text: We utilize various processes and tools to assess, identify, and manage risks from cybersecurity threats. In the development of our products and features, our security teams work with our engineering and product teams to identify, assess, and agree upon mitigation or remediation measures with respect to product development. On an ongoing basis, we encourage an environment of openness in which our engineering and product teams, led by our security teams, proactively identify, manage and discuss actual or perceived cybersecurity risks. These teams also use automated and manual processes to identify and track risks from cybersecurity threats. The identified risks are triaged, prioritized for remediation, and reported by the security teams to various levels of our senior management, as appropriate. We also deploy technical safeguards that are designed to protect our platform and systems from cybersecurity threats, including firewalls, intrusion prevention, and detection systems. We have established an incident response plan that addresses our response to cybersecurity incidents, and we require periodic training for our employees on cybersecurity threats. In addition, we maintain cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Datadog, Inc.

ticker: DDOG


text: In addition, we maintain third-party vendor management standards that are used to evaluate cybersecurity risks associated with our third-party service providers, and we assess information technology and software vendors to determine their security posture and maturity. All vendors that process our data or access our systems go through a security and privacy review before they are engaged that is targeted to the services to be provided and the systems and data involved. Based on the information provided by the vendor and depending on the nature of the services provided, our vendor management process may involve security questionnaires and contractual obligations such as audit rights and breach reporting.

secItem: Item 1C


text: We also periodically perform various types of security audits and assessments, including penetration tests, via internal and external parties. In addition, certain Datadog products are subject to specific compliance requirements and standards, including, as applicable, ISO 27001, SOC 2, PCI, and FedRAMP (Low and Moderate), and are tested and evaluated by third-party auditors against those applicable compliance requirements and standards. The identified risks from such audits and assessments are triaged, prioritized, reported by our security teams to various levels of our senior management and tracked and remediated depending on the severity.


text: Our internal audit function conducts annual interviews across business groups to identify key areas of risk, including cybersecurity risk. This enterprise risk assessment helps inform the internal audit plan, and both the assessment and progress against the internal audit plan are periodically presented to the Audit Committee. Our Chief Information Security Officer also reports separately to our Audit Committee on cyber and information security risk on a quarterly basis.


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or our third-party service providers experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."


text: Our Board of Directors has delegated its oversight of risks associated with cybersecurity to its Audit Committee. Generally, each quarter, the Audit Committee reviews and discusses with our Chief Information Security Officer material cybersecurity risks and our processes for assessing, identifying, and managing such risks, and the Audit Committee will receive updates as necessary between each quarterly meeting. In the event of a material cybersecurity incident, the Audit Committee will be notified, and the Board of Directors will also receive updates on cybersecurity risks and incidents, as appropriate.


text: Our Chief Information Security Officer and Chief Technology Officer are the members of our executive team who are principally responsible for overseeing our cybersecurity risk management program. Our Chief Information Security Officer and Chief Technology Officer are informed about cybersecurity threats through their involvement with the processes set forth above. For example, our Chief Information Security Officer receives regular reports on identified cybersecurity risks and progress toward remediation from our security teams and both our Chief Information Security Officer and Chief Technology Officer are notified of cybersecurity incidents and the management of such incidents in accordance with the escalation procedures of our incident response plan.


text: We believe these members of our executive team have the appropriate expertise, background, and experience to manage risks arising from cybersecurity threats. Alexis L -Qu c is one of the co-founders of our company and has served as our Chief Technology Officer and a member of our board of directors since June 2010. Mr. L -Qu c has extensive knowledge and experience from building and leading the development of our technology and from his decades of experience in the technology industry. Prior to co-founding Datadog, Mr. L -Qu c worked at Wireless Generation from March 2004 to December 2010, where he most recently served as Director of Live Operations. Previously, Mr. L -Qu c held engineering positions at a number of technology and software companies, including IBM Research and France T l com S.A. Mr. L -Qu c received his M.S. in Computer Science from CentraleSup lec. Emilio Escobar has served as our Chief Information Security Officer since September 2020. With two decades of experience in information security and compliance, Mr. Escobar has worked at large enterprises, medium-sized companies, and governmental organizations. Previously, Mr. Escobar served as the Vice President of Information Security for Hulu, where he played a pivotal role in setting up key security functions. Prior to that, Mr. Escobar worked for PlayStation, where he built and ran the software security teams. Mr. Escobar holds a BS in Computer Science from the University of Puerto Rico.


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or the third parties with whom we work experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."


text: We maintain a cybersecurity program that is designed to protect our information, and that of our customers, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. We have implemented a comprehensive risk-based approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents.


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences any such incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee. Our Board and Audit Committee regularly review the measures implemented to identify and mitigate data protection and cybersecurity risks. As part of such reviews, our Board and Audit Committee receive reports and presentations from team members responsible for overseeing our cybersecurity risk management, including our Chief Information Officer (CIO), which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. We have implemented protocols by which certain cybersecurity incidents are escalated internally and, where appropriate, reported timely to our Board and Audit Committee.


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Through December 31, 2023, the date on which our CIO retired, our CIO, who had extensive cybersecurity knowledge and skills gained from over 25 years of experience in the construction industry, including four years as our CIO, led the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reported directly to our Chief Financial Officer. This team, during our search for a new CIO, continues to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we conduct tabletop exercises in consultation with third-party consultants to enhance our readiness and response strategies in safeguarding against potential threats to our data, information technology systems, and critical business functions; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain an alternate recovery site and immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to responding to, containing, investigating, documenting, and mitigating incidents.


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences of any such incidents. A cybersecurity incident could materially and adversely affect our business strategy, results of operations, or financial condition due to a loss, or loss of access to, our funds, reputational damage, a loss of customers and related revenues, and/or the institution of governmental enforcement actions or civil litigation against us. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. Our CIO joined the Company in 2024 and has extensive cybersecurity knowledge and skills gained from over three decades of experience in technology management, product management, strategic planning, and team leadership. She leads the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reports directly to our Executive Vice President and Chief Marketing Officer. Our CIO and her team continue to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.


text: We have implemented and maintain various information security processes at each of our remote and office locations designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, and Deputy Chief Information Security Officer ("Deputy CISO") help identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.


text: The Company's information security program, led by our CTO and Deputy CISO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include incident management, change management, network segmentation, cyber protection and containment, detection and response, and recovery. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our board of directors (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, as well as to perform a variety of other functions throughout our business. We have enlisted the services of a third-party managed detection and response firm to conduct continuous monitoring of our information systems, including intrusion detection and alerting. We also regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and Deputy CISO. The CTO and Deputy CISO have a combined four decades of information technology and cybersecurity leadership experience across public and private sectors.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and Deputy CISO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our board of directors for certain cybersecurity incidents.


text: The Finance & Risk Committee receives periodic reports from CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Finance & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, helps identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.


text: The Company's information security program, led by our CTO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our Board (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO. The CTO has a over two decades of information technology and cybersecurity leadership experience.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our Board for certain cybersecurity incidents.


text: The Company has a structured risk management process for identifying, reviewing, and assessing material risks from cybersecurity threats. These processes are included in the Company's overall risk management process, which is overseen by the Audit Committee of the Company's Board of Directors. As part of the cybersecurity risk management process the Company uses various methods to monitor and evaluate its threat environment and its risk profile. These methods include using manual and automated tools such as vulnerability scanning software; monitoring current and emerging cybersecurity threats; studying reports of threats and threat actors; performing scans of the threat environment; assessing our industry's risk profile; conducting internal and external audits and assessments; and carrying out threat and vulnerability assessments. To manage and mitigate material risks from cybersecurity threats to our information systems and data, the Company implements and maintains a variety of technical, physical, procedural, and organizational measures. These measures include access controls for networks, devices, and applications; firewalls and antivirus/antimalware software; management of network and user device configurations; encryption of data; monitoring of networks, devices, applications, and accounts; penetration testing; asset management procedures; risk assessments; incident detection and response plans; vulnerability management processes; business continuity and disaster recovery plans; internal IT controls; and employee cybersecurity awareness training.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: The cybersecurity risk management process also includes the evaluation of risks from cybersecurity threats associated with the use of third-party service providers, such as vendors engaged by the Company to provide the IT systems used in its operations. As a part of the overall risk management process, the Company evaluates new vendors for security risks before onboarding and regularly monitors third-party vendor performance to identify potential cybersecurity risks. The Company periodically engages with third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management processes.


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.


text: Board of Directors The Audit Committee of the Company's Board of Directors oversees the effectiveness of the Company's internal controls, including controls designed to identify, mitigate, and assess potentially material cybersecurity threats and incidents. The Audit Committee is informed of the status of the cybersecurity risk management processes by management during regular Audit Committee meetings. Reports from management include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives.


text: The Company's IT department, under the direction of its Chief Financial Officer, is responsible for the assessment and management of material cybersecurity risks. The IT department has over 70 years of combined work experience in information technology, including security, auditing, compliance, systems, and programming. The IT department is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management process described above, and regularly reports to the Audit Committee.


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents such as the cybersecurity incident described below, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.


text: Despite the systems and processes the Company has in place to monitor, detect, mitigate and remediate potential vulnerabilities, on June 30, 2024, the Company detected a cybersecurity incident in which an unauthorized third party gained access to certain information systems of the Company, which resulted in the Company incurring expenses, including expenses to retain external cybersecurity experts to assist with an investigation into such incident. For additional information, see Note 14 "Commitments and Contingencies" included in Part IV, Item 15 of this Report.


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. We are committed to implementing leading data protection standards, and have a comprehensive set of written policies and standards that follow the guidance of the industry standard cybersecurity frameworks.

companyName: American Homes 4 Rent

ticker: AMH


text: We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports directly to our Chief Technology Officer ("CTO"). Our CISO has more than 10 years of experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"). Our CISO reports to our CTO, who reports to our CFO.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the company's risk assessment, risk management and risk mitigation policies and programs. A key part of this responsibility is overseeing the Company's cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program, addressing topics such as current threat levels, program enhancements and vulnerability testing. The Audit Committee oversees our compliance with industry standard cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, penetration testing, incident response plan updates, and our business continuity plan. The Audit Committee also periodically evaluates our cyber strategy to ensure its effectiveness, including benchmarking against our peers. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.


text: As part of our board refreshment efforts in recent years we have focused on adding trustees with cybersecurity risk management experience. Currently four members of our board of trustees have information security experience.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program has four components: (1) prevention and preparation, (2) detection and analysis, (3) containment, eradication, recovery, and reporting, and (4) post-incident analysis and program enhancements.


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on our data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing that we conduct throughout the year.


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature of the event (e.g. ransomware, personal data breach, intellectual property breach, theft or fraud) and assessing the severity of the event and sensitivity of any compromised data according to preset criteria. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.


text: Containment, Eradication, Recovery, and Reporting With every cybersecurity incident, the highest priority of the incident response team is to contain the cybersecurity incident as quickly as possible. A cybersecurity incident is considered contained when no additional harm can be caused and the focus shifts to remediation. The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.


text: Further, the Company also maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, and the Audit Committee annually reviews such coverage.


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, including the CEO, CFO, COO and CLO, the Audit Committee, internal and external counsel, particularly with respect to legal obligations to report the incident to tenants, regulators and law enforcements, and to the Disclosure Committee and external counsel with respect to the Company's SEC reporting obligations.


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify and implement enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The CISO generally oversees the implementation of enhancements identified through these reviews with oversight by senior management and the Audit Committee as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we are able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors–Risks Related to our Business–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. Our cybersecurity program includes written policies and standards that follow the guidance of well-recognized industry cybersecurity frameworks.


text: We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports on cybersecurity directly to our Chief Technology Officer ("CTO"), who reports to our Chief Financial Officer ("CFO"). Our CISO has significant experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), CFO, and Chief Legal Officer ("CLO").


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third-party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and enterprise risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program. As part of its oversight, the Audit Committee may, for example, receive updates regarding assessments of our alignment with certain industry cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, results of penetration testing, and revisions to the incident response plan and business continuity plan. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is training employees on our data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities that we conduct throughout the year.


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature and severity of the event. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.


text: Containment, Eradication, Recovery, and Reporting The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include, depending on the incident's classification and other circumstances, the CEO, CFO, COO and CLO, the Audit Committee, the Disclosure Committee, and internal and external counsel. In addition, the incident response plan considers communications and reporting to tenants, regulators and law enforcement.


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify potential enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The results of these reviews are shared with management and the Audit Committee.


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents. However, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors—Risks Related to our Business—If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. We have therefore designed and implemented a framework of policies, programs and procedures (the "Information Security Program") intended to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The Information Security Program is informed by interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: First Internet Bancorp

ticker: INBK


text: Our Information Security Program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for all critical functions; • a physical security program that is tested regularly; • obtaining and maintaining appropriate insurance and indemnification for cybersecurity incidents; including insurance to cover cybersecurity incidents affecting third party vendors and service providers: and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A.


text: Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company, and receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis. However, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Audit and Risk Committee. Our ISO and Chief Risk Officer provide the Audit and Risk Committee and the Company's internal Enterprise Risk Management Committee periodic reports on our cybersecurity risks and cybersecurity incidents, if any. The Board, and the Audit and Risk Committee, have appropriate expertise in planning for and dealing with cybersecurity threats. Specifically, and without limitation, David Becker, Ann Dee and Justin Christian all possess specific expertise in this area.


text: The Audit and Risk Committee and the entire Board review and approve the Company's Information Security Policy, Incident Response Policy, Third Party Risk Management Policy, Risk Appetite Statement and other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for implementing the Information Security Program alongside our Chief Information Officer. The ISO and Chief Information Officer both serve on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. The Company's information security program is designed to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The program is comprised of policies, procedures, and programs, and is informed by and intended to align with the interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool (the "Information Security Program"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Information Security Program is integrated into our risk management program and is aligned to the Company's business strategy and Enterprise Risk Management program. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment are conducted on at least an annual basis; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for critical functions; • a physical security program that is tested regularly; • obtaining and maintaining cyber insurance; and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties, as well as contractual protections related to cybersecurity incidents affecting third party vendors and service providers.


text: The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.


text: The risk and evolving nature of cybersecurity threats, and not a previous cybersecurity incident, has led to the Company to devote significant time and resources to the development and implementation of the Information Security Program described above. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company. The Board receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis and receives cybersecurity training on at least an annual basis. While the entire Board receives reporting and receives training, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Risk Committee. Our ISO and Chief Risk Officer provide the Risk Committee and the Company's internal Enterprise Risk Management Committee periodic and as needed reports on our cybersecurity risks and cybersecurity incidents, if any.


text: The Risk Committee and the entire Board review and approve the Company's information security policies and certain other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for overseeing and managing the Information Security Program alongside our Chief Information Officer. The Chief Information Officer serves on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents.


text: Our Board oversees risk management for the Company including through its approval of the investment policy and other policies of the Company and its oversight of the Advisor. For certain risks, the Board has delegated oversight responsibilities to committees of the Board. For example, the Compensation Committee oversees and reports to the Board on the assessment and mitigation of risks associated with the Company's and the Advisor's compensation policies and practices, and the Nominating and Corporate Governance Committee assists our Board with assessing risks associated with conflicts of interest and with ESG matters. Cybersecurity risk management is integrated into this broader risk management framework. The Board has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Franklin Templeton cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. The Company has a policy that supplements the Franklin Templeton cybersecurity incident response plan and addresses reporting and disclosure considerations related to a cybersecurity incident.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants (e.g., Cobalt, Crowdstrike and EY) to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that we conduct throughout the year.


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan. Containment procedures may include off-lining systems, including by disconnecting network cable, utilizing network-management tools to isolate the host, altering the DNS entry of impact hosts, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, and increased network monitoring or logging to identify recurring attacks.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, a ransomware recovery vendor, a communications firm, and various law firms.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Advisor and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Advisor uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have impacted or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure.


text: Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities and trainings that we conduct throughout the year.


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it periodically updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event..


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is responsible for deciding on a containment strategy to respond to the cybersecurity incident consistent with the procedures in the incident response plan.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, identify potential adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. See "Item 1A–Risk Factors–Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Information Security Officer ("CISO") and our Chief Customer and Technology Officer ("CCTO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We also are a member of an industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: We assess Chipotle's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of Chipotle's information security environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform Chipotle during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), Chipotle has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Chipotle (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report.


text: Our cybersecurity risk management and strategy processes are led by our CISO and our CCTO. These individuals have collectively over 50 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews and discusses with our CISO and our CCTO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, including potential unauthorized occurrences on or through both, our physical systems and electronic information systems, that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process and store as part of our business, including on behalf of third parties. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: GLOBUS MEDICAL INC

ticker: GMED