text: Role of management Our Chief Information Security Officer is responsible for the day-to-day management of our cybersecurity risks. To ensure robust oversight, we have established a Security Council comprising senior leaders, including our Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel and Chief Privacy Officer. The Security Counsel meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and cybersecurity.


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Chief Information Security Officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI

secItem: Item 1C


text: Our Chief Information Security Officer has extensive experience in the information technology area, with over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC. Our Chief Information Security Officer aims to ensure rigorous oversight and execution of our cybersecurity and information security strategy.


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Managing Director of Information Technology serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). Included are policies and procedures to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third-party as compliant with the ISO 27001 standard. The Committee engages multiple third-party experts to perform penetration tests on a periodic basis, and to assess whether these policies and procedures are designed appropriately and operating effectively.


text: Cybersecurity oversight forms part of the Board's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives at least annual reports and meets periodically with the Chief Compliance Officer and the Managing Director of Information Technology, both of whom serve on the Committee. From its review of these reports and discussions with the Committee and management, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has three members who have obtained certifications in cybersecurity oversight.


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business. In 2024, the Company did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition. However, despite its efforts, the Company cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Technology Risk & Information Security Officer serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, legal, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented an information security program that includes a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). The policies and procedures within the program, among other things, are to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third party as compliant with the ISO 27001 standard. The Committee engages third-party experts to perform penetration tests on a periodic basis and to assess whether these policies and procedures are designed appropriately and operating effectively.


text: Cybersecurity oversight forms part of the Board 's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives quarterly reports and meets periodically with the Committee chair. From its review of these reports and discussions with management and the Committee chair, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has four members who have obtained certifications in cybersecurity oversight.


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard (PCI DSS). Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: We undertake a bi-annual NIST CSF and CIS 18 Critical Security Controls assessment, conducted by a third-party, to measure our program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review, with various frequencies, on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks, for execution by our information security team, in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to test our response processes and incident management procedures.


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Vice President of Information Security and Chief Information Security Officer (CISO) presents cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.


text: Our information security organization is led by our CISO, who has over eighteen years of relevant experience, serving in leadership roles across the retail and technology sectors. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our CISO reports to our Chief Information and Digital Officer (CIDO), who has more than thirty years' experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.


text: Risks from Material Cybersecurity Threats We and our third-party service and merchandise providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Form 10-K, we are not aware of any risks from actual cybersecurity incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. It is possible that there have been intrusions into our systems that have not been identified by our controls and procedures and that might manifest in significant events at a later time. There can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing will be sufficient to protect our systems, information or other property. See "Risk Factors" in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard. Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.


text: We undertake regular NIST CSF and CIS 18 Critical Security Controls assessments, conducted by a third-party, to measure program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review with various frequencies and on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to review our response processes and incident management procedures.


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Chief Information and Digital Officer (CIDO) and his executive team, including the Vice President of Information Security and Chief Information Security Officer (CISO), present cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.


text: Our information security organization is led by the CISO. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our former CISO left the Company in June 2025, and we are actively sourcing a qualified replacement. In the interim, our Deputy CISO, who has over 20 years of cybersecurity and leadership experience, is managing the CISO responsibilities. The CISO position reports to our CIDO, who has more than 30 years experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.


text: The importance of protecting against unauthorized access to or use of customer data that has been entrusted to us as part of the various services provided to our customers; as well as operational disruptions caused by cybersecurity events, is of paramount importance to us. The Bank relies upon a formalized Information/Cybersecurity Program ("ICP") to ensure we are protecting the confidentiality, integrity and availability of confidential information. The ICP is approved by the Board of Directors or a Committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risk levels to within the documented risk appetite. The ICP has been designed to align with industry best practices, as well as Regulatory guidelines and laws; and leverages both the Secure Control and the National Institute of Standards and Technology Cybersecurity frameworks as its baselines.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: The ICP incorporates formal policies and procedures to ensure established controls are subjected to testing and independent effective challenge, to provide for appropriate due diligence and ongoing oversight of third parties who have access to our confidential information and/or systems, and to provide information and cybersecurity training to our employee population to ensure awareness of risks facing the institution and latest techniques used by malicious actors. A key component of the training program is the performance of phishing and social engineering campaign, the result of which are used to gauge the training program's effectiveness, as well as to identify employees that pose a potential higher level of phishing/social engineering susceptibility risk, with all such employees provided additional targeted training. The ICP also includes subject matter expert review of third-party servicing agreements to ensure provisions adequately protect the bank in the event of a cybersecurity event whenever the relationship involves sensitive customer information. Internal auditors and third-party security experts are relied upon to review and ensure that established controls are appropriately designed, effectively implemented, and operating as intended; with such reviews undertaken as part of the Bank's internal audit and third-party penetration testing programs.


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's formalized enterprise risk management program ("ERM Program"), which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The ERM Program sets forth enterprise-wide operational practices to ensure consistency in the organizations approach to risk identification, documentation, measurement, management, and mitigation with all aspects of risk management documented within a centrally maintained risk management platform ("RMP"). A key aspect of the ERM Program is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the RMP, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will, and have satisfactorily addressed the identified issue.


text: A formal Incident Response Plan ("Plan") is maintained by the Information Security Department, and approved by the Board of Directors or designated Committee thereof at least annually. The Plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident ("Incident"). The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified Incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an Incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.


text: We believe that the impact of any previously identified cyber incidents, including those subject to ongoing investigation and remediation, will not have a material impact on the Company, including business strategy, results of operations or financial condition.


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the enterprise risk management and information/cybersecurity risk management programs. The Committees meet monthly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Enterprise Risk Management and Information/Cybersecurity Programs. The Committees rely upon various management level committees (e.g.


text: Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching risk management framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Risk Officer, and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions ("FI") and FI service providers primarily within the New York metropolitan area.


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's Risk Governance Framework, which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The Risk Governance Framework sets forth enterprise-wide operational practices to ensure consistency in the Company's approach to risk identification, assessment and testing, issues management, and mitigation with all aspects of risk management documented within a centrally maintained Governance, Risk and Controls ("GRC") risk management platform. A key aspect of the Risk Governance Framework is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the GRC risk management platform, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will and have satisfactorily addressed the identified issue.


text: A formal incident response plan is maintained by the Information Security Department and approved by the Board of Directors or designated Committee thereof at least annually. The response plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident. The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees meet quarterly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees rely upon various management level committees (e.g. Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching Risk Governance Framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Information Officer and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions and financial institutions service providers primarily within the New York metropolitan area.


text: We maintain a comprehensive cybersecurity program, recognizing the critical importance of safeguarding our operations, employees, customers, and other business partners from the constantly evolving risks associated with cybersecurity threats. These risks include, among other things, operational risks, reputational risks, financial risks, and litigation and legal risks.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: As a part of our comprehensive cybersecurity program, we have developed an incident response plan (IRP) designed to quickly respond to, mitigate, and recover from cybersecurity incidents. The IRP includes procedures for incident detection and reporting, initial assessment, containment, eradication, recovery, post-incident activities, and continuous improvement.


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Technology Officer (CTO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CTO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.


text: In the three-year period ended March 31, 2024, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats or incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material threats or incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.


text: Our Board of Directors has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CTO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board of Directors. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.


text: Our CTO and CISO have extensive experience in cybersecurity. Our CTO has served in his role since 2014. He has also served in various roles in Information Technology for over 25 years, including the oversight of Information Security for 15 years. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Digital & Data Officer (CDDO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CDDO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.


text: In the three-year period ended March 31, 2025, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior cybersecurity incidents experienced by either us or third parties, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.


text: Our Board has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CDDO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.


text: Our CDDO and CISO have extensive experience in cybersecurity. Our CDDO has served in his role since September 2024. He has over 15 years of experience in digital transformations, enterprise technology, artificial intelligence, and data management. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. We maintain a robust cybersecurity infrastructure to safeguard our operations, networks, and data through comprehensive security measures including our technology tools, internal management, and external service providers.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: Our Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 14 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 28 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information System Security Professional ("CISSP") certifications.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management, including information technology and cybersecurity. The Audit Committee routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends, and regulatory developments from the CIO.


text: We use a risk-based approach to identify, assess, protect, detect, respond to, and recover from cybersecurity threats, utilizing industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework, internal controls, and robust technological toolsets. Our information security program includes, among other aspects, penetration and vulnerability assessments and management, intrusion detection systems, antivirus and malware protection, encryption, access control, high availability and redundancy, and employee training. Risks identified by the CIO and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The CIO also routinely discusses trends in cyber risks and our strategy with our Audit Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any incidents from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our Chief Information Officer (" CIO ") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 15 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 29 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information Systems Security Professional ("CISSP") certifications.


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training. Our teams evaluate the risk profile of third-party service providers, considering key risk factors such as cybersecurity measures, data privacy policies, and regulatory compliance. We maintain communication channels with key third-party service providers to assess and respond to potential impacts of incidents within a service provider's organization. We rely on our third parties to communicate such incidents to us in a timely manner. Beyond cybersecurity assessments, our teams conduct a structured due diligence process as part of our vendor compliance program for third-party providers that meet specific criteria set by us. We use third-party risk management services to evaluate additional risk factors, including but not limited to past or pending litigation, criminal history, derogatory information, and financial stability.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. Such processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: We engage external parties to supplement our internal capabilities and to assess our cyber maturity and readiness on a periodic basis. This includes being party to a managed services agreement with an external party for incident response; engaging an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery; and engaging additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives. While utilizing third-party service providers presents risk, we assess all third-party service providers for their qualifications before engaging them and monitor such providers throughout the term of the engagement in order to help protect us from any additional vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors ("Audit Committee") provides direct oversight over cybersecurity risk and acts in an advisory capacity to our management team, primarily, as it relates to cybersecurity, our Chief Information Officer ("CIO"), and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles.


text: In an effort to deter and detect cyber threats, we provide key employees, with various cybersecurity trainings that cover timely and relevant topics, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have specific processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. These processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. The processes are updated as needed on an annual basis.


text: Based on an assessment using the previously described cybersecurity risk management processes, we do not believe that there are currently any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles. Our CIO is supported by a dedicated team of cybersecurity professionals in addition to managed services and retained external experts.


text: In an effort to deter and detect cyber threats, we provide key employees with various cybersecurity trainings that cover a range of timely and relevant topics. The trainings function to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We recognize the importance of assessing, identifying, and managing material risks to our Company associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader enterprise risk management program process, covering other Company risks. As part of this process our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material information security breach incidents and the expenses we have incurred from information security breach incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risk. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The purpose of the Cybersecurity Steering Committee is to oversee our compliance with reasonable and appropriate organizational, physical, administrative and technical measures designed to protect the confidentiality, integrity, availability, security and operations of our information technology systems, transactions, and data owned by us, by providing guidance and oversight of our information technology and cybersecurity program.


text: The Cybersecurity Steering Committee generally meets on a quarterly basis and receives reports from the CISO and CIO of our cybersecurity and information security risk management and strategies, covering topics such as data security posture, results from third-party assessments, progress towards key initiatives, our incident response plan, and cybersecurity threat risks, incidents and developments. The Cybersecurity Steering Committee generally delivers reports and updates to the Audit Committee once a quarter.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 9 years of experience in cybersecurity and information technology risk managing, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our CISO and CIO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as vulnerability assessments, penetration testing, and tabletop exercises.


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risks. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity-related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 10 years of experience in cybersecurity and information technology risk management, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategies and implementing effective information and cybersecurity programs.


text: Cyber Risk Management and Strategy The Company, under the oversight of the Audit Committee of its Board of Directors, has implemented and maintains a cybersecurity risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This program extends to third-party vendors and the various properties under the Company's management, including corporate and commercial properties, through establishing vendor risk requirements and conducting vendor risk assessments.

companyName: MACERICH CO

ticker: MAC


text: This risk management program addresses, but is not limited to, risks identified by external auditors and assessors, internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. An internal audit team at the Company manages and maintains remediation strategies for identified risks, and reports on them regularly to senior leadership. As part of the Company's cyber risk management program, the Company has engaged external independent assessors to conduct cyber risk assessments, evaluate cyber risk management controls, and report both findings and recommendations to management.


text: The Company, like other companies in its industry, faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date, the Company has, from time to time, experienced threats to and security incidents related to its data and systems. For more information about the cybersecurity risks the Company faces, see Item 1A. Risk Factors.


text: Related to Cybersecurity Risks The Company's cyber risk management program and related operations and processes are directed by the Senior Vice President of Information Technology (the "SVP-IT"). Currently, the SVP-IT role is held by an individual who has over twenty five years of cybersecurity, information technology and systems engineering experience. The SVP-IT meets with the Chief Financial Officer and Chief Legal Officer quarterly to monitor and review the outcomes of the Company's cybersecurity risk management processes and to discuss and decide matters related to cybersecurity risk treatment strategy (including mitigations).


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.


text: The Company's Board of Directors plays an important role in risk oversight and discharges its duties both as a full board and through its committees. The Board has delegated oversight of risk management matters, including cybersecurity and information technology matters, to its Audit Committee. As reflected in the Audit Committee charter, the committee is responsible for reviewing information technology, cybersecurity and other data protection strategies and plans, as well as assessing incident response protocols. The Security Committee provides quarterly reports to the Audit Committee and the SVP-IT attends board meetings yearly, or more frequently as appropriate, to inform the Company's Board of Directors on cybersecurity risks.


text: Additionally, the Company is subject to the requirements of the Sarbanes-Oxley Act of 2002 and information technology general controls are an important part of the Company's internal control over financial reporting and are subject to controls testing. Control deficiencies that represent cybersecurity risks would be reported by management to the Audit Committee.


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, property management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.


text: We have developed an information security program that is designed to address material risks from cybersecurity threats and our cybersecurity risk management processes are integrated into our overall risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A cybersecurity risk assessment, based on an internationally recognized methodology, is conducted annually.

companyName: GUESS INC

ticker: GES


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software, and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cyber security awareness training annually.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factors under the heading "Risks Related to Data Privacy and Cybersecurity" in Part I, Item 1A of this Report for additional information about the risks we face associated with cybersecurity threats.


text: The Chief Information Security Officer (CISO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 with knowledge of both operations and governance. In his previous position as Chief Technology Officer for an international managed security service provider, he worked as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide management level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The CISO provides quarterly updates on the information security program to the Audit Committee and more frequently as circumstances require.


text: We have developed and integrated into our overall risk management program an information security program that is designed to address material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. A cybersecurity risk assessment, based on an internationally recognized methodology, is conducted annually.


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, we have used third parties to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cybersecurity awareness training annually.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "—Risks Related to Data Privacy and Cybersecurity" in "Item 1A. Risk Factors" of this Annual Report for additional information about the risks we face associated with cybersecurity threats.


text: The Chief Information Security Officer ("CISO") is the management position with primary responsibility for the development, operation, and maintenance of our information security program, which includes cybersecurity. Our CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 and ISO 22301 with knowledge of both operations and governance. He previously served as Chief Technology Officer for an international managed security service provider, during which time he served as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide a management-level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The Audit Committee is informed of cybersecurity-related risks through the CISO providing quarterly updates on the information security program and more frequently as circumstances require.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its annual cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessment, penetration testing, or ethical hacking; and to audit and provide advice on how to make its security operations and controls more effective.


text: Furthermore, the Company utilizes third-party service providers to perform a variety of functions to assist in operating the business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided, the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Senior leadership, including the Chief Digital Information Officer, updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit and Risk Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of internal audit, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents. While prior incidents have not had a material effect on the Company's business, there can be no guarantee that the Company will not experience a future incident that does have a material effect on its business. See "Risk Factors - Risks Related to Information Technology - The Company's business and financial performance may be adversely affected by cybersecurity attacks, information systems interruptions, equipment failures, and technology integration" for more information on the Company's cybersecurity risks.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber incidents, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.


text: Our business operations rely on the consistent availability of our communication platforms, enterprise applications, and related systems. We have implemented protocols to ensure the secure collection, storage, and transmission of data and have invested in the development and enhancement of controls designed to prevent, detect, and respond to unauthorized access, computer viruses, malware, data exfiltration, and other threats.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001:2013 standard to ensure the consistent application of security principles, policy statements, and controls. In adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data by partnering with reputable, recognized security firms, and conducting ongoing internal and external information security audits, risk assessments, anti-phishing campaigns, penetration testing exercises, systems monitoring activities, employee training, and cyber incident response exercises. Our policies include standards and procedures for vulnerability management, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, mobile device management and system monitoring. SUN COMMUNITIES, INC.


text: Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.


text: To manage vendor risk, we conduct ongoing risk assessments based on the vendor's published Systems and Operational Controls ("SOC") reports, information provided in vendor security questionnaires, and any publicly available information including ongoing litigation or external disclosures.


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.


text: Senior leadership provides the Board of Directors with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, third-party audit reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Audit Committee of the Board of Directors provides oversight and is responsible for assessing risks to our business, in accordance with its charter. The Audit Committee engages in regular conversations with senior leadership about our security systems in order to monitor and mitigate risks from cybersecurity incidents, in accordance with our security principles and protocols.


text: The Senior Vice President of Information Technology and the Director of Information Security bear direct responsibility for daily management of cyber risk. Oversight from the executive team, led by the Chief Administrative Officer, ensures strategic alignment. With a wealth of executive leadership spanning over 20 years in both public and private sectors, these individuals collectively possess more than 75 years of invaluable experience in information technology and security.


text: The Information Security Management Committee (ISMC) and Enterprise Risk Management Committees (ERM) meet regularly to provide oversight of cyber risk management functions. Committee composition includes members from cross-functional departments, including technology, innovation, human resources, accounting and finance, internal audit, operations and executive management. Various members of these committees hold industry certifications representing expertise in information security risk and compliance management, including the Certified Information Technology Professional (CITP), Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), and Certified in Risk and Information Systems Control (CRISC) designations. SUN COMMUNITIES, INC.


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001 standard to ensure the consistent application of security principles, policy statements and controls. By adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data through the following actions: • Partnering with reputable, recognized security firms • Conducting regular internal and external audits and risk assessments • Providing ongoing employee security awareness training • Conducting tabletop exercises • Running anti-phishing campaigns and simulated phishing exercise • Deploying tools for continuous vulnerability monitoring • Performing penetration testing and continuous system monitoring activities • Conducting recovery simulations for core systems and data centers Our comprehensive policies and procedures address critical areas including: • Vulnerability management • Business continuity planning • Encryption of sensitive data • Backup and recovery SUN COMMUNITIES, INC.


text: • Physical security • User access controls • Vendor risk management • Teleworking protocols • Mobile device management • Comprehensive system monitoring These initiatives collectively reinforce our commitment to safeguarding information and ensuring the resilience of our security infrastructure. Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.


text: The Chief Information Officer (CIO) and the Director of Information Security are directly responsible for managing cyber risk on a daily basis. The CIO reports to the Chief Administrative Officer (CAO), who oversees the Company's overall information technology strategy and governance. Executive oversight, spearheaded by the CAO, ensures strategic alignment across the organization. With a wealth of leadership in both public and private sectors, these individuals collectively possess years of invaluable experience in information technology and security.


text: Cybersecurity risk oversight and management is a top priority for the Company and the Board of Directors. The Company offers a broad portfolio of industrial cybersecurity solutions to its customers, and an understanding of cybersecurity risks is critical to both the Company internally and to our customers and business partners. The Company identifies, assesses, and manages cybersecurity risk as part of both the enterprise cybersecurity program and the enterprise risk management program. The Company's expertise, dedicated resources and proven technology in cybersecurity management are evident in the Company's enterprise cybersecurity program. The Company's Cybersecurity Committee (described below) is a subcommittee of and reports to the Audit Committee, which oversees the enterprise risk management program.

companyName: BELDEN INC.

ticker: BDC


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including: •24/7 Security Operations Center,


text: • advanced endpoint detection/response, • user behavior analytics, • vulnerability identification/patching, • email threat prevention, • data loss prevention, • privileged access management, and • ongoing/annual phishing training / testing.


text: To ensure the Company is addressing constant changes in the threat landscape, management and the Board of Directors continue to advance their cybersecurity knowledge and stay current with evolving information, regulations and industry practices through our memberships and affiliations with industry leading companies such as Crowdstrike, IBM, and Palo Alto Networks, as well as national organizations such as the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and others. In addition, to supplement our efforts, expert consultants and third-party vendors are engaged from time to time to assess enterprise security posture, identify operational technology vulnerabilities, and assess software product security. In addition to these assessments, the Company engages third-party vendors to perform enterprise-wide attack and penetration tests. Findings from these activities are reported to senior management and the Belden Board of Directors.


text: The Company recognizes the importance of identifying and managing material cybersecurity risks associated with our use of third-party service providers. To address these third-party risks, the Company has developed a program to assess both new and existing vendors and suppliers that are expected to have access to or otherwise influence Belden's internal network or internal data. Components of this program include customed vendor security assessments, security architecture review, and third-party rating services. We perform cybersecurity due diligence through this program as appropriate in connection with the on-boarding of a third-party relationship and conduct periodic reviews based on the inherent risk profile of the particular provider.


text: Impact of Cybersecurity Risks on Strategy and Results Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company believes that they are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The Company experienced a cybersecurity breach in 2020. The Company determined the impact of this incident was not material, but enhanced its cybersecurity controls and processes in response to the incident. The Company has taken reasonable measures to protect against future compromise, and believes these measures will protect against material adverse impact, including its business strategy, results of operations or financial condition.


text: In 2018, in recognition of the unique nature of cybersecurity threats and the desire to apply focused oversight of cybersecurity risk, the Company's Board of Directors formed a Cybersecurity Subcommittee (the "Subcommittee") providing oversight of the Company's cybersecurity posture and reporting to the Board's Audit Committee. The Subcommittee consists of three independent directors with experience and/or expertise in cybersecurity management and oversight. The Subcommittee meets regularly on at least a quarterly basis. The Subcommittee has full access to management and consultants engaged by management and receives regular reporting directly from the Company's chief information officer, head of cybersecurity, internal audit and the legal function, as well as third-party assessments of the Company's cybersecurity processes. In addition, the full Board of Directors receives a report on cybersecurity annually, or as necessary.


text: The Company's cybersecurity program is managed by a dedicated vice president of cybersecurity, who reports directly to Belden's chief information officer and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The chief information officer reports directly to the Company's chief financial officer and has access to other members of senior management, including Belden's chief executive officer, as appropriate. Belden's vice president of cybersecurity has over 30 years of IT experience, including twelve years of cybersecurity experience. Belden's chief information officer has over 35 years of IT experience, a BS in Computer Science and an MBA.


text: The Company's policies and procedures described above are designed to ensure that the Company's vice president of cybersecurity and chief information officer and other necessary members of any cybersecurity response team are appropriately informed of any cybersecurity matters and the status of our ongoing processes. The Company's vice president of cybersecurity and chief information officer jointly provide periodic reports to the Subcommittee, the Company's CEO and CFO, and other members of management. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The Company's program is regularly evaluated internally and externally and updates are presented to senior management and the Subcommittee. The Company also actively engages with key vendors, industry participants, and knowledge leaders as part of the Company's continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.


text: Cybersecurity risk oversight and management is a top priority for the Company and the Board of Directors. The Company offers a broad portfolio of cybersecurity solutions to its customers, and an understanding of cybersecurity risks is critical to both the Company internally and to our customers and business partners. The Company identifies, assesses, and manages cybersecurity risk as part of both the enterprise cybersecurity program and the enterprise risk management program. The Company's expertise, dedicated resources and proven technology in cybersecurity management are evident in the Company's enterprise cybersecurity program. The Company's Cybersecurity Committee (described below) is a subcommittee of and reports to the Audit Committee, which oversees the enterprise risk management program.


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including:


text: •24/7 Security Operations Center, • advanced endpoint detection and response, • user behavior analytics, • vulnerability identification and patching, • email threat prevention, • data loss prevention, • identity and privileged access management, and • ongoing phishing training and testing.