text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information and Technology Officer ("CITO"), who has been designated as our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CITO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity risk management is led by our CITO, who has extensive experience in cybersecurity, information risk management, digital innovation, technology transformation, operations, and regulatory compliance. The CITO is supported by dedicated security professionals and external advisors to ensure a comprehensive and adaptive security strategy.

companyName: Shake Shack Inc.

ticker: SHAK

secItem: Item 1C


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Financial institutions have an obligation to customers, consumers and stakeholders to safeguard the confidentiality, integrity and availability of nonpublic, sensitive information and the information systems used to store, transmit or process such information.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Consistent with industry guidelines, such as the National Institute of Standards and Technology Cybersecurity framework, and regulatory requirements, guidelines and standards, b1BANK's information security and cybersecurity programs (collectively, "Program(s)") have been adapted to fulfill this obligation by establishing and employing administrative, technical and physical safeguards to maintain a secure and dependable infrastructure and environment. These Programs focus on identifying and addressing threats to the company and its customers and contribute corporate decision-making guidance for information security, cybersecurity and risk management objectives.


text: Defending against information security and cybersecurity (collectively, "Security") threats demands a concentrated, collaborative approach and, as such, supplementary programs and processes have been instituted into governing Security and risk management strategies.


text: Global threat intelligence is monitored for potential Security risks or vulnerabilities. These threats are analyzed for potential impact to the bank and are addressed in accordance with Program requirements. b1BANK's Chief Information Security Officer ("CISO") presents Security reports to the Operating Committee and Risk Committee of b1BANK's board of directors on a quarterly basis or as needed. These reports consist of significant Security events and issues, vulnerability metrics, and material risks. Additional reporting representing the overall state of the Program is presented on at least an annual basis to the full board of directors, which is responsible for overseeing Security functions and associated initiatives.


text: Security is embedded into our culture, being promoted through security awareness materials, mandatory testing campaigns and the mandatory annual review and acknowledgement of corporate Security policies and standards.


text: Business Continuity and Incident Response plans have been cohesively established and employed to provide frameworks for responding to and recovering from events such as natural disasters or security events. Our Director of Business Continuity and CISO, respectively, are responsible for the facilitation of these plans, as needed, and testing each on at least an annual basis. The owners of these plans are responsible for identifying an appropriate group of cross-enterprise subject matter experts and convening them to ensure a comprehensive response. These groups, under the leadership of our Chief Operations Officer ("COO"), provide appropriate internal notifications of material security events and response activities to our General Counsel, Chief Risk Officer, Chief Executive Officer, and board of directors or other appropriate corporate executives.


text: A vendor management program has been developed and employed to manage potential risks for third-party service providers, suppliers and external partners who have access to our confidential information. The effectiveness of these processes is verified by independent internal and external audit functions or organizations.


text: Independent internal and external auditors are engaged to perform Security assessments to determine the appropriateness and effectiveness of the overall Program. Supplementary self-assessments are performed as needed or as required by regulatory guidelines. Assessment results are evaluated to determine the scope of risk on the security of the bank and are addressed in accordance with Program requirements.


text: Our current CISO maintains appropriate security certifications and has over 20 years of experience in an information security role. The CISO manages a group dedicated to the security of the bank. This group is responsible for information technology monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. Our CISO reports directly to our COO and oversees, is assigned the responsibly of and is held accountable for the implementation and monitoring of the Program. Our COO serves on the Risk Committee of the Board, chaired by a board director.


text: The Company engages in a continuous, focused risk monitoring process to identify the likelihood and impact of internal and external threats to our information security systems and data and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CISO and COO together lead efforts to design, implement and operate necessary controls commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the bank. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect b1BANK.


text: Risk Management and Strategy NerdWallet, Inc. recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and that of our users.

companyName: NERDWALLET, INC.

ticker: NRDS


text: We have adopted the National Institute of Standards and Technology - Cybersecurity Framework (NIST-CSF) to guide our risk assessment and management and promote a company-wide cybersecurity risk management culture. Our cybersecurity team works closely with our information technology (IT) department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engagement of Third Parties We enlist third-party cybersecurity assessors and consultants to evaluate and test both our risk management systems and the third-party risk management systems of our business partners. Through these collaborations, we tap into specialized knowledge and insights, helping us gauge the effectiveness of our cybersecurity strategies and processes. The findings from these assessments guide our decision-making and planning processes, influencing how we set priorities and allocate resources.


text: Overseeing Third-party Risk Before partnering with third-party providers, we conduct a thorough examination of their cybersecurity program, policies, and practices. This includes a review of their SOC 2 reports and any available penetration tests. Additionally, we actively monitor our primary service providers and regularly obtain security control reports from them. We also employ real-time monitoring to detect any suspicious activity promptly. This approach is implemented to minimize risks associated with data breaches or other security incidents that may arise from third-party sources.


text: Risks from Cybersecurity Threats To date, no cybersecurity incident or any risk from cybersecurity threats has materially affected, or has been determined to be reasonably likely to materially affect, us or our operations or financial condition.


text: The Board of Directors recognizes the critical importance of managing cybersecurity risks and has implemented robust oversight mechanisms designed to ensure effective governance in this area.


text: Audit Committee Oversight The Audit Committee, comprising Board members with diverse experience in risk management, IT, cybersecurity, and finance, is directly responsible for overseeing cybersecurity risks. Our Chief Information Security Officer (CISO) provides comprehensive quarterly presentations to the Audit Committee, covering ongoing cybersecurity initiatives, strategies, and emerging threats. The Committee reports significant matters to the full board, and the CISO also delivers an annual presentation to the Board of Directors.


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.


text: Risk Management Leadership The primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our highly experienced CISO. With two decades of cybersecurity expertise, including multiple CISO roles, our CISO plays a pivotal role in developing and executing our cybersecurity strategies. His responsibilities include overseeing governance programs, addressing known risks, leading employee security training, and executing the incident response plan in case of a cybersecurity incident.


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, human resources, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical corporate computer networks, third party hosted services and production computing environment utilized to provide our services, and our critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer-related data ("Information Systems and Data").

companyName: CS Disco, Inc.

ticker: LAW


text: Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product Officer, Senior Vice President of Engineering and General Counsel), identify, assess and manage the Company's cybersecurity threats and risks (the "Cybersecurity Function"). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry's risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, systems monitoring, and access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the security organization works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. We conduct a cybersecurity risk assessment for vendors that manage, host or process our Information Systems and Data. Depending on the vendor, the program includes a security assessment questionnaire, a review of existing security assessments or reports related to the vendor and the use of third-party risk assessment services and scoring. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section referred to as: "If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of management's assessment and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over eight years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.


text: Various individuals that are part of our Cybersecurity Function are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including various management personnel that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer. Various individuals that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer, work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and full board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product and Technology Officer, Senior Vice President of Engineering, and General Counsel and Chief Compliance Officer), identify, assess and manage the Company's cybersecurity threats and risks (the "Cybersecurity Function"). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry's risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, and access controls.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, and cybersecurity consultants.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section referred to as: " If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences. "


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of management's assessment and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over nine years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.


text: The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and the full Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We have developed and implemented processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. We have established a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management strategy is informed by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and the NIST Risk Management Framework. Our cybersecurity processes have been integrated into our overall business risk management process.

companyName: ALPINE IMMUNE SCIENCES, INC.


text: Both internally and through third-party experts, we routinely assess our information technology, or IT, environment with reference to the NIST CSF. We also assess risks related to third-party vendors, suppliers and contractors. Our risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We provide regular training to our employees regarding cybersecurity threats and best practices, and we have established policies for the responsible use of our IT and information resources. We also maintain a cyber insurance policy to mitigate and cover cybersecurity risks.


text: As of the date of this report, we have not experienced cybersecurity incidents or are aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information about our cybersecurity risks, please see the section of this report titled " Risk Factors."


text: Our board of directors administers its cybersecurity risk oversight function directly through the audit committee. Through its regular meetings with management, including the finance, legal, and risk management functions, the audit committee reviews and discusses all significant areas of our business, including cybersecurity risks, and summarizes for the board of directors all areas of risk and the appropriate mitigating factors. The audit committee is responsible for the oversight of cybersecurity risk monitoring and assessment, and the officers and information technology personnel who oversee monitoring and assessing strategic risk exposure and the day-to-day management of material risks.


text: The Information Technology Risk Management Committee, or ITRMC, was established to assist in identifying, assessing, and managing risks across various domains to protect our interests, assets, reputation, and enhance its resilience. The ITRMC consists of members with diverse backgrounds, expertise, and experience relevant to risk management, including the CFO and Head of IT. The ITRMC is informed about our cybersecurity risks, including risks from cybersecurity incidents, through information obtained directly from and through working with our internal security team and outside experts. The ITRMC provides oversight, guidance, and recommendations on risk management strategies, policies, procedures, and practices to the executive management team and the audit committee. The ITRMC, as needed with assistance from external experts, provides regular reports to executive management and the audit committee, covering items such as risk management activities, significant risk exposures, mitigation efforts, and audits.


text: Our cybersecurity and data privacy risk management processes are integrated in our overall risk management program, and we have developed processes for assessing, identifying, and managing material risks from cybersecurity threats. We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation. Our information security team is primarily responsible for managing our cybersecurity and data privacy risk management processes. We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement. We also have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: UPWORK, INC

ticker: UPWK


text: Our platform is designed to help ensure the security of our data and systems, protect our customers' personal information, and meet the rigorous privacy and security requirements of our Enterprise clients. To that end, we have obtained, and we maintain through regular audits where relevant, the following security and privacy certifications: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, and U.S.-EU and U.S.-Swiss Privacy Shield certifications. We are also TrustArc certified. In addition, we leverage the National Institute of Standards and Technology security framework to drive strategic direction and maturity improvement to protect against new and evolving cybersecurity risks over time.


text: Our information security controls operate at multiple levels and are designed to detect, prevent, and mitigate cybersecurity threats that could impact the privacy and security of our data and our customers' data. To operate at scale, we have automated several risk mitigation strategies. We have implemented comprehensive trust and safety processes to help prevent and detect suspicious and fraudulent behavior on our platform. Over the years of developing our work marketplace, we have developed and refined specific pattern-matching algorithms to detect unusual behavior on our work marketplace, and we continue to improve such algorithms in the evolving threat landscape. We also regularly update our information security policies, standards and processes as needed to better reflect and account for updates in our cybersecurity posture, cybersecurity risks, and our risk mitigation strategies. We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. We have also developed a program and engaged with a bug bounty service for ongoing identification of exploitable vulnerabilities in the environment. Separately, our information security team also conducts regular scans of the environment to identify known vulnerabilities for remediation.


text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, advanced email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. All access to our platform is encrypted using industry-standard transport layer security technology. When customers enter sensitive information on our site, such as tax identification numbers, we encrypt the transmission of that information using secure socket layer technology. We also use the HSTS (HTTP strict transport security) to ensure visitors connect to the website over HTTPS which adds an additional layer of protection for our customers. For servers that store personally identifiable information, the data is encrypted. Moreover, our customers may elect to further secure their account credentials through two-factor authentication that requires them to authenticate with information provided by a second device. In order to make secure payments through our platform, we are Payment Card Industry Data Security Standard certified, which means we have demonstrated compliance with the Payment Card Industry security standards required for businesses that complete credit card or debit card transactions.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."


text: While everyone at Upwork plays a part in managing cybersecurity and data privacy risks, oversight responsibility is shared by our board of directors, audit committee, and management.


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, which we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.


text: Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO has over 25 years of experience in various technology leadership positions across multiple industries including finance, healthcare and technology. He has held leadership positions specifically in the information security space since 2011 at four publicly traded companies. The CISO's leadership team members are all seasoned information security professionals who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status of the cybersecurity environment, and cybersecurity incidents and actual or potential risks. Our CISO and his team provide regular updates to the management team and escalate events that require leadership's attention.


text: Our cybersecurity and data privacy risk management processes are integrated in our overall risk management program, and we have developed processes for assessing, identifying, and managing material risks from cybersecurity threats. We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation. Our information security team is primarily responsible for managing our cybersecurity processes and partners with our legal team on data privacy risk management processes. We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement. We also have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our platform is designed to help ensure the security of our data and systems, protect our customers' personal information, and meet the rigorous privacy and security requirements of our Enterprise clients. To that end, we have obtained and maintain the following security and privacy certifications: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, U.S. Department of Commerce Data Privacy Framework certifications, and TRUSTe Enterprise Privacy & Data Governance Practices certification from TrustArc.


text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.


text: To date, cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, who we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Tesla, Inc.

ticker: TSLA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, operate a bug bounty program to encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2023, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our information technology systems or data, or those of our service providers or customers or users could be subject to cyber-attacks or other security incidents, which could result in data breaches, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our Enterprise Cybersecurity Services ("ECS") team, led by our Chief Information Security Officer ("CISO"), has first line responsibility for our cybersecurity risk management processes. However, the ECS team works in partnership with other internal teams to coordinate efforts, priorities and oversight. These include: our Cybersecurity Executive Council (the "Council"), which is composed of key leaders from stakeholder groups throughout the Company, including the CISO and certain members of senior management;


text: our Enterprise Risk Management ("ERM") team, which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk, and advising senior management and the Board regarding our overall risk profile and priorities as they evolve;


text: our Internal Audit Department ("IAD"), which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment; and our Cyber Incident Response Team ("CIRT"), a cross-functional team of subject matter experts from across the Company and certain third-party support providers that we have on retainer.


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their security fitness against our risk posture and request changes as we deem necessary.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" in this Form 10-K.


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.


text: Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader ERM program. Specifically, under its charter, the Audit Committee is responsible for overseeing our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations to address and resolve any breaches or issues related to the protection or privacy of our data. Management (including our Chief Information Officer ("CIO") and our CISO) reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel. The Audit Committee chair reports to the full Board on these risk discussions as appropriate. At least annually, the Board meets with members of our ERM team to review and discuss our ERM program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.


text: Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. Formerly known as our Information Security and Risk ("ISR") team, the ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has 24 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.


text: As noted previously, our CISO is a member of the Council, which meets at least quarterly to provide operational direction to the ECS team considering the evolving risk landscape. The ECS team and the Council, through ongoing communication, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit Committee, as appropriate. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701) for our corporate and cloud based software solutions and SOC 2, PCI DSS and HIPAA with respect to our cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party- and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.


text: Our assessment and management of material risks from cybersecurity and privacy threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. In addition, the information security team works with management to prioritize our risks that are more likely to have a material impact on our business and our CISO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the technology committee of the board of directors (the "technology committee") and the board of directors. In addition, the audit committee of the board of directors (the "audit committee") oversees our overall enterprise risk management program and receives semi-annual updates on cybersecurity and privacy threat-related risks as part of such program.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, among other things. cybersecurity consultants, cybersecurity software providers, penetration testing firms and other professional services firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and vulnerability scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.


text: For a description of the risks from cybersecurity threats that may have a material affect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or Senior Vice President of Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last seven years, has been a chief information security officer for eight years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the Chief Executive Officer, the Chief Financial Officer, the General Counsel, the CIO and other senior members of the Company. Such individuals work with our incident response team to help us assess, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the technology committee of the board of directors for certain cybersecurity incidents.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Chief Executive Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages International Organization for Standardization 27001/27002 standards for general information technology controls, the National Institute of Standards and Technology Cyber Security Framework for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management system, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.


text: We perform simulations, tabletop exercises and response readiness tests on an annual basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides guidance to address the overall coordination of our response to a cyber crisis and plan for resources, actions and decisions we may need to be prepared for; a cyber crisis communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis, including the timeline, approval process and monitoring of messaging; and business continuity plans that document the application of specific strategies and measures to enable core business activities to continue during a cyber event. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly. Tabletop testing of the various plans occur annually with quarterly preparedness exercises.


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. We also perform periodic due diligence reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.


text: Refer to "A cyber-attack or failure of one or more key information technology systems, operational technology systems, networks, processes, associated sites or service providers could have a material adverse impact on our business and reputation" in Item 1A. "Risk Factors" for information regarding material risks from cybersecurity threats that affect us.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • comparing our processes to benchmark standards, such as those set by the National Institute of Standards and Technology (NIST); • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • conduct annual customer data handling and use requirements training for employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we may engage with assessors, consultants, auditors, and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain, our CROs or those who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factors entitled "We are increasingly dependent on information technology systems, infrastructure and data. Cybersecurity breaches could expose us to liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," and "Our internal computer systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of development programs for our product candidates," in Part I, Item 1A of this Annual Report on Form 10-K, each of which is incorporated herein by reference.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by a team of senior level management, including our President, Chief Executive Officer and Chairman of the Board, Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Secretary, and VP of Information Technology. Such individuals collectively have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, these members of management report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Hubbell recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Cybersecurity related risks are included in the risk universe that our enterprise risk management program evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop mitigation plans, which are then tracked to completion. Cybersecurity related risks are also considered as part of our business continuity and resiliency planning. Business continuity plans establish risk management processes and procedures to mitigate interruptions to business activities, including from cybersecurity incidents.

companyName: HUBBELL INC

ticker: HUBB


text: Given the complexity and evolving nature of the cybersecurity threat landscape, Hubbell has a dedicated team of internal and external cybersecurity professionals led by Hubbell's Chief Information Security Officer ("CISO") that regularly monitor alerts and meet to discuss threat levels, trends, and remediation. We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. The engagement of third parties includes regular audits, threat assessments, and information system penetration tests. We also actively engage with key vendors, industry participants, legal counsel, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Hubbell further recognizes risks associated with the use of third-party service providers and has processes to identify material risks related to third parties. We conduct security assessments of third-party providers prior to their engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards. Our monitoring includes periodic assessments by the CISO and a team of cybersecurity professionals. Our cybersecurity risk management program is aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF).


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item IA. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("We are subject to risks surrounding our information technology systems failures, network disruptions, breaches in data security and compliance with data privacy laws or regulations.").


text: Hubbell's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated oversight of risks associated with cybersecurity threats and has developed mechanisms to ensure effective oversight in managing such cybersecurity risks. The Audit Committee is composed of Board members with diverse expertise, including cybersecurity and technology, financial, and risk management experience.


text: Hubbell's cybersecurity program is managed by a dedicated CISO who has over a decade of information technology and program management experience. The CISO is responsible for leading our enterprise-wide cybersecurity program and assessing, monitoring, and managing our cybersecurity risks. These responsibilities include overseeing cybersecurity governance programs, testing our compliance with standards, remediating known risks, completing cybersecurity risk management activities related to acquisition due diligence and integration, and leading our employee cybersecurity training program. The CISO stays current with the latest developments in cybersecurity and the evolving threat landscape to inform cybersecurity prevention, detection, mitigation, and remediation efforts. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes processes to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a detailed incident response plan which outlines the steps to be followed from incident detection to mitigation, notifications, and recovery. Notifications include functional areas (including legal), senior management and the Board, as applicable. We have adopted and enforce various enterprise-wide policies relating to cybersecurity, to ensure the ongoing protection of our systems including, policies to identify, classify, and protect company data, manage vulnerabilities, and perform user access reviews. We further conduct drills of our incident response plan to prepare incident response teams and provide cybersecurity training and phishing simulations throughout the year via our enterprise learning management systems.


text: The CISO provides regular (but not less than quarterly) updates to the Audit Committee. These updates include a broad range of topics, including the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives and strategies, incident reports, and the results of internal and external assessments of our information systems. The CISO, in his capacity, regularly informs our Chairman, President and Chief Executive Officer; EVP, Chief Financial Officer; and SVP, General Counsel and Secretary on aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management, including the Company's Disclosure Committee, are made aware of Hubbell's cybersecurity posture and potential cybersecurity risks. Furthermore, any material cybersecurity matters, and strategic cybersecurity risk management matters are promptly escalated to the Audit Committee of the Board.


text: We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party cybersecurity firm who serves as our dedicated information technology (IT) and cybersecurity team and helps us oversee, implement and manage these processes and controls.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: To identify and assess material risks from cybersecurity threats, we consider cybersecurity threat risks individually and alongside other company risks as part of our overall risk assessment process. Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, management coordinates with relevant subject matter specialists as appropriate for each relevant risk area, including our third-party IT and cybersecurity team with respect to information technology and security risks.


text: Management is accountable for our day to day risk management activities. With the assistance of our third-party IT and cybersecurity team, we employ a range of tools and services, including a governance, risk and compliance platform to inform our managements' risk identification and assessment relating to our technology program. With this platform, we map our cybersecurity and risk management program to the Center for Internet Security ("CIS") framework.


text: Processes and controls we have implemented with the assistance of our third-party IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third party cybersecurity firm; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; • leverage the CIS Controls incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident.


text: At least annually, our third-party IT and cybersecurity firm conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents.


text: Through our incident response policy, we have designated an incident response team composed of representatives of management and other employees as well as representatives from our outsourced cybersecurity firm that has responsibility for overseeing cybersecurity incidents. Led by management, our third-party IT and cybersecurity team is responsible for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response policy, incidents meeting specified severity levels are required to be escalated to the incident response team for review and response. The goal of the policy is to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring. Pursuant to our incident response policy, if we are notified of a cybersecurity incident impacting a third-party service provider that affects our information systems or data, we will respond on the same basis as any other incident. We are implementing a business use case review process and vendor risk assessment for all third-party service providers that will access or implicate our materially significant technology or data. If we deem the cybersecurity risk of a particular service provider too great, such service provider will not be approved or access will be terminated.


text: Based on information known to us, we also do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to "Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" and "If we or our tenants fail to adhere to applicable privacy and data security laws, this could have a material adverse effect on us or on our tenants' ability to meet their obligations to us" included "Item 1A, Risk Factors" of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.


text: As described above, we have engaged a third-party IT and cybersecurity firm to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Members of this dedicated third-party IT and cybersecurity team include a virtual chief information security officer (vCISO) who is responsible for the overall development and implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer, and director of information security. Our management, including our Chief Executive Officer, oversees the work of our third-party IT and cybersecurity team and regularly communicates with members of the team. Through the policies and controls described above, including our incident response policy, representatives of the third-party IT and cybersecurity team as well as members of our management, including our Chief Executive Officer, are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents. The representatives of our third-party IT and cybersecurity team who lead our cybersecurity risk management and risk assessment process have collectively over 30 years of prior work experience in various roles managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans. The members of the cybersecurity team hold degrees in computer engineering and cybersecurity as well as advanced cybersecurity certifications, including a Certified Information Systems Security Professional (CISSP) certification, a Certified Information Systems Auditor (CISA) credential and a Certified Information Security Manager (CISM) certification. Other members of our third-party cybersecurity team have also obtained various professional certifications and advanced training in the areas of information security and cybersecurity.


text: Our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic processes covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture, the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Outside of quarterly presentations, the chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the audit committee would also be expected to review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the Securities and Exchange Commission. Through their participation in meetings of the audit committee, other members of the Board are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee and Quality, Compliance and Technology Committee (QCT Committee) of the Board of Directors and is managed by a dedicated Chief Information Security Officer (CISO), whose organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at another healthcare company. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including our control measures, and to assist in conducting risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability, such as the ongoing monitoring of our systems, including with the assistance of third party vendors, conducting routine exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes, and engaging with proxy advisors and external cybersecurity rating agencies that assess our cyber risk to improve our internal evaluations and vulnerability management processes. In addition, to help promote privacy and security awareness throughout the company, all employees with a valid Baxter email address receive annual training and access to virtual events and updated materials. Further, our Third-Party Risk Management Program includes assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups led by senior management that report to the cybersecurity steering committee or cybersecurity executive oversight committee, as appropriate, on matters such as, among other things, enterprise level cybersecurity initiatives and directives, threat intelligence and product cybersecurity risks and remediations. Our cross functional cybersecurity steering committee, which is led by the CISO, is composed of members of senior management, including the Chief Information Officer, and reviews matters such as product security escalations, critical remediations and disclosure recommendations. The output from the steering committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Compliance & Trust Officer and our business segment presidents. The cybersecurity executive oversight committee meets quarterly, oversees enterprise and cybersecurity risk management and reports to the Audit Committee and QCT Committee of the Board. The Audit Committee currently oversees our information technology functions generally, including non-product-related cybersecurity matters, and the QCT Committee oversees product or service-based information technology matters, including with respect to product cybersecurity matters. The Audit Committee is also responsible for the oversight of any cybersecurity incident, including ones related to our products and services. Both committees receive updates from management on cybersecurity-related topics within their purview throughout the year. Additionally, the full Board generally receives periodic updates on information technology and cybersecurity matters from management and external advisors.


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our patients, customers, operations, partners, employees and third parties, consistent with our legal obligations. Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations to date. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. See Item 1A. Risk Factors "Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" for a discussion of cybersecurity-related risks.


text: In our business operations, we use information technology, enterprise applications, communications tools, cloud network solutions, and related systems to manage our operations, including to manage our building systems, tenant and vendor relationships, accounting and recordkeeping, and communications, among other aspects of our business.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: We have developed and implemented a cybersecurity risk management program intended to protect our properties, confidential and proprietary data, and information technology and systems, from cybersecurity threats, including unauthorized access or attack. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to the business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our processes for assessing, identifying, and managing risks from cybersecurity threats, including operational risks, financial reporting risks, reputational risks, personal data theft, fraud, and other potential risks, are integrated into our overall enterprise risk management process, and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas.