text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs at least annually.


text: We have a unified and centrally-coordinated team, led by our Senior Vice President of Corporate Quality and IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Senior Vice president of Corporate Quality and IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: GLOBUS MEDICAL INC

ticker: GMED

secItem: Item 1C


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. Additional information about cybersecurity threats we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are subject to data privacy laws and our failure to comply with them could subject us to substantial liabilities," which should be read in conjunction with the information above.


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Senior Vice President of Corporate Quality and IT. They also oversee the response to any significant cybersecurity incidents. Our Senior Vice President of Corporate Quality and IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.


text: We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure may be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: Frontier Communications Parent, Inc.


text: Cybersecurity risk management is embedded in the annual enterprise risk management ("ERM") process, which is jointly administered by the Chief Financial Officer and head of Internal Audit and overseen by the Board of Directors, primarily through the Audit Committee. As part of the ERM process, senior management annually, or more frequently as necessary, identifies, assesses and evaluates enterprise level risks using a range of tools and services.


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we work to upgrade our existing technology systems, enhance our overall security posture and provide employee training around cyber risks, which are constantly evolving.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers and other external parties and circumstances. External risks to our network and information systems may arise from third parties and other parties we may not fully control. For example, we use vendors for encryption and authentication technology and cloud storage, and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. We engage outside providers to monitor our network and conduct periodic internal and external security testing and to assist in the ongoing evaluation and enhancement of our cyber security preparedness and protocols. We use the NIST Cybersecurity Framework to audit our cybersecurity controls.


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Data and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate material incidents for consideration by the Audit Committee.


text: While material risks are generally overseen by the full Board, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board at least annually on cybersecurity risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as the framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership from both TKO and Endeavor that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC function. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, General Counsels, Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.


text: Our cybersecurity risk management program, thus, includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; a written cybersecurity incident response plan;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management not less often than once per calendar year;


text: phishing simulations at regular intervals (not less than quarterly) to all users of the Company's email system; and a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the Company or the Company's confidential or proprietary information or otherwise is connected to any Company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose contractual remediation obligations to be agreed upon by the vendor.


text: Our continually evolving cybersecurity strategies are informed by multiple threat intelligence resources, the status of ongoing remediation plans, and technical developments. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Business — Failure to protect our IT Systems and Confidential Information against breakdowns, security breaches, and other cybersecurity risks could result in financial penalties, legal liability, and/or reputational harm, which would adversely affect our business, results of operations, and financial condition."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from Endeavor's Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.


text: Our management team, including Endeavor's Chief Compliance Officer, Chief Information Officer, SVP, Privacy & Cybersecurity, and SVP, Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. Our SVP, Privacy & Cybersecurity, leads a team of five dedicated privacy professionals in the Legal department.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Assessment, Identification and Management Processes We have implemented a cybersecurity risk management strategy to assess, identify and manage material risks from cybersecurity threats. This strategy is designed to protect our systems, data, and operations from potential cyber threats and to ensure the continuity of our business operations.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We conduct regular risk assessments to identify potential cybersecurity threats. These assessments involve evaluating our systems, networks and data for vulnerabilities that could be exploited by cyber threats, through, among other things, vulnerability scanning and penetration testing. Once risks are identified, we implement measures to manage and mitigate these risks. This includes updating and patching our systems, implementing security controls and monitoring our networks for suspicious activity. We have a process in place to respond to any identified threats, which includes containment, eradication and recovery measures. We also monitor and update our cybersecurity risk management strategy to respond to the evolving cyber threat landscape. This includes staying abreast of the latest cybersecurity threats and trends and updating our systems and processes accordingly.


text: Our cybersecurity processes are integrated into our overall enterprise risk management program and business continuity processes. In this regard, we address cybersecurity risks through a comprehensive, cross-functional approach across our technology, legal, compliance, finance, and other teams aimed at preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our enterprise risk management program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to management and to the audit committee of our board of directors. We also periodically review our cybersecurity risk with our entire board of directors.


text: Engaging Third Parties in Risk Management. We use a combination of internal resources and external assessors, consultants and auditors to conduct our cybersecurity risk assessments and identification. We periodically examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines, along with compliance with our internal cybersecurity controls. We also work with third parties to assess our incident response preparedness and to manage and track our risks.


text: Overseeing Risks Associated with Third-Party Service Providers. We have established a third-party risk management program to evaluate new and existing third-party service providers for their security controls and processes; identify cyber risks associated to the third-party service providers requiring remediation tracking; and continuously monitor the cyber risk posture of third-party service providers. Where appropriate, our contracts with third-party service providers require agreement and adherence to security and privacy requirements, including: the proper access, use, retention and deletion of data; security awareness training; security incident response and breach notification; our rights to security assessment, testing and audits; compliance with laws and industry standards; and system and services requirements. For example, we require our business process outsourcers, which are providers that support certain customer services operations and other services, to complete security awareness training and payment card industry data security standards training.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see Item IA. Risk Factors in Part I of this Annual Report on Form 10-K for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We also maintain an incident response plan to respond to any cybersecurity incident. This plan outlines the steps we will take to respond to an incident, including identifying and containing the incident, eradicating the threat, recovering our systems and communicating with relevant stakeholders.


text: Board of Directors Oversight of Cybersecurity Risk Our board of directors is responsible for oversight of our enterprise risk management program, which incorporates cybersecurity risk. The audit committee undertakes primary responsibility for assisting the board of directors in overseeing cybersecurity risk, including policies and procedures for assessing, managing and responding to cybersecurity risk. The audit committee meets with appropriate members of our management team at least quarterly—and third-party assessors, consultants and auditors as needed—to review and discuss cybersecurity risk.


text: The full board of directors receives quarterly updates from the audit committee on its oversight of cybersecurity risk and engages in further review for the full board of directors from time to time as appropriate.


text: Our technology team, and particularly our information security team, are actively involved in the development and implementation of policies and tools to assess risk and identify emergent risks, with cross-functional support from enterprise risk management, legal, compliance and finance, among other teams. We have established governance structures to increase the maturity of our cybersecurity program with a governance, risk and compliance approach. This includes the identification of internal weaknesses and the mitigation of IT risks through training programs or new policies and internal controls.


text: Management is also responsible for the testing of the overall security posture and the documentation of risk management and security for regulatory examinations and for regular review of security and privacy requirements. In addition to our internal cybersecurity team, our company has retained a third-party security firm to aid in the identification, containment, eradication and recovery of systems, data or both in the event of a material security incident.


text: Among management, our Chief Technology Officer ("CTO") and our Chief Information Security Officer ("CISO") are responsible for leading efforts to assess and manage cybersecurity risks. Our CTO has over 20 years of experience leading technology teams and developing applications and other digital solutions for commerce, incorporating the assessment and management of cybersecurity risk, a Master's degree in Engineering Management and a Bachelor's degree in Computer Science. Our CISO has over 20 years of experience assessing and managing cybersecurity risk, including leading information security teams at complex web-based businesses, and has a Master's degree in Computer Information Systems and multiple professional, cybersecurity and certifications, including CISM, CDPSE, CIPM, CIPT, and PMP.


text: Monitoring Cybersecurity Incidents. On a daily basis, our information security team monitors, identifies and classifies potential cybersecurity events and is responsible for notifying the CTO and CISO of such events as appropriate based on risk to our organization. Our CTO and CISO are responsible for notifying executive leadership, other functional teams and our audit committee, as appropriate.


text: Reporting to the Board of Directors. Our CTO and CISO report to the audit committee at least quarterly about the detection, prevention, mitigation and remediation of cybersecurity events, including information about the latest cybersecurity threats, the status of our prevention and detection measures and the effectiveness of our mitigation and remediation efforts, as well as any other cybersecurity risk management activities and the progress of related projects. These briefings include updates on the formalized incident response plan, communications and escalation procedures. Management will apprise the board of directors of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: The Company treats cybersecurity risk seriously and is focused on maintaining and regularly updating the security of our systems, networks, technologies and data.

companyName: CHEMED CORP

ticker: CHE


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that was observed in early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.


text: We acknowledge that cyberattack risk may occur with our third-party technology service providers. High-profile cyberattacks have occurred at healthcare companies, credit bureaus, financial institutions, and other businesses for the purpose of acquiring the confidential information of individuals, including potential customers and patients. We take significant measures to prevent and mitigate issues caused by any such attacks, including outreach to our providers and other third-parties that we engage with, in order to ascertain any potential downstream implications of known breaches.


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.


text: The reports include information on any attacks or potential breaches within the Company as well as security events at third-party providers when the breach or potential breach may affect the Company. This process allows the Company to involve both senior management and third-party service providers, including forensic analysts, other cyber experts, and outside counsel, as necessary in order to combat potential threats and help ensure appropriate and timely responses to threats, and mitigation and remediation of any incidents.


text: To date, the increase in cyberattacks has not resulted in any material disruption of our operations or material harm to our customers or patients. However, while we have significant internal resources, policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that any such failure, interruption or security breach will not occur in the future, or if they do occur, that they will be adequately addressed. Please also reference additional disclosures about cybersecurity in Item 1A Risk Factors, under both Roto-Rooter and VITAS sections.


text: We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer ("CISO"). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework ("NIST CSF"), Payment Card Industry Data Security Standards ("PCI DSS"), the Center for Internet Security ("CIS") Critical Security Controls, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and relevant International Organization for Standardization ("ISO") standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes: A security testing schedule, which includes internal/external penetration testing; Regular vulnerability assessments; Detailed vulnerability management; 24/7 Security Operations Center Monitoring and reporting of systems and critical applications; Data loss prevention controls; File access and integrity monitoring and reporting; Threat intelligence; Third-party vendor management.

companyName: Bancorp, Inc.

ticker: TBBK


text: The Company's Security Operations Center ("SOC") functions as the central point for all cybersecurity events that occur on our information systems. The SOC provides end-to-end operations to monitor, detect, alert and respond to any unusual, suspicious or malicious activities. In 2023, we expanded the SOC's operational hours to 24 hours a day, 7 days a week, utilizing both internal and third party resources for that full coverage. We conduct risk assessments and compliance audits against the above-referenced standards and regularly benchmark and evaluate program maturity with industry leaders. We also engage both internal and external auditors and third party information security experts to examine our cybersecurity processes. Additionally, the Company undergoes the PCI certification process and obtains the related certification on an annual basis.


text: Recognizing the interconnected nature of the financial industry, we evaluate and monitor the cybersecurity practices of our third party service providers and partners using a risk-based approach. Our Third Party Oversight Department evaluates new and existing relationships based upon due diligence requirements defined by our Cybersecurity Department to understand and mitigate material risks associated with third party service providers and partners. Risk assessments and audit results in connection with our Cybersecurity Program are reported to senior management and the Board of Directors. Risk owners from our Cybersecurity Program develop risk mitigation plans to resolve any cybersecurity risks identified in risk assessments or audits.


text: We recognize that a successful cybersecurity incident could lead to disruptions in operations, financial loss, reputational damage, and potential legal and regulatory consequences. The Company has a fully implemented incident response program, and internal forensics capabilities with third party forensic experts on retainer. We also maintain business continuity and disaster recovery plans so the Company can more effectively respond to cybersecurity incidents. It is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2023, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, "Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure."


text: Management regularly evaluates and enhances its cybersecurity measures to mitigate cybersecurity risks. The Company's CISO is responsible for all aspects of the Cybersecurity Program, including managing cybersecurity functions, ensuring that cybersecurity staff are adequately skilled and trained in the activities required for their respective job functions, and overseeing corporate cybersecurity initiatives. Under the direction of the CISO, the Cybersecurity Department regularly monitors for enterprise-wide compliance with Cybersecurity Program procedures and regulatory requirements. Our CISO, in collaboration with our Chief Information Officer ("CIO"), Chief Risk Officer ("CRO"), and senior management, drives awareness, ownership and alignment of cybersecurity protocol for effective cybersecurity risk management across all lines of business and corporate functions. The CISO and CIO are responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes to effectively prevent, detect, mitigate and remediate cybersecurity threats. Our CISO has expertise in cybersecurity, information security risk management, identity and access management, security architecture, application security, vulnerability management, threat intelligence, security operations and incident management and response through prior roles leading information security functions at financial institutions. The CISO holds multiple professional certifications, including Certified Chief Information Security Officer through the International Council of Electronic Commerce Consultants, also known as the EC-Council.


text: The CISO reports to management's Enterprise Risk Management Committee and quarterly to the Board's Risk Committee regarding the Company's cyber risks and threats, the status of efforts to strengthen information security systems, assessments of the Company's Cybersecurity Program, and the emerging threat landscape. In these meetings and on an ad hoc basis senior management receives periodic reporting from the Cybersecurity Department, Operations Department and Information Technology Department on operational risks and the steps taken to monitor and control cybersecurity exposure.


text: The Board of Directors recognizes the importance of cybersecurity to safeguard confidential information and sensitive data and receives periodic training on cybersecurity risk and best practices for related oversight. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2023, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and evaluate the Company's cybersecurity program in the context of the global risk environment.


text: The Board has delegated responsibility for more detailed oversight of the Company's cybersecurity and information security framework to the Risk Committee of the Board. The CISO and CIO provide updates on the cybersecurity threat environment and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment to the Risk Committee quarterly and to the full Board at least annually and on an ad hoc basis. Additionally, the Risk Committee also reviews and approves the Cyber Risk Management Program Policy and Information Security Program Policy at least annually. Elevation to a full Board communication and/or interaction would occur upon the initiation of a cyber incident response, or a material compromise of business functionality, customer data or network integrity.


text: Incident Response Policy The Board of Directors is responsible for overseeing the risks from cybersecurity threats. Each month, the Board is presented with the executive overview of the Cybersecurity Continuous Monitoring Review Report ("Report") prepared by the Company's third-party chief information security officer. The Board of Directors reviews the Report each month and, if warranted, directs senior management of the Company to take necessary and appropriate actions in accordance with the IR Policy (as defined below).

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: Wayne Bank has adopted an Incident Response Policy (the "IR Policy") for responding to cybersecurity incidents. This IR Policy applies to both potential and actual incidents. The IR Policy should be invoked in any context where the Bank believes that an incident may have occurred. The IR Policy applies to all employees, contractors, and third parties. The objectives of the IR Policy are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.


text: Implementation of the IR Policy requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Policy are spread across the entire organization of the Bank's senior leadership and chief credit officer.


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.


text: During the fiscal year ended December 31, 2023, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.


text: Overview the protect connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational, and operational impacts that can significantly adversely affect our customers, capital, and earnings. Therefore, we integrate cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies are the cybersecurity are the the cybersecurity the Federal Financial Institutions Examination Council ("FFIEC"). framework offers a set of guidelines financial institutions manage and mitigate cybersecurity risks effectively. It focuses on ensuring the confidentiality, of sensitive information and systems. Compliance Department the Bank cybersecurity and the Risk Committee of our Board of Directors.

companyName: USCB FINANCIAL HOLDINGS, INC.

ticker: USCB


text: program, periodic risk assessments are performed the Company's cybersecurity risk, the maturity level of the program, the risk of cyber threats, and the effectiveness practice. The the National Institute of Standards and Technology ("NIST") Framework and the FFIEC's Cybersecurity Assessment Tool to help management identify its risks and determine the Company's cybersecurity posture. environment. defense-in-depth security the cybersecurity controls and fostering a resilient operational framework.


text: It is the policy of the Company and its technology service providers they can identify, attacks such attacks, etc. This commitment aligns with the Company's risk appetite, Incident Response Policy, and Business Continuity Plan, which incorporates business continuity planning and testing activities to enhance response and recovery capabilities.


text: At Vaxxinity, cybersecurity risk management is an integral part of our IT strategy. Our cybersecurity risk management program is based on standard industry practices and follows the National Institute of Standards and Technology (NIST) framework, which provides steps for identifying system and operational vulnerabilities, protecting systems, detecting intrusions and malicious behavior, as well as for planning a strong response and recovery. This methodology and our smaller functional scope allow us to effectively address cybersecurity threats and incidents.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: A majority of our IT systems are built on services provided by third parties. For example, we leverage commonly used foundational technologies provided by third parties, such as secure messaging gateways, enforced drive encryption and multi-factor authentication.


text: Our choice of tools is shaped by these providers' reputations and the outcomes of our internal evaluation process. We have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing services parties and regularly review the performance of these vendors and monitor for any adverse developments which may impact our own security posture. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from any such compromise or failure.


text: Employees and contractors are given cybersecurity awareness training as part of their on-boarding process. We also maintain an organizational IT and Security Policy which includes an Acceptable Use Policy that provides detailed guidelines on proper resource use and personal behavior. We require written acknowledgment of the latter document by all employees and contractors. All policies are regularly reviewed and updated to keep in line with industry developments and organizational changes. Employees and contractors across all departments are encouraged to report any concerns or suspicions to the IT department, who then investigates recommends appropriate actions.


text: Our board of directors has overall responsibility for oversight of our risk management policies and procedures. Its audit committee (the "Audit Committee") is responsible for ensuring that management has processes in place designed to identify cybersecurity risks to which we are exposed and implement processes and programs to manage them and mitigate and remediate any incidents. The audit committee also reports material cybersecurity risks to our full board of directors on an as-needed basis, but no less than annually.


text: Routine oversight of cybersecurity risk management is delegated by the Audit Committee to our Chief Legal, Compliance and Administrative Officer. The IT department, reporting directly to this Officer, is responsible for managing the cybersecurity risk management program and is responsible for identifying, considering and assessing potentially material cybersecurity risks on an ongoing basis, establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and reporting to executive leadership about evolving issues. The Chief Legal, Compliance and Administrative in turn, updates the Audit Committee and board of directors of any related incidents or threats that are being addressed.


text: The IT department's personnel have extensive backgrounds in IT operations in similar environments and each team member has had experience managing cybersecurity issues.


text: We have access to external advisors in connection with our cybersecurity risk management program should additional expertise be required to manage cybersecurity incidents or risk.


text: In 2023, we did not identify any cybersecurity threats or incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" in this annual report on Form 10-K.


text: We execute a comprehensive cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program is aligned with industry-wide recognized standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cybersecurity threats; and continuous improvement of our cybersecurity measures. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.

companyName: MONRO, INC.

ticker: MNRO


text: Quarterly cybersecurity awareness training for teammates, monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., articles, flyers, cybersecurity awareness month); A dedicated security operations team to monitor, analyze, and respond to security threats 24/7; Security governance to manage and maintain security processes; Intrusion, detection, and prevention systems; A vulnerability management program to identify and remediate security liabilities; A configuration management program to harden systems based on industry standards; Industry-leading email security, endpoint detection, and response platforms; Threat intelligence from multiple resources to identify and anticipate emerging threats;


text: African Fintech industry, which is subject cybersecurity risks our business, of operations—including, but not the following: intellectual property risk and reputational risk. DSS") ("NIST")

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: Security Risk Assessment ("SRA") to identify the potential impact and determine the controls. We this SRA our cybersecurity roadmap and strategies to ensure the best IT security environment is implemented at our company. We use various tools cybersecurity risk—including, not the the use Managed Endpoint Detection and Response ("EDR") software and for our Local Area Network (LAN) monitoring with internal and external Security Operations Center


text: ("SOC") real-time monitoring, Data mandatory Multi-factor Authentication ("MFA") in our IT environment. In addition, the any monitor our cybersecurity threat our security cybersecurity practices consistent the security the workforce, security management which for crisis scenarios. This also includes regular phishing simulations and campaigns.


text: the availability, security of our property. Any disruption, compromise, or breach of our systems cybersecurity threat or incident could adversely our operations, customer service, product development, and competitive position. This could also result in a breach of our contractual to protect the privacy of our stakeholders. Such to affected parties, cybersecurity protection to our market share.


text: Certain key controls considered through Coronado's internal control processes are linked to cybersecurity these include controls over access and change management for key financial systems. Where the management parties, the controls.

companyName: Coronado Global Resources Inc.

ticker: CODQL


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, including potential unauthorized occurrences on or through both, our physical systems and electronic information systems, that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process and store as part of our business, including on behalf of third parties. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs at least annually.


text: We have a unified and centrally-coordinated team, led by our Vice President of IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Vice president of IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. Additional information about cybersecurity threats we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are subject to data privacy laws and our failure to comply with them could subject us to substantial liabilities," which should be read in conjunction with the information above.


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Vice President of IT. They also oversee the response to any significant cybersecurity incidents. Our Vice President of IT, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.


text: We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure have been and may in the future be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.


text: Cybersecurity risk management is embedded in the annual enterprise risk management ("ERM") process, which is jointly administered by the Chief Financial Officer and head of Internal Audit and overseen by the Board of Directors, primarily through the Audit Committee. As part of the ERM process, senior management annually, or more frequently as necessary, identifies, assesses and evaluates enterprise level risks using a range of tools and services.


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we conduct regular exercises and simulations to review and continuously improve our incident response protocols, we work to upgrade our existing technology systems to enhance our overall security posture and we provide ongoing employee training around cyber risks. For example, employees are required to complete cybersecurity training and receive ongoing education which includes simulated phishing attacks and communications for recognizing evolving threats.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers and other external parties and circumstances. External risks to our network and information systems may arise from third parties and other parties we may not fully control. For example, we use vendors for encryption and authentication technology and cloud storage, and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. We engage outside providers to monitor our network and conduct periodic internal and external security testing and to assist in the ongoing evaluation and enhancement of our cyber security preparedness and protocols. We use the NIST Cybersecurity Framework to audit our cybersecurity controls.


text: As of the date of this report, we have not experienced any cybersecurity incidents that [we have determined] have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Digital and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate potentially material incidents for consideration by the Audit Committee. For example, the Audit Committee was actively involved in the review, disclosure and mitigation of the reported April 2024 cyber-attack. See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: While material risks are generally overseen by the full Board of Directors, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board of Directors at least annually on cybersecurity risks.


text: The Company treats cybersecurity risk seriously and is focused on maintaining and regularly updating the security of our systems, networks, technologies and data.


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that has been observed since early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.


text: We acknowledge that cyberattack risk may occur with our third-party technology service providers. High-profile cyberattacks have occurred at healthcare companies, credit bureaus, financial institutions, and other businesses for the purpose of acquiring the confidential information of individuals, including potential customers and patients. We take significant measures to prevent and mitigate issues caused by any such attacks, including outreach to our providers and other third-parties that we engage with, in order to ascertain any potential downstream implications of known breaches.


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee 's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.


text: The reports include information on any attacks or potential breaches within the Company as well as security events at third-party providers when the breach or potential breach may affect the Company. This process allows the Company to involve both senior management and third-party service providers, including forensic analysts, other cyber experts, and outside counsel, as necessary in order to combat potential threats and help ensure appropriate and timely responses to threats, and mitigation and remediation of any incidents.


text: To date, the increase in cyberattacks has not resulted in any material disruption of our operations or material harm to our customers or patients. However, while we have significant internal resources, policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that any such failure, interruption or security breach will not occur in the future, or if they do occur, that they will be adequately addressed. Please also reference additional disclosures about cybersecurity in Item 1A Risk Factors, under both Roto-Rooter and VITAS sections.


text: Incident Response Policy The Board of Directors is responsible for overseeing the risks from cybersecurity threats. Each month, the Board is presented with the executive overview of the Cybersecurity Continuous Monitoring Review Report (" Report ") prepared by the Company's third-party chief information security officer. The Board of Directors reviews the Report each month and, if warranted, directs senior management of the Company to take necessary and appropriate actions in accordance with the IR Policy (as defined below).


text: Wayne Bank has adopted an Incident Response Policy (the "IR Policy") for responding to cybersecurity incidents. This IR Policy applies to both potential and actual incidents. The IR Policy should be invoked in any context where the Bank believes that an incident may have occurred. The IR Policy applies to all employees, contractors, and third parties. The objectives of the IR Policy are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.


text: Implementation of the IR Policy requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Policy are spread across the entire organization of the Bank's senior leadership and chief credit officer.


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.


text: During the fiscal year ended December 31, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.


text: Overview the protect connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational, and operational impacts that can significantly adversely affect our customers, capital, and earnings. Therefore, we integrate cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies are the cybersecurity are the the cybersecurity the Federal Financial Institutions Examination Council ("FFIEC"). framework offers a set of guidelines financial institutions manage and mitigate cybersecurity risks effectively. It focuses on ensuring the confidentiality, of sensitive information and systems. Compliance Department the Bank cybersecurity and the Risk Committee of our Board of Directors.


text: program, periodic risk assessments are performed the Company's cybersecurity risk, the maturity level of the program, the risk of cyber threats, and the effectiveness practice. The the National Institute of Standards and Technology ("NIST") Framework and the FFIEC's Cybersecurity Assessment ("Cybersecurity Assessment") Company's cybersecurity posture.


text: of rigorous procedures training initiatives for both management and staff, the institution cultivates a safe cybersecurity environment. This approach including security fortifying the institutions cybersecurity controls and fostering a resilient operational framework.


text: It is the policy of the Company and its technology service providers they can identify, malware and invasive attacks such as phishing, ransomware, malware, etc. Continuity Plan, capabilities.


text: The Company realizes that it faces a variety of risks from cyber-attacks involving destructive malware, including such as such, it is the the Company that its risk management these risks by: Establishing


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: Millburn Multi-Markets Fund L.P.


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The General Partner has no t identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


companyName: NESTOR PARTNERS


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: The Managing Owner has written procedures and policies that govern the Trust's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: GLOBAL MACRO TRUST


text: The Cybersecurity Committee (the "Committee") of the Managing Owner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the Managing Owner (the "Board"). The Committee is co-chaired by the Managing Owner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The Managing Owner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the Managing Owner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the Managing Owner's cybersecurity programs and to mitigate exposure, the Managing Owner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the Managing Owner's cyber insurance provider. The Managing Owner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The Managing Owner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the Managing Owner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The Managing Owner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The Managing Owner carries cyber insurance. The Managing Owner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer ("CISO"). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework ("NIST CSF"), Payment Card Industry Data Security Standards ("PCI DSS"), the Center for Internet Security ("CIS") Critical Security Controls, and relevant ISO standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes: A security testing schedule, which includes internal/external penetration testing; Regular vulnerability assessments; Detailed vulnerability management; 24/7 Security Operations Center Monitoring and reporting of systems and critical applications; Data loss prevention controls; File access and integrity monitoring and reporting; Threat intelligence; Third-party vendor management.


text: The Company's Security Operations Center ("SOC") functions as the central point for all cybersecurity events that occur on our information systems. The SOC provides end-to-end operations to monitor, detect, alert and respond to any unusual, suspicious or malicious activities. In 2023, we expanded the SOC's operational hours to 24 hours a day, 7 days a week, utilizing both internal and third party resources for that full coverage. We conduct risk assessments and compliance audits against the above-referenced standards and regularly benchmark and evaluate program maturity with industry leaders. We also engage both internal and external auditors and third party information security experts to examine our cybersecurity processes. Additionally, the Company undergoes the PCI certification process and obtains the related certification on an annual basis.


text: Recognizing the interconnected nature of the financial industry, we evaluate and monitor the cybersecurity practices of our third party service providers and partners using a risk-based approach. Our Third Party Oversight Department evaluates new and existing relationships based upon due diligence requirements defined by our Cybersecurity Department to understand and mitigate material risks associated with third party service providers and partners. Risk assessments and audit results in connection with our Cybersecurity Program are reported to senior management and the Board of Directors. Risk owners from our Cybersecurity Program develop risk mitigation plans to resolve any cybersecurity risks identified in risk assessments or audits.


text: We recognize that a successful cybersecurity incident could lead to disruptions in operations, financial loss, reputational damage, and potential legal and regulatory consequences. The Company has a fully implemented incident response program, and internal forensics capabilities with third party forensic experts on retainer. We also maintain business continuity and disaster recovery plans so the Company can more effectively respond to cybersecurity incidents. It is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2024, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, "Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure."


text: Management regularly evaluates and enhances its cybersecurity measures to mitigate cybersecurity risks. The Company's CISO is responsible for all aspects of the Cybersecurity Program, including managing cybersecurity functions, ensuring that cybersecurity staff are adequately skilled and trained in the activities required for their respective job functions, and overseeing corporate cybersecurity initiatives. Under the direction of the CISO, the Cybersecurity Department regularly monitors for enterprise-wide compliance with Cybersecurity Program procedures and regulatory requirements. Our CISO, in collaboration with our Chief Information Officer ("CIO"), Chief Risk Officer ("CRO"), and senior management, drives awareness, ownership and alignment of cybersecurity protocol for effective cybersecurity risk management across all lines of business and corporate functions. The CISO and CIO are responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes to effectively prevent, detect, mitigate and remediate cybersecurity threats. Our CISO has expertise in cybersecurity, information security risk management, identity and access management, security architecture, application security, vulnerability management, threat intelligence, security operations and incident management and response through prior roles leading information security functions at financial institutions. The CISO holds multiple professional certifications, including Certified Chief Information Security Officer through the International Council of Electronic Commerce Consultants, also known as the EC-Council.


text: The CISO reports to management's Enterprise Risk Management Committee and quarterly to the Board's Risk Committee regarding the Company's cyber risks and threats, the status of efforts to strengthen information security systems, assessments of the Company's Cybersecurity Program, and the emerging threat landscape. In these meetings and on an ad hoc basis senior management receives periodic reporting from the Cybersecurity Department, Operations Department and Information Technology Department on operational risks and the steps taken to monitor and control cybersecurity exposure.


text: The Board of Directors recognizes the importance of cybersecurity to safeguard confidential information and sensitive data and receives periodic training on cybersecurity risk and best practices for related oversight. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2023, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and evaluate the Company's cybersecurity program in the context of the global risk environment.


text: The Board has delegated responsibility for more detailed oversight of the Company's cybersecurity and information security framework to the Risk Committee of the Board. The CISO and CIO provide updates on the cybersecurity threat environment and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment to the Risk Committee quarterly and to the full Board at least annually and on an ad hoc basis. Additionally, the Risk Committee also reviews and approves the Cyber Risk Management Program Policy and Information Security Program Policy at least annually. Elevation to a full Board communication and/or interaction would occur upon the initiation of a cyber incident response, or a material compromise of business functionality, customer data or network integrity.


text: We execute a comprehensive cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program is aligned with industry-wide recognized standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cybersecurity threats; and continuous improvement of our cybersecurity measures. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.


text: Our cybersecurity program has a set of controls and priorities with a multi-pronged approach that includes: quarterly cybersecurity awareness training for teammates, monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., articles, flyers, cybersecurity awareness month); a dedicated security operations team to monitor, analyze, and respond to security threats 24/7; security governance to manage and maintain security processes; intrusion, detection, and prevention systems; a vulnerability management program to identify and remediate security liabilities; a configuration management program to harden systems based on industry standards; industry-leading email security, endpoint detection, and response platforms; threat intelligence from multiple resources to identify and anticipate emerging threats; network and web application firewalls; multi-factor authentication; and network segmentation to isolate and safeguard critical systems and sensitive data.


text: The Company assesses cybersecurity risks on an ongoing basis, including assessing and deploying technical safeguards designed to protect its information systems from cybersecurity threats. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements and examine the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing, incident response exercises, maturity assessments, and industry benchmarking.


text: The Company engages with a range of external professionals, including cybersecurity experts, consultants, auditors, and legal counsel to leverage specialized knowledge, experience and insights, to help ensure our cybersecurity strategies and processes remain current. This includes: engaging third-party experts to periodically advise and train our Board and management regarding the structure and oversight of our cybersecurity program, Incident Response Plan ("IRP") and various cybersecurity-related matters;


text: retaining data security and data privacy legal counsel whose practice focuses on data breach response, information security compliance, and compliance with the data privacy laws in the various jurisdictions in which the Company operates; and utilizing specialized consultants and third-party managed service providers to assist us with projects that will improve the Company's IT infrastructure, strengthen our security posture and cybersecurity incident investigations, and improve our cyber readiness.


text: The Company has implemented processes to identify, prioritize, assess, mitigate and remediate risks associated with third-party service providers. As part of these processes, we conduct security assessments of critical third-party providers before engagement and contractually require third parties we engage to implement security programs commensurate with their risk.


text: in the Southern African which is subject to various cybersecurity risks that could our business, financial condition, operations including, but not limited to, the extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk and reputational risk. ("NPS").


text: -party Security Risk Assessment the potential impact and the this our cybersecurity roadmap and strategies to ensure a robust IT security environment is implemented at our company. We use various tools cybersecurity risk—including, not the the use Managed Endpoint Detection and Response ("EDR") software and Managed Network Detection and Response our Local Area Network ("LAN") ("SOC")


text: Cybersecurity is an ongoing priority, and we remain focused on our obligation to assess, identify and manage risks from cybersecurity threats and cybersecurity incidents. We have developed and implemented a cybersecurity risk management program that employs a multitude of measures and processes that aid in these efforts. This program is designed to protect our information systems, detect cybersecurity threats and ensure our compliance with applicable privacy and cybersecurity laws.

companyName: Compass, Inc.

ticker: COMP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is considered an integral part of our overall risk assessment process. For example, we report, review and consider results and findings from external and internal security and privacy assessments as part of our overall risk assessment process, and we analyze how cybersecurity risks interplay with operational, financial, compliance and reputational risks.


text: As part of our cybersecurity risk management program, we undertake various activities, including, but not limited to, detective, preventative, and automated controls; user access controls; a centralized security information and management system; periodic assessments, including penetration testing; periodic trainings and simulations; and policies for the handling of personally identifiable information. We closely monitor the privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans providing for response, containment, reporting and disclosure and recovery, including providing training and remediation steps for internal threats. We also carry customary cybersecurity risk insurance.


text: In addition, we use third party service providers, when appropriate, to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program. For example, we leverage external assessors such as security researchers and penetration testers to identify vulnerabilities in our information systems.


text: Further, our cybersecurity risk management program includes processes that address cybersecurity risks associated with our use of third-party services providers that have access to our information systems and/or employee, agent or agent client confidential information. For example, we perform certain due diligence before engaging third-party service providers and consider potential cybersecurity risks and exposures in our choice among providers. We also generally require our third-party service providers that could potentially introduce cybersecurity risks to our information systems or sensitive consumer personal information to contractually agree to maintain a cybersecurity risk management program aimed at mitigating those risks and be subject to external cybersecurity audits.