condition. For more information refer to "Item 1A. Risk Factors—Risks Related to Our Business—We rely on information technology in our operations, and any material failure, inadequacy or security failure of that technology could harm our business".


text: Board of Trustees' and Management Oversight Our Board of Trustees oversees our cybersecurity program and initiatives through its Audit Committee. The Audit Committee, in consultation with management, actively oversees and manages the Company's cybersecurity risk, including periodically reviewing our policies and procedures with respect to risk assessment and risk management.


text: As part of its cybersecurity oversight role, the Audit Committee meets regularly with the Company's executive officers and senior IT personnel to discuss the Company's policies, procedures and other measures put in place to protect its business systems and information against cyber-related attacks and risks, as well as to discuss recent cyber and IT trends.


text: Through the policies, plans, guidelines and processes the Company has implemented, any material cybersecurity incident would be reported to our executive officers as well as the Audit Committee and/or the Board.


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University. Our IT department has more than 25 years of combined experience. The members of our IT department have experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business, including as a former owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department has experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: A number of cybersecurity measures were employed to reduce the likelihood that cybersecurity incidents would materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they experienced cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.


text: We also created and maintained processes that provided a playbook in the event of a cyber incident. These processes provided assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics, legal providers and law enforcement as part of the response plan. We also instituted a variety of safeguards to counter ransomware threats.


text: We integrated our cybersecurity program into our overall risk management processes by instituting corporate measures and protocols to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also addressed employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats, including any past cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition.


text: Trustee Oversight Senior personnel from our IT department managed our cybersecurity program on a day-to-day basis. For EQC, o ur Board of Trustees oversaw our IT department's management of our cybersecurity program through its Audit Committee. For EQC LT, our Trustees oversaw our IT department's management of our cybersecurity program.


text: Through our policies, plans, guidelines, processes and other communications, any material cybersecurity incident would have been reported to our executive officers, as well as to the Audit Committee and/or the Board of the Company, and to the Trustees of EQC LT.


text: Management Oversight Our cybersecurity program was managed on a day-to-day basis by our IT department, which was led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department's experience included network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also included IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: General Motors Financial Company, Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Cybersecurity, Information Technology and Data Management Practices," which is incorporated by reference into this Item 1C.


text: The GM Board of Directors established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. Our Global Chief Information Security Officer provides the Risk and Cybersecurity Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides periodic reports to our Board of Directors.


text: Our team of cybersecurity professionals is led by our Global Chief Information Security Officer, who has over 20 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our cybersecurity team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program) that is informed in part by international frameworks as well as our specific security requirements and cybersecurity risk profile. We have implemented policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Our Cybersecurity Program also includes an incident response process that is overseen by our Vice President of Cybersecurity and supported by an internal team of cybersecurity specialists, with involvement from business, legal and senior management as appropriate. In the event of a cybersecurity incident, a technical cybersecurity team investigates and addresses the threat, while a cross-functional team assesses the incident to inform criticality determinations and response efforts, including escalations of the incident to senior management as appropriate.


text: We evaluate and update our cybersecurity risk profile through ongoing assessment of the cybersecurity threat landscape and security monitoring. Our cybersecurity risk profile is used as an input to identify, assess and update our Cybersecurity Program, and associated priorities are updated as new risk information becomes available. Information security, including cybersecurity, is also incorporated into our overall Enterprise Risk Management (ERM) program. Our ERM Operating Committee includes members in senior leadership positions across various functional areas that evaluate enterprise risks and develop and monitor associated mitigation plans. Cybersecurity related risks are included in the risk universe that the committee evaluates to assess top risks to the enterprise. As part of our ERM program, our executive leadership team receives annual updates on enterprise risks, including cybersecurity risks, as well as their potential impact, likelihood, potential mitigation plans and status.


text: Our Cybersecurity Program, and portions thereof, are periodically reviewed by third-party assessors, consultants, auditors or other firms. For example, we periodically conduct penetration tests and tabletop exercises to simulate attacks against our infrastructure, systems, or portions thereof, in order to validate the efficacy of our security controls and response capabilities. Such exercises are typically conducted with assistance from third-party advisors and experts. Incident response efforts are also supported by external resources such as legal advisors, cybersecurity forensic firms, communications specialists, and other outside advisors and experts as well as law enforcement support, as appropriate. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources, and such third parties may also help reduce costs, increase efficiency and/or improve the quality of our Cybersecurity Program.


text: Our supplier community (including suppliers of IT services and other third-party service providers) plays a large role in Qualcomm's success, and we believe in engaging with our suppliers to help them protect against cybersecurity threats. We operate a supplier cybersecurity assurance program, which is integrated with our procurement processes and supported by the relevant groups within the legal organization, to assess and attempt to mitigate potential cybersecurity risks across our supplier community commensurate with their cybersecurity risk. Specifically, based on a risk classification of the supplier, our third-party risk management process includes steps such as the evaluation of a supplier's security controls, posture and maturity as well as the identification and treatment of cybersecurity-related risks.


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or implement fully effective preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2024, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see Part I, Item 1A, "Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee of our Board assists the Board in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Vice President of Cybersecurity, on at least a semi-annual basis. At least annually, the full Board also receives updates on the Cybersecurity Program and cybersecurity risks. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization, and certain legal functions under the office of the General Counsel, which includes subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. That experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.


text: To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program), which includes policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or guarantee the effectiveness of our preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2025, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see "Part I, Item 1A. Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Chief Information Officer (CIO) and Vice President of Cybersecurity, on at least a semi-annual basis. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our CIO, Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization and certain legal functions under the office of the General Counsel, which include subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our CIO has over 30 years of experience in IT and telecommunications and previously held CIO or other IT leadership roles at DISH Network (now EchoStar), CenturyLink, Level 3 Communications and TW Telecom prior to joining Qualcomm. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. This experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.


text: Park assesses, identifies, and manages risks from cybersecurity threats consistent with its broader risk management and operations systems, processes, and controls. Park's information security and cybersecurity operations teams have primary responsibility for guarding against cybersecurity threats. The teams employ numerous security tools such as for threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, and including end-point protections, webproxy, anti-malware, and email security protections. Park uses multi-factor authentication for computer and mobile devices, encryption technology, and requires virtual private network access to Park's network for all remote employees. Park engages in annual recovery and information security tabletop exercises to simulate threats and events. Park engages third parties on an annual basis to conduct and report on penetration testing exercises. Park administers mandatory security awareness training to all associates on a monthly basis, enhanced administrator access training for security-related positions on an annual basis, and routinely administers employee email phishing testing and training. Topics of training include escalating suspicious activity, malware, insider threats, and email security.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: Park maintains a third-party risk management program that is designed to evaluate, monitor and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.


text: In designing and carrying out cybersecurity controls, Park follows the National Institute of Standards and Technology Cyber Security Framework for measuring readiness to respond, Sarbanes Oxley for assessment of internal controls, the Gramm-Leach-Bliley Act regarding information security, the Office of Comptroller of the Currency's Cybersecurity Supervision Work Program, Interagency Guidance on Third-Party Relationships: Risk Management, other applicable regulatory guidelines, and federal and state laws.


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team prepares and issues a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, and risk assessments. Park's cybersecurity operations team also prepares and issues a quarterly report to the full Board of Directors identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, and fraud and security, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.


text: Park's business strategy, results of operations, and financial performance have not been materially affected by risks from cybersecurity threats. Park cannot provide assurance that business strategy, results of operations, or financial performance will not be materially affected in the future by such risks or any future incidents.


text: Park maintains a third-party risk management program that is designed to evaluate, monitor, and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team and cybersecurity operations team jointly prepare and issue a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, risk assessments, identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, corporate fraud and security, and fraud prevention, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security ("CIS"). The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Axogen, Inc.

ticker: AXGN


text: The Company's cybersecurity program focuses on the following areas: a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: d. Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: e. Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.


text: f. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically.


text: g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: h. Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the the Company's VP of Information Technology, Security and Business Intelligence and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.


text: The Company's VP of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's VP of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The VP of Information Technology, Security and Business Intelligence holds a MBA from Boston University, a Master's degree in Electrical and Computer Engineering from Utah State University, and a Bachelor's degree in Electronics Engineering from Mumbai University. The Company's Information Technology team has specific professional certifications, and has over 10 years of experience with managing risks arising from cybersecurity threats.


text: The Company's VP of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the VP of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's IP; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.


text: h. Governance: The Board's oversight over the effectiveness of the Company's cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Vice President of Information Technology, Security and Business Intelligence and other members of the cyber team and management.


text: The Board, in coordination with the Audit Committee, oversees the effectiveness of management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.


text: The Company's Vice President of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The Vice President of Information Technology, Security and Business Intelligence holds a master's degree in business administration from Boston University, a master's degree in electrical and computer engineering from Utah State University, and a bachelor's degree in electronics engineering from Mumbai University. The Company's Information Technology team has specific professional certifications and has over 10 years of experience with managing risks arising from cybersecurity threats.


text: The Company's Vice President of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the Vice President of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC). Mitek uses guidance from standard bodies such as the NIST (Cyber Security Framework). Mitek also adheres to Service Organization Control (SOC2) security framework for securing customer data.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of Confidentiality, Integrity and Availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring: • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.


text: We assess and test our cybersecurity policies and practices on an annual basis. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess and test our cybersecurity measures.


text: We perform risk assessments on critical third-party service providers, software and other tools used in the Company's operations that may have the potential to create cybersecurity threats to our business.


text: We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure.


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors has ultimate oversight of the Company's risk management. Our Board receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises our cybersecurity personnel. Our Head of IT's experience includes over 25 years of design, implementation and management of cyber-security & information technology programs at various levels and organizations.


text: The Company maintains a comprehensive information security program that is designed to identify, protect against, detect, and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Our Information Security Policy provides guidance on the requirements necessary to ensure the security of the Company's data, systems, and networks. It applies to all individuals who access IT resources or data processed by the Company. We use commercially reasonable efforts to follow industry standards and best practices, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, for our IT Security Incident Response Plan.


text: Our technology structures undergo an annual internal assessment to evaluate risk using the NIST Cybersecurity Framework; our assessment methodology and a thorough sampling of our results are validated annually by a third party. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.


text: Our IT Application Security Program includes reviews and assessments of security vulnerabilities and remediation. We use commercially reasonable efforts to update security systems regularly to protect against known vulnerabilities. We plan to perform vulnerability scans at least quarterly and penetration testing annually as well as after any significant infrastructure or application modification. Whitebox and blackbox security testing and manual penetration testing is performed to monitor security controls and defenses.


text: All employees and third-party contractors with access to the Company's IT infrastructure must annually acknowledge that they have read and understand the IT User Acceptance Policy. Employees and contractors must also complete information security awareness training upon initial hire and annually thereafter.


text: We have measures in place to protect the confidentiality, integrity and availability of franchise and customer information. Most personally identifiable information ("PII") handled by our restaurants is associated with payment cards, which are protected by an EMV chip reader that encrypts and tokenizes customer data, so it passes through our networks without retaining any personal information. We do not store any credit or debit card information from customers. All information is processed through a third-party firm. To maintain the safety and security of our customers' private payment information, we follow the Payment Card Industry Data Security Standard ("PCI DSS") to ensure our processes and systems are well equipped for proper data protection. Employees and third-party contractors with access to the Company's cardholder data environment ("CDE") or systems used to support the CDE, complete annual PCI awareness training. The Company's corporate restaurant employees also receive periodic security training on devices that capture payment card data.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls applied to financial business processes and supporting information systems are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements.


text: Our Board of Directors has charged the Audit Committee with oversight of the Company's identification, assessment, and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. Our Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") manage our network operations and software development across corporate and franchise locations. The Board of Directors receives regular updates from the CISO and CTO regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.


text: Our technology structures undergo an annual assessment to evaluate risk using the NIST Cybersecurity Framework. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.


text: We recognize the importance of cybersecurity in achieving our business objectives, safeguarding our assets, and managing our daily operations. Accordingly, we integrate a process for identifying, assessing, and managing material risks from cybersecurity threats into our overall risk management system. The Audit Committee of our Board of Directors oversees all matters related to the security of and risks related to information technology systems and procedures, including cybersecurity policies and procedures.

companyName: EMCORE CORP


text: Our cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents, is managed by our Director, IT, who has worked in information technology and communications services for over 25 years. Our cybersecurity program incorporates an incident response plan to engage cross-functionally across the Company and report cybersecurity incidents to appropriate levels of management, including senior management and the Audit Committee or Board of Directors, based on potential impact. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging larger, well-known third-party service providers with significantly greater cybersecurity capabilities than we possess to monitor cybersecurity events and provide rapid responses to any critical events, including with respect to Managed Detection and Response (MDR) and Endpoint Detection & Response (EDR). Because we rely on their more significant expertise, our ability to identify and remediate weaknesses or vulnerabilities is limited to their services. We have engaged with third parties to assess our cybersecurity defenses biweekly and audit our cybersecurity program. We also conduct annual penetration tests of our information systems via independent third-party cybersecurity experts to evaluate our systems and provide remediation and recommendations to improve our cybersecurity program. We also conduct annual cybersecurity awareness training. We aim to incorporate industry best practices throughout our cybersecurity processes, and our cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. We are compliant with DFARS 252.204-7012 and DFARS 252.204-7020 and have a compliant NIST SP 800-171 self-assessment status.


text: As of the date of this report, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: While we believe our cybersecurity program is appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see Item 1A. "Risk Factors" in this report.


text: Managing cybersecurity risks and securing our sensitive data and systems are a critical part of our business operations and of paramount importance to our organization. Consequently, our cybersecurity risk management program is integrated into our overall enterprise risk management (ERM) program.

companyName: CARROLS RESTAURANT GROUP, INC.