text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives (i) quarterly updates or reports delivered directly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") and (ii) three reports delivered as part of the Company's enterprise risk management update to the Audit Committee. These reports may be supplemented, as needed, by the CIO, CISO, and other executives at the Company. These reports include a variety of cybersecurity topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks. In such sessions, the Audit Committee receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our CIO and CISO.

companyName: JUNIPER NETWORKS INC

secItem: Item 1C


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.


text: Our CISO oversees our cybersecurity risk management program in partnership with our CIO and other business leaders, including our General Counsel. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 39 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 25 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.


text: To aid in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls incorporating principles from standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: We regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having third parties, including independent Qualified Security Assessors review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 40 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 26 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, employees and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EPR PROPERTIES

ticker: EPR


text: The Company's cyber risk management program is led by the Company's Vice President of Information Systems, whose team is responsible for leading company-wide cybersecurity strategy, policy, and processes while reporting directly to the Company's Chief Financial Officer. While the Board has ultimate oversight for the risk management process, the Audit Committee is responsible for overseeing the Company's policies and procedures for assessing and managing its exposure to risk, including cybersecurity risks. The Company's Vice President of Information Systems provides regular reports to the Audit Committee on any cyber risks and threats to the Company, assessments of the Company's security program and projects in progress to enhance the Company's security systems. The Company's Board of Trustees also receives periodic updates relating to the Company's cybersecurity programs and emerging cybersecurity threats as part of its general oversight duties. Pursuant to the Company's response plan, the Board and the Audit Committee will receive prompt and timely information regarding any material cybersecurity incidents.


text: The Company has a documented response plan to follow in the event a cybersecurity incident occurs. The plan details how to determine the scope and risk of an incident, incident response, communication of incident results and risks to all stakeholders and how to reduce the likelihood of an incident occurring or reoccurring. On an annual basis, the Company conducts a test of the cyber response plan in order to test its pre-planned actions, facilitate discussions regarding the plan's effectiveness and identify useful strategies and tactics learned from the test. Additionally, the Company's security program is supported by external third-party experts, including outside cybersecurity professionals at a security operations center and expert legal counsel specializing in information technology and cybersecurity.


text: The Company's cyber risk management program includes processes for identifying and overseeing both internal cybersecurity risks and those presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third party systems.


text: In addition, the Company conducts frequent security awareness trainings for all employees, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.


text: The Company's Vice President of Information Systems has been with the Company for over 18 years and has overseen the Company's information systems, including its cyber risk management program, for the last five years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, associates and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: In addition, the Company conducts frequent security awareness trainings for all associates, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.


text: The Company's Vice President of Information Systems has been with the Company for over 19 years and has overseen the Company's information systems, including its cyber risk management program, for the last six years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: NVIDIA CORP

ticker: NVDA


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.


text: Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.


text: We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats. Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data they process on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. Within the Company's Enterprise Risk Management program, Technology Risk Management plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, prompt remediation measures are implemented to reduce the risk to an acceptable level.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Identification of risks is a multifaceted process, encompassing diverse activities such as management self-disclosure, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third-party service providers/vendors. The Technology Risk Management practice operates as a continuous model assessment, utilizing information gathered daily, weekly, monthly, and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities may be outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establish policies and standards required to be implemented in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts, law enforcement, along with documentation of regulatory notification. Our practices are interdependent with service providers/vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.


text: The Company's Board of Directors ("Board") provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.


text: Direct oversight of cybersecurity risks is delegated to the Board's Risk and Technology Committee. The Committee meets at least quarterly and receives reports detailing current risks, the maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board. All Committee reports are available to the full Board for review. In the event of critical matters arising between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.


text: To further ensure independence and effectiveness, the Board has delegated authority for the conduct of the cybersecurity program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Board's Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.


text: Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. The Board-approved Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management program, which includes Technology Risk Management.


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees Technology Risk Management. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring, and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.


text: The Company's information technology department, including a dedicated security operations group, plays a crucial role in implementing practices aligned with the Information and Cyber Security Policy and Program requirements. Responsibilities include the maintenance and monitoring of systems, network(s), and application access and error logs, identification of unauthorized access attempts, adherence to access controls standards, configuration management, and the implementation of controls to mitigate risks related to information availability, integrity, and confidentiality.


text: Business activities, products, and services are managed by experts in their respective fields, with employees receiving training to detect and prevent material cybersecurity threats. Business leaders are expected to understand specific threats within their areas of responsibility and adhere to established processes and standards to control such threats.


text: To facilitate a transparent and collaborative approach to managing cybersecurity risk, an executive management level committee has been established. Chaired by the Chief Risk Officer and administered by the Technology and Risk Management Director, the committee ensures continual awareness of the information and cybersecurity risk posture, emerging threats, known threat actors, and vulnerabilities. Its purpose is to foster a security culture within the Company through active participation in planning and managing threat and security risk activities.


text: All committee activities are reported to the Board's Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. The Company's Enterprise Risk Management program and team plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the implementation of a holistic risk management program for overseeing the assessment and appropriate control of information and cybersecurity risks. Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of the Bank's risk appetite and security testing expectations. Risks identified are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal remediation activities that are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level Identification of risks is a multifaceted process, encompassing diverse activities such as the execution of formal risk assessments, as described above, management self-disclosures, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third party service providers/vendors. The dedicated Technology Risk Management team operates a continuous risk management framework, utilizing information gathered daily, weekly, monthly, quarterly and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities are performed internally and are outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank's security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establishes the additional policies and standards the Bank is required to implement in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts and law enforcement, along with documentation of regulatory notification requirements. Our practices are interdependent with third party vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, reputation, results of operations and financial condition. During the reporting period, the Company had not experienced any material cybersecurity events or incidents. Although third party service providers that the Bank engages have encountered cybersecurity events or incidents during the year ended December 31, 2024, the Bank's investigation of each event or incident has shown that these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.


text: The Board provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.


text: Direct oversight of information and cybersecurity risks is delegated to the Risk and Technology Committee of the Board. The Risk and Technology Committee meets at least quarterly and receives reports detailing current risks, maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an interim basis to address developing risk. All Risk and Technology Committee reports are available to the full Board for review. In the event critical matters arise between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.


text: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.


text: Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. As discussed above, the Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management Program, which includes the Technology Risk Management team, and responsibilities assigned to various employees and the Risk and Technology Committee.


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees the Technology Risk Management function. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.


text: All committee activities are reported to the Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director. The Risk and Technology Committee provides similar reports to the full Board quarterly, as well as on an as-needed basis. Results of cybersecurity-related audits are also reported to the Board's Audit and Finance Committee.


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend considerable resources on cybersecurity risk management, strategy and governance.

companyName: Ingredion Inc

ticker: INGR


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management. The Board of Directors reviews material cybersecurity risks we face, approves strategic priorities, and monitors progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management our policies and procedures with respect to cybersecurity risks and the processes management has implemented to monitor and mitigate those risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity policies and standards, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.


text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology (NIST) framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.


text: We have implemented a number of cybersecurity risk management processes to assess, identify and manage material risks from cybersecurity threats. We conduct real-time monitoring of our environment for suspicious cyber activity using a variety of security tools and centralized logging systems. In addition, we leverage threat intelligence monitoring to stay updated on emerging cyber threats and vulnerabilities and, utilizing this information, conduct regular vulnerability assessments. Furthermore, we conduct regular penetration tests to simulate real-world attacks and identify weaknesses.


text: To supplement our internal resources, we engage external consultants to conduct independent assessments, perform penetration testing, and provide other cybersecurity-related services as needed. We also utilize external consultants and legal counsel to facilitate cybersecurity tabletop simulations. In addition, we engage external vendors to review and test key controls within our cybersecurity program.


text: We regularly assess cybersecurity risks associated with our use of suppliers and other third-party service providers. In this process, we classify by level of risk our principal suppliers and other key service providers and evaluate their data security controls and changes in potential cybersecurity risk levels. In addition, our contracts with these service providers require them to promptly report security incidents to us and to provide us with access to relevant information and resources to allow us to conduct related investigations.


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management (ERM) processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.


text: Subject to oversight by our Board of Directors and Audit Committee, as described above, our Chief Digital and Information Officer is responsible for developing and guiding our global information technology and digital strategy, which includes overseeing cybersecurity risk management. The Chief Digital and Information Officer provides guidance on cybersecurity strategy initiatives and risk mitigation activities to the Senior Director, Global Information Security and the associated function. Our Chief Digital and Information Officer and our Senior Director, Global Information Security provide regular reports on security incident activity, including containment and remediation measures as relevant, and other cybersecurity risk management matters to the Board of Directors and the Audit Committee.


text: Our Chief Digital and Information Officer has over 30 years of experience at multinational companies, including six years of service at our company in his current position as a digital leader and executive, including experience managing and responding to cybersecurity risks. He holds a bachelor's degree in computer science. Our Senior Director, Global Information Security has over two decades of service at multinational companies and a federal government agency, including over one year of service at our company in his current position dedicated to information technology and cybersecurity, and possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional (CISSP) certification.


text: To date, the risks from cybersecurity threats have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition.


text: For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend what we consider to be adequate resources on cybersecurity risk management, strategy and governance.


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management by reviewing material cybersecurity trends, potential risks and strategic priorities, and by monitoring progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management the processes management has implemented to monitor and mitigate cybersecurity risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity strategy, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.


text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology ("NIST") framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.


text: Our Chief Digital and Information Officer, who holds a bachelor's degree in computer science, has over 30 years of experience at multinational companies, including seven years of service at Ingredion in his current position as a digital leader and executive, which includes experience managing and responding to cybersecurity risks. Our Senior Director, Global Information Security, who has over two decades of service at multinational companies and a federal government agency, including over two years of service at Ingredion in his current position dedicated to information technology and cybersecurity, possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional ("CISSP") certification.


text: To date, cybersecurity breaches have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.


text: Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system for assessing, identifying, and managing cybersecurity risks, designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while helping to support business resiliency and seeking to protect employee, guest, and franchisee information from unauthorized access or attack, as well as seeking to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Compliance and Enterprise Risk Management Committee.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Company devotes significant resources to helping protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company is in the process of assessing its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective of improving decision-making and prioritization and promoting monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.


text: To help oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, the Company has a third-party information risk management program intended to minimize the likelihood of misuse of Choice data by third parties and business partners and requires that third-party service providers complete a periodic security risk assessment. Depending upon the identified risk, actions such as obligating the third party to remediate the identified deficiencies or termination of the relationship may occur. Also, depending upon the nature of the relationship and data, third party agreements include security and privacy provisions that oblige third parties to abide with applicable regulations and employ reasonable security controls.


text: The Company's Board of Directors does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.


text: The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.


text: The Company has a Chief Information Security Officer ("CISO") whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks. The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC.


text: The Company has also established a cross-functional cybersecurity oversight committee led by our CISO serving as the chair and consisting of executive-level leaders, that is responsible for the Company's cybersecurity, disaster recovery, and business continuity programs. The Company's internal audit team also provides independent assurance on the functional components of the Company's cybersecurity program and reports the results of these audits in its quarterly reports to the Audit Committee.


text: In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.


text: Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system to assess, identify, and manage cybersecurity risks. The system is designed to help protect the Company's information assets and operations from internal and external cyber threats. The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee.


text: The Company devotes significant resources to help protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's applicable technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.


text: The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.


text: Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We are committed to establishing a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: Impact of Cybersecurity Risks We assess, on an ongoing basis, the potential impact of risks from cybersecurity threats on us and our business. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Board Oversight of Cybersecurity Risks Our Board of Directors, through the Audit Committee, provides strategic oversight regarding risks from cybersecurity threats through oversight of our overarching cybersecurity posture and risk management practices. The Audit Committee receives periodic updates from our CIO on the current status of our cybersecurity program and risks from cybersecurity threats, and our Board of Directors is apprised of significant cybersecurity matters.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing risks from cybersecurity threats. Specifically, our CIO, supported by our Global Information Security Team, is responsible for the overall management of our information security program, which includes assessing, identifying and managing cybersecurity risks and material risks from cybersecurity threats. The Company's CIO was promoted to the position in January 2024 after serving as Senior Vice President – Enterprise Applications since July 2022. The CIO has more than 25 years of manufacturing experience, mostly in IT leadership roles in the semiconductor industry, and holds electrical and computer engineering degrees from the University of Missouri and an MBA from The Ohio State University.


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Each Global Information Security Team member has more than 15 years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.


text: Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We have established a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Global Information Security Team members have multiple years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.


text: Our Board recognizes the increasing significance that cybersecurity has on our operations and business and is responsible for overseeing our cybersecurity plan and risks to the Company from cybersecurity threat actors. From farm to table our operations rely on various information systems and technologies, including those provided by third party suppliers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v1.1, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:


text: Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner.


text: Identify, Protect and Detect: We have designed and implemented an industry standard security architecture, policies and procedures applying least privilege, and third-party monitoring of security controls of our core enterprise systems.


text: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("CISO"). We regularly test our incident response plan, conduct compliance audits, periodic tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.


text: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats to educate and empower our workforce to be vigilant against threat actors and actively participate in cybersecurity efforts.


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its finding with the company Audit Committee. The CISO and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.


text: Management Oversight Our COO, CISO, Chief Global Privacy Officer ("CPO"), our General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with the Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. When appropriate, cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, CISO, CPO, our Chief Operating Officer, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.


text: While we have not experienced any cybersecurity incidents that have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations, we did experience and incur costs related to a cybersecurity incident in 2023. Future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs or expose us to litigation. For additional discussion of the risks posed by cybersecurity threats, see Part I, Item 1A. Risk Factors – Risks Related to our Information Systems of this Annual Report on Form 10-K.


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v2.0, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident.


text: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("VP of IT"), who is also in charge of information security, and our Chief Global Privacy Officer ("CPO"). We regularly test our incident response plan, conduct compliance audits, annual tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.


text: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for technology supplier selection.


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. Our Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its findings with the company Audit Committee. The VP of IT and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.


text: Management Oversight Our Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), VP of IT, CPO, General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with our Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, VP of IT, CPO, CFO, COO, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.


text: As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company has engaged third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.

companyName: IES Holdings, Inc.

ticker: IESC


text: We have experienced cybersecurity attacks and incidents in the past and could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Our Board oversees the Company's general risk management processes, and with respect to cybersecurity risks the oversight is performed primarily through the Audit Committee of the Board, which is briefed at least quarterly on cybersecurity threats, the results of periodic assessment and reviews of the Company's cybersecurity programs, and cybersecurity developments affecting companies generally. Our incident response plan provides for prompt notice to the Board of any material cybersecurity incident.


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer and our Vice President of Information Technology. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our head of cybersecurity is also responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.


text: As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company periodically engages third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our Chief Technical Officer is responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data (collectively, Information Systems and Data).

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) cybersecurity framework. Our cybersecurity operations team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile. We use various methods and security tools designed to help prevent, identify, protect, detect, escalate, respond, and recover from identified vulnerabilities and security incidents in a timely manner.


text: Depending on the technology environment, we implement and maintain various technical, physical, and organizational measures, in the form of policies, standards, processes, and technical capabilities, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things, internal reporting, annual and ongoing cybersecurity awareness training for employees, mechanisms to detect and monitor unusual network activity, as well as threat detection, containment, incident response and backup recovery tools.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. As part of such process, we conduct tests of our cybersecurity program on a regular basis that are designed to identify cybersecurity risks associated with our technology environment. We use third-party security service providers and cybersecurity consultants to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats and review our cybersecurity program. Our internal audit team also conducts audits to evaluate the effectiveness of our cybersecurity program and improve our security measures and planning. The results of such reviews are reflected in the cybersecurity risk register and certain members of our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), which evaluates our overall enterprise risk, as well as to the full Board.


text: We use third-party service providers to perform a variety of functions throughout our business, such as research collaborators, contract research organizations, contract manufacturers, suppliers, and distributors. Depending on the nature of the services provided, certain providers are subject to cybersecurity risk assessments at the time of onboarding and upon contract renewal. We also use various inputs to assess the risk of our third-party service providers, including information supplied by them. Depending on the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve various levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee chair regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receives periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We recently established the Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer, Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite, risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 25 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We, and the third parties with whom we work, rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receive periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have an Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer (CFO), Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity, who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite and risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 20 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at public companies.


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates in conjunction with our overall risk management systems and processes, covering all company risks.

companyName: F5, INC.

ticker: FFIV


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team and is principally responsible for our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, monitoring, detecting and responding to cybersecurity events and incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our products and related supportive infrastructure, critical IT systems, information, and our broader enterprise IT environment; • monitoring, detection and collection and analysis of information regarding evolving, ongoing, and emerging threats and vulnerabilities, and corresponding actions to assess and remediate corresponding risks; • regular testing and assessments to identify vulnerabilities; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, including, where appropriate, escalation to the Risk Committee and the Board. We periodically perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities, and assess team preparedness.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches. We periodically review our cybersecurity insurance program.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application security and delivery products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation."


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats and is assisted in that oversight by its Risk Committee. The Risk Committee reviews and assesses the Company's cybersecurity risk exposure and evaluates the adequacy and effectiveness of related risk management processes and policies.