text: The Company's CISO reports directly to the CIO, who in turn reports to the CEO. The CISO has over 20 years of experience in IT and cybersecurity. Under the direction of the CISO, the Company's cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements preventive and detective controls, as appropriate, to mitigate these risks. The cybersecurity team consists of cybersecurity professionals holding multiple certifications such as CISSP (Certified Information Systems Security Professional), CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), among others. This analysis drives the Company's short- and long-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the board of directors regularly.


text: We are committed to protecting our information assets and systems from cybersecurity threats and ensuring compliance with applicable laws and regulations. Despite our commitment to protecting our systems, data and assets, we know that networks and systems are subject to the risk of an extended interruption, outage, or security incident due to many factors including, without limitation: (i) changes to our systems and networks for such things as scheduled maintenance and technology upgrades, or conversions to other technologies, service providers, or physical location of hardware; (ii) failures or lack of continuity of services from public cloud or third-party data center and other service providers; (iii) defects and/or critical security vulnerabilities in software programs; (iv) human and machine error; (v) acts of war and/or nature; (vi) intentional, unauthorized attacks from computer "hackers" or other cybersecurity attacks; and (vii) using the systems to perpetrate identity theft through unauthorized authentication to our customers' customers' accounts. In the following sections we describe how we identify, assess, and manage material risks related to cybersecurity, and how our Board of Directors (the "Board") oversees our cybersecurity program.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS

secItem: Item 1C


text: We believe we have implemented a cybersecurity program that is aligned with the ISO 27001 framework, SEC regulations, and industry best practices. It is our goal to identify and manage material risks related to cybersecurity and implement effective controls and measures to mitigate such risks. The Board endeavors to provide effective oversight and governance of our cybersecurity program and ensure that our cybersecurity program supports our strategic objectives and risk appetite.


text: Although we take reasonable and effective measures to ensure the protection of any data that is stored, processed, or transmitted through our systems, we know that attackers have the means, motives, and opportunities to attack. As of the date of this filing we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In addition, we maintain controls and procedures that are designed to ensure prompt escalation of critical cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. Please refer to "Item 1A. Risk Factors" for further information about the material risks associated with various cybersecurity threats.


text: Our cybersecurity risk management process is aligned with our enterprise risk program. We continuously identify, assess, treat, and monitor cybersecurity risks and report those risks on a periodic and as-needed basis to executive management and the Board. We use various sources of information, including internal and external audits, tabletop exercises, threat intelligence, vulnerability scans, penetration tests, customer and employee feedback, and industry benchmarks, to identify and mitigate our cybersecurity risks. We will also engage third-party services, from time-to-time, to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Additionally, we evaluate trends in the legal and regulatory environment and consider business drivers, emerging threats, and technology changes to identify risks across our people, processes, and technology. We then assess our current controls and capabilities to mitigate those risks and develop action plans to address any identified gaps or weaknesses. Action plans are prioritized and implemented with monitoring of completion and effectiveness against the identified risks. We also monitor our performance and progress against various key indicators and objectives based upon ever-changing risks and provide ongoing updates to relevant stakeholders, including executive management and the Board.


text: We leverage the ISO 27001 framework for cybersecurity risk management. Our cybersecurity risk management strategy is frequently reviewed and adapted to address and meet current and emerging threats. In addition, we have taken steps to address cybersecurity threats presented by third-party service providers, to include third-party systems that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. We have formal requirements that these third parties maintain certain security controls, we assess their compliance with these requirements on an ongoing basis, and we require timely notification of potential or confirmed security breaches. We also use third-party services that help us to monitor the security risks associated with our third-party service providers. Risk treatment plans are strategically prioritized and executed, and residual risks are reported through our enterprise risk program and elevated to executive management and the Board.


text: We foster a proactive cybersecurity culture across our organization through employee education, awareness, and engagement. This approach includes monthly e-mail phishing simulations, quarterly computer-based security awareness training on topics relevant to protecting our organization, role-based secure design and coding training, role-based security practitioner training, cybersecurity tabletop exercises, and adversary emulation exercises.


text: Our cross-functional Information Security Steering Committee ("ISSC") is the senior management team that oversees the direction, execution, and effectiveness of our cybersecurity program, policies and procedures including: cyber risks, mitigations, risk treatment plans, incident response plans, compliance with applicable regulations, and ensuring business-aligned cybersecurity objectives. The ISSC is chaired by our Chief Information Security Officer ("CISO") and consists of representatives from risk, compliance, internal audit, IT, accounting, finance, legal, and other key executives, including our Chief Information Officer ("CIO") and Chief Financial Officer. The ISSC meets quarterly to guide, direct, and monitor the performance and effectiveness of our cybersecurity program and elevates risks and mitigation plans, as appropriate, to the Board.


text: Overall Risk Approach The Board is responsible for oversight of our risks, including establishing our risk appetite and overseeing our risk management framework. The Board recognizes that effective risk oversight is important to the success of our strategy and is an integral part of exercising its fiduciary duties with respect to the Company and our stockholders. The Board believes our current leadership structure facilitates its oversight of risk by combining independent leadership through the Board with executive management members who have an intimate knowledge of our business, industry, and challenges.


text: Cybersecurity Risk Management and Oversight The Board is responsible for overseeing the Company's cybersecurity program and ensuring that it is aligned with our strategic goals and risk appetite. The Board has diverse expertise on topics including accounting and financial management, corporate governance, global business, technology and innovation, human capital management, ESG, and cybersecurity. The Board also reviews the strategic direction of the Company's cybersecurity program and ensures that adequate resources and budget are allocated to address cybersecurity threats.


text: The Board exercises its cyber risk oversight primarily through updates provided by executive management, our CIO, and our CISO. Our CIO and CISO have expertise in the areas of information security and cybersecurity, through decades of management, prominent cybersecurity training, and real-world experience. Intimate knowledge of best practices, incident response, technologies, and IT and business processes enable the management team to be effective in their approach.


text: The Board also has a standing committee (the "Cybersecurity Committee"), comprised of certain members of the Board, that advises it on cybersecurity matters and provides strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee convenes as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. Our CIO and CISO collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Additionally, the Cybersecurity Committee reviews the outcomes of our regular tabletop exercises with our CIO and CISO and ensures that lessons learned have been incorporated into the overall strategy.


text: We have implemented an information security program that is informed by, and incorporates elements of, industry standards and frameworks, including those issued by NIST (National Institute of Standards and Technology), ISO (International Organization for Standardization), and CIS (Center for Internet Security). Our security program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Our cybersecurity risk management program includes a number of components, such as information security program assessments and ongoing monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments and testing of our systems, including penetration testing and other vulnerability analyses. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and service providers. Our process includes a security assessment informed by vendor questionnaires and contractual security requirements related to data privacy for certain vendors.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks and attacks to the security of the systems of our third-party vendors and service providers. For more information on our cybersecurity related risks, see "Our internal computer systems, or those used by our third-party collaborators, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our development programs and business operations" in Item 1A- Risk Factors.


text: Our internal information security team is responsible for day-to-day operations related to our cybersecurity risk management strategy, including identifying, assessing, and managing cybersecurity threats and risks. We established a process that intends for our Incident Response Team to respond to and address incidents as they arise. The Incident Response Team is multidisciplinary and comprised of members of our information technology and security function, accounting and finance department, and legal department. This team is led by our Director of Security and Network Infrastructure. The Director of Security and Network Infrastructure role is currently held by an individual who has approximately twenty (20) years of information technology and ten (10) years of information security related experience.


text: The Incident Response Team provides periodic reports to our Data Privacy and Security Committee, as well as our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on the Company's cybersecurity risk management program, assessments of current cybersecurity risks, and status updates for projects designed to enhance our information security systems. Our Data Privacy and Security Committee meets to further discuss such items on a monthly basis and reports periodically to the Audit Committee of the Board of Directors.


text: Our Board of Directors, as a whole and through its committees, has oversight responsibility over the Company's strategy and risk management, including our response to critical risks related to cybersecurity threats. The Audit Committee of the Board of Directors specifically oversees the management of enterprise risks, including risks associated with privacy and data security (including cybersecurity), in accordance with its charter. The Audit Committee engages in periodic discussions, on at least a bi-annual basis, with a member of the Data Privacy and Security Committee as well as members of legal and executive leadership as appropriate regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from critical cybersecurity threats. Executive leadership periodically reports on critical cybersecurity risks and risk management to the full Board of Directors.


text: Our EVP and Chief Financial Officer is responsible for the oversight of the Company's information technology and cybersecurity function, which consists of five employees and is led by our VP, Information Systems & Solutions. Our VP, Information Systems & Solutions has over 25 years of experience in information technology leadership, including oversight of information technology general controls and management of information technology security and cybersecurity programs. The information technology and cybersecurity team also includes our Director, Information Technology, who has held information technology leadership roles for over 15 years, including in management of infrastructure, applications, information technology security, and cybersecurity prevention and education programs. The Audit Committee of the Board of Directors oversees the evaluation of the policies and practices developed and implemented by the Company with respect to the risk assessment and risk mitigation of information technology and cybersecurity matters.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: The Company has implemented a Computer Security Incident Response Plan (the "Incident Response Plan") that sets forth the process for identifying, responding to, and recovering from cybersecurity incidents. We have a dedicated cross-functional Incident Response Team (the "IRT") that participates in annual tabletop exercises and simulations with our external cybersecurity legal counsel to test the Incident Response Plan as part of our business continuity, incident response, risk assessment, and disaster recovery planning. The IRT is also responsible for evaluating the level of materiality of any cybersecurity incident in accordance with the Incident Response Plan and may engage the services of third-party experts to assist in the event of a cybersecurity incident.


text: To our knowledge, in the last three years we have not experienced a cybersecurity incident that has had, and we are not aware of any cybersecurity incident that is reasonably likely to have, a material impact on us, our business strategy, results of operations or financial condition. However, as (i) our business involves the storage and transmission of numerous classes of sensitive and confidential information and proprietary information, including tenants' information, private information about our investors and our employees, and financial and strategic information about us and (ii) we also rely on third-party service providers that have access to such information in connection with providing necessary information technology and security and other business services to us, we face risks associated with security breaches through cyber-attacks or cyber-intrusions, malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our IT networks and related systems that could have a material impact on us, our business strategy, results of operations or financial condition. See "Risks Related to Our Business and Properties – Security breaches and other technology disruptions could compromise our information systems and expose us to liability, which could materially and adversely affect us" for additional information.


text: In an effort to mitigate the impact of cybersecurity events, we conduct mandatory information technology and cybersecurity training for all employees upon hire and at least annually thereafter, and regularly test our employees for information security awareness and adherence to our information technology and cybersecurity policies, which are reviewed at least annually. We also provide our employees with access to educational newsletters and articles regarding relevant information technology and cybersecurity matters on a regular basis. Additionally, we utilize third-party experts to review and test our information technology infrastructure, including constant monitoring for suspicious activity, routine penetration testing of our networks, and an annual security assessment of the effectiveness of our informational technology environment to identify potential vulnerabilities. For example, our VP, Information Systems & Solutions and Director, Information Technology receive monthly reporting from our managed security service provider and meet regularly to discuss reported activity. Our VP, Information Systems & Solutions and Director, Information Technology also meet with the cybersecurity solutions team at our managed security service provider on a quarterly basis to review and discuss the Company's cybersecurity vulnerability score and key risk indicators, including security alerts, specific vulnerabilities, and remediation cadence, as well as peer comparisons and enhancements to the Company's cybersecurity program. Our third-party service providers of technology services are generally required to provide us with system and organization controls (SOC) reports prior to formal engagement and annually thereafter. The reports are reviewed by our VP, Internal Audit and our VP, Information Systems & Solutions, or their designee(s), to assess and monitor compliance with cybersecurity best practices.


text: In conjunction with the operational day-to-day processes discussed above, material risks from cybersecurity threats are identified and assessed in connection with the Company's enterprise risk management process. Our Enterprise Risk Management Committee ("ERMC"), which is overseen by our SVP and General Counsel and is comprised of our senior leadership team and key functional personnel, meets quarterly to discuss the Company's enterprise risks, including cybersecurity risks. Cybersecurity risks are reviewed in detail and assigned risk ratings on an annual basis. The ERMC also discusses mitigation efforts, potential enhancements to processes and policies, and key risk indicators for the Company's risks, including cybersecurity risks. The ERMC's annual risk assessment is presented to the Board of Directors and the Audit Committee on an annual basis. In addition to the Company's annual ERMC risk assessment, our VP, Information Systems & Solutions and Director, Information Technology brief the Audit Committee on information technology and cybersecurity matters at least annually and provide interim updates to the Audit Committee on such matters on a quarterly basis.


text: Our and our Manager's cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our and our Manager's enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard, which our Manager uses to assist with our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition, as of the fiscal year ended December 31, 2024. Our Risk Factors include further detail about our material cybersecurity risks.


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 25 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.


text: The Cybersecurity Program is integrated into our and our Manager's enterprise risk management framework that assesses, identifies and protects our and our Manager's enterprise information systems, data and business operations from various security threats and contains the following elements: • Information Security Risk Assessment – Conducting internal and external risk and control assessment, quality control and assurance testing. • Identity and Access Management – Managing enterprise identity and access control systems. • Security Architecture – Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support. • Security Engineering – Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses. • Security Operations – Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence. • Attack Surface Management – Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps. • Third-Party Assessments – Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. • Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.


text: Monitoring and Incident Reporting We and our Manager continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we and our Manager gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and our board of trustees.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our and our Manager's enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and our board of trustees to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Our and our Manager's Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of trustees' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our and our Manager's overall enterprise risk management framework. Additionally, our and our Manager's Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.


text: Board of Trustees Oversight The board of trustees oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of trustees and our board committees.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Amplitude, Inc.

ticker: AMPL


text: We design and assess our program based on industry-standard frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), SOC2, ISO 27000, and ISO 27018. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material ly affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities."


text: Our Board considers cybersecurity risk as part of its risk oversight function and established a dedicated Cybersecurity Committee of the Board in July 2024 to oversee cybersecurity risks, including management's implementation of our cybersecurity risk management program.


text: The Cybersecurity Committee meets at least twice annually with management to review our cybersecurity risks and cyber risk management program, and periodically reports to the Board on its activity. In addition, management updates the Cybersecurity Committee and Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Engineering Officer and acting Chief Information Security Officer, Wade Chambers, reports to our Chief Executive Officer, and is primarily responsible for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Chambers previously served as the Chief Technology Officer and SVP of Engineering at Included Health. He also led engineering at Twitter, TellApart, Proofpoint, Yahoo, Opsware, and Netscape. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Prevention, Identification, Detection and Mitigation Activities We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following: • Procedures and guidelines designed to ensure that information security is a key consideration in the requirements for both new information systems and enhancements to existing systems and assets; • IT environment risk assessments conducted at regular intervals and in connection with certain events, such as implementation of a new system, service or vendor; • Tabletop and simulation exercises to discuss roles and responsibilities of team members in the event of a cybersecurity incident and to test and modify the plan as needed; • Ongoing security penetration testing and threat modeling of our network and web application; • Automated tools and manual review processes to ensure ongoing compliance with technical standards and identify configuration issues and technical vulnerabilities; • Encryption of all communications with our servers, which are configured to utilize only high-grade encryption algorithms; and • Ongoing employee training related to information security and data privacy policies and standards, including periodic phishing, vishing, and social engineering exercises.


text: We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We maintain plans to address any cybersecurity incidents, including but not limited to a Crisis Management Plan, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team's ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee of the Board of Directors on a quarterly basis.


text: Certifications and Audits We maintain the following ISO certifications related to our information systems: • ISO 22301:2019 (standard for implementing and managing an effective business continuity management system); • ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments); • ISO/IEC 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and • ISO 9001:2015 (standard for the implementation of quality management processes).


text: We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, and processing integrity. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.


text: Impact of Risks from Cybersecurity Threats We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition.


text: Both management and the Board of Directors are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board of Directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board of Directors The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company's information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.


text: Role of Management The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 15 years. The Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.


text: The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT Security, Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.


text: In addition, we have established a working group composed of senior leaders from various departments, including operations, finance, IT, information security, internal audit, and legal. This working group's responsibilities include (i) ensuring that information security goals and objectives are identified, meet organizational and business requirements, and are integrated into relevant processes, (ii) reviewing the effectiveness of the information security program, (iii) providing clear direction and highly visible management support for security initiatives, (iv) providing resources required for information security projects and initiatives, (v) overseeing programs to maintain information security awareness, including training and team-specific guidance, and (vi) coordinating the information security aspects of supplier relationships.


text: To help address cybersecurity threats, Western Union has developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader enterprise risk management processes. We recognize that cybersecurity threats are constantly evolving and that there is no single solution that can guarantee complete protection.

companyName: Western Union CO

ticker: WU


text: Our cybersecurity strategy is designed to protect the confidentiality of our data from unauthorized access, the integrity of information throughout its lifecycle, and the availability of that information and the related systems. Our strategy is guided by the National Institute of Standards and Technology Cybersecurity Framework, which helps us identify, assess, and manage cybersecurity risks relevant to our business.


text: Within our cybersecurity program, we have identified and implemented a variety of processes for cybersecurity risk management: • We conduct regular risk assessments to identify and evaluate potential cybersecurity threats, including threats to our business operations, technology infrastructure, and data. • We monitor threat intelligence feeds to stay updated on the latest cybersecurity threats and vulnerabilities. • We scan our systems for vulnerabilities on an ongoing basis, with vulnerabilities prioritized and remediated based on their potential impact. • We have implemented a variety of access controls to restrict access to our systems and data, including user authentication, authorization, and encryption. • We conduct regular security awareness training for our employees to help them identify and avoid cybersecurity threats. • We periodically conduct test exercises to review our cybersecurity controls and resilience and to identify improvements. • Our third-party risk assessment program identifies, assesses, and monitors vendors for risk. These include information technology and cybersecurity vendors who are part of our digital supply chain.


text: Our cybersecurity governance framework is designed to manage cybersecurity risks at all levels of the organization. As part of this governance framework, our Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing the Company, including cybersecurity threats, and management's process for identifying, prioritizing, and responding to them. The Audit Committee of the Board of Directors assists the Board in overseeing the significant risk exposures facing the Company and regularly reviews cybersecurity risks at its committee meetings. Cybersecurity risks are integrated into the broader company risk management system through our Information Security and Privacy Committee ("ISPC"), which is a subcommittee of our Enterprise Risk Committee (the "ERC"), is co-chaired by the Chief Information Security Officer and Chief Privacy Officer and consists of senior leaders across the company. The ISPC is charged with oversight, advisory, and decision-making responsibilities with respect to information security and privacy risks. The Chief Information Security Officer is responsible for communicating cybersecurity risks to the Audit Committee and Board of Directors. Our cybersecurity program, led by our Chief Information Security Officer, who reports to our Chief Risk and Compliance Officer, has a team of dedicated, experienced cybersecurity professionals responsible for day-to-day security operations and strategic cybersecurity programs. The Chief Information Security Officer has over 20 years of experience in security risk management, with over 10 years of experience leading cybersecurity teams. All employees are responsible for protecting Western Union's data and systems and are required to follow Western Union's cybersecurity policies.


text: We have been, and continue to be, the subject of cybersecurity attacks and threats, including distributed denial of service and ransomware attacks. Historically, none of these attacks or breaches has individually or in the aggregate resulted in any material liability to us or any material damage to our reputation. Disruptions related to cybersecurity have not caused any material interruption to our business, strategy, results of operations, or financial condition. There can be no assurance that such attacks or disruptions will not have a material adverse impact on us in the future.


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and includes technical, administrative and physical controls, including encryption, firewalls, anti-virus systems and well-documented processes and policies. We continue to promote a company-wide culture of cybersecurity risk management. Cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Vice President of Information Systems, who has many years of experience in IT management, and reports directly to the Chief Executive Officer and works closely with our management team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our VP of Information Systems provides regular updates on cybersecurity to the Audit Committee of the board of directors. Our board of directors, as a whole and through the Audit Committee of the board of directors, exercises oversight with respect to cybersecurity and our risk management strategy, consistent with its approach to overseeing our enterprise risk management as a whole.


text: Engagement of Third Parties on Risk Management We engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Oversight of Third-Party Risk We have established processes to oversee and manage risks relating to third-party service providers. For example, our Security Operations Center, employs a Security Information and Event Management ("SIEM") and other systems to monitor risks while also conducting security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, and data processed by us or third-party vendors."


text: Recognizing the importance of assessing, identifying, and managing material risks from cybersecurity threats, we maintain a cybersecurity program that is led by our management team and overseen by the Audit Committee of our Board of Directors. Material risks from cybersecurity threats to our company may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: To identify and manage the risks from cybersecurity threats, our cybersecurity program includes various preventative, detection and responsive measures, including without limitation the following: use of monitoring and detection software applications, ongoing employee education and certification about cybersecurity threats, routine security access reviews, and the implementation of physical security measures. As standard practice, we require third-party service providers that may electronically interact with or handle our sensitive information to maintain an effective security management program and to notify us in the event of any known or suspected cyber incident.


text: Members of our management team, most notably our Chief Financial Officer, who has responsibility for managing our Information Technology and Security functions, are responsible for leading our cybersecurity program. Our management team meets regularly with our information technology leadership personnel, including our Vice President, Head of Global Information Technology, who reports to our Chief Financial Officer, to receive updates and data on cybersecurity management activities, including assessments on emerging technologies and evaluations of recommended practices related to cybersecurity measures. Our Vice President, Head of Global Information Technology, who has decades of information technology leadership experience, and our Chief Financial Officer maintain their expertise through participating in events such as continuing education and training, and information-sharing collaborations. We also retain a third-party Information Security consulting firm to advise on and assess our cybersecurity processes on an ongoing basis.


text: The Audit Committee of our Board of Directors has oversight responsibility for our cybersecurity program. Our Chief Financial Officer and Information Technology leadership provide periodic updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee, and provide other information as needed or requested to facilitate the committee's oversight of our cybersecurity risk. The chair of our Audit Committee, who previously founded and for 19 years led an information technology consulting company that specialized in providing software and systems integration, business process and technical consulting to multinational companies, holds a certification in Systemic Cyber Risk Governance for Corporate Directors. Other members of our full Board of Directors, which also receives periodic briefings on cybersecurity matters, also have received professional education and training related to cybersecurity.


text: Despite our efforts to manage the risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a further discussion of our cybersecurity risks.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: CarGurus, Inc.

ticker: CARG


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture according to the perceived level of risk and in accordance with industry standard best practices.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to our Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.


text: Our Vice President, Information Security and Technology, who reports to our Chief Technology Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Vice President, Information Security and Technology has extensive experience assessing and managing cybersecurity and risk programs having served in the current position for us since December 2020 and prior Senior Director level positions in security and privacy at several private and public Software as a Service, or SaaS, companies. Specialized knowledge also results from our Vice President, Information Security and Technology holding a Master of Information Security and Assurance from Norwich University.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time employees, with a data protection, cybersecurity, and incident response and prevention training program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: We believe cybersecurity is a necessity for operating our business. As a global leader in computational science and artificial intelligence, we face many cybersecurity threats that range from common attack patterns, such as ransomware and denial-of-service, to attacks from sophisticated and persistent adversaries, including nation state actors, that target companies with innovative technology. Our customers, vendors and other third-party partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we carefully execute our cybersecurity operations, strategy and governance.

companyName: Altair Engineering Inc.


text: The Board of Directors are informed of cybersecurity risks and provide oversight to the executive management team with the day-to-day responsibility of cybersecurity functions, auditing and budget. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to impair data confidentiality, integrity and/or availability. In the event of an incident, we intend to follow our customized incident response playbooks, which outline the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate. Our procedures vary slightly depending on the type of incident at issue (e.g., account compromise, malware, data loss) as well as the data compromised.


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has more than ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. During 2024 Altair chose to grow its security team further, recognizing the ever-increasing threats; a Director for IT Security was brought on board and a number of global staff were added to the Security Operations team. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. During 2024 and into 2025 we have increased the Security team involvement with business leaders. Our Security team works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have further developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.


text: We employ a data privacy counsel to specifically improve our responses to growing international privacy laws. We believe that this enhances our data control and thus may reduce risk.


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some vital areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. Additionally, we leverage a Security Operations Center ("SOC")-as-a-Service provider to ensure continuous monitoring and rapid response to potential threats, enhancing our ability to maintain a robust security posture at all times.


text: We employ risk management functionality and document enterprise information security risks. Our information security team maintains documentation to assess risk and mitigate cyber risk in alignment with risk (understanding general impact and likelihood of risk exploitation), resources, and business process. Cybersecurity risks are tracked throughout the risk management process from risk mitigation to ultimate completion of remediation. From time-to-time significant risks may be escalated to the executive management team and/or the Board in the existing executive management processes for cybersecurity and Board briefing schedule.


text: We rely on our indirect sales channel partners and supply chain to deliver our products and services to our customers, and a cybersecurity incident at a channel partner, supplier, subcontractor or joint venture partner could materially adversely impact us. We also contractually flow cybersecurity regulatory requirements to our subcontractors in alignment with legal and contractual obligations. Extensive international law and US-sector specific laws pertaining to privacy and data security may create challenges for our supply chain and increase costs as we continue to flow down legal obligations.


text: Despite our careful planning, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risks, and to timely detect the occurrence, and mitigate the effects of cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of Directors on the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that is led by our CIO. The team in turn may leverage the expertise of third-party consultants, external legal counsel, and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident, and the breadth of the incident. The plan also establishes procedures for escalating incidents depending on severity and for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors, and insurance providers. Our CIO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process. In addition to internal resources, we utilize third-party service providers to supplement and maintain our cybersecurity and our information technology systems.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition.


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyberattacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Risk Management and Strategies We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes. We seek to align our cybersecurity program with practices recommended under ISO 27001 and by the National Institute of Standards and Technology and the Center for Internet Security Critical Security Controls.


text: When reviewing key third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third-party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.


text: We periodically undertake cybersecurity audits or other independent assessments, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach. We have also engaged a third-party vendor to, among other things, provide continuous monitoring and respond to cybersecurity events.


text: We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness.


text: Additionally, we have engaged third-party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition.


text: For further discussion of the risks related to cybersecurity, see also Item 1A. "Risk Factors – Risks Related to our Business - Failures or security breaches of our information technology systems could disrupt our operations and negatively impact our business".


text: Our board of directors oversees our risk management processes and has tasked our Audit Committee with oversight of our cybersecurity and information governance, including periodically reviewing and discussing with management our risk exposures relating to data privacy and cybersecurity, and reviewing the steps we have taken to identify, assess, monitor, mitigate and manage such exposure and cybersecurity risks. At the management level, our Director of Cybersecurity is responsible for overseeing our cybersecurity processes and risk management, working together with our Chief Information Officer to implement our cybersecurity initiatives.


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyberattacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.


text: Our Director of Cybersecurity is informed of cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our policies and processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Chief Information Officer has over 30 years of technology leadership experience and is, among other things, a Certified Information Systems Security Professional and a Certified Secure Infrastructure Specialist. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional. He has held various leadership positions where he developed, managed and implemented security programs and controls. He also holds, among other information technology certifications, the Certified Information Systems Security Professional designation.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall Enterprise Risk Management (ERM) process. As part of the ERM, the Company focuses on developing multi-layered, collaborative processes to identify, monitor, and manage risks from cybersecurity threats. Risks are grouped into categories that management can then assess, monitor, and prioritize based on the likelihood of an occurrence, level of impact, and mitigating factors.

companyName: Alcoa Corp

ticker: AA


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic and email. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.


text: The Company engages third-party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms and our awareness campaigns, including ongoing network monitoring. The Company also has a comprehensive third-party information security audit program in place.


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third-party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third-party service providers are subject to audits in which contract owners within Information Technology Automation Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.


text: We have in the past experienced attempts and incidents by external parties to penetrate our, our service providers', and our business partners' networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. See Part I Item 1A of this Form 10-K for more information on risks.


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program, and specifically, reviews and oversees the Company's risk management and strategy relating to cybersecurity, including cybersecurity developments and threats and the Company's process for assessing, managing, and mitigating material cybersecurity risks and threats. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.


text: Alcoa's CISO has thirty years of experience in information technology, including over fifteen years in cybersecurity, and prior to joining Alcoa, was the CISO of the U.S. business of a large global insurance and asset company and was responsible for the security of data, systems, and processes supporting customer assets. Alcoa's CISO maintains professional certifications in information security, participates in intelligence sharing organizations, and has extensive cybersecurity risk management experience in manufacturing organizations and reports to the CIO. Alcoa's CIO has almost thirty years of information technology experience, including a diverse knowledge in manufacturing and process control solutions, corporate applications, infrastructure, and service delivery operations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee (ISSC), which oversees current and emerging cybersecurity risks and investments in the cybersecurity risk protections for the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO (the ISSC Chair) and CIO.


text: The Company has established comprehensive incident response plans that set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified, and elevated to an executive team which includes the CISO and executives on the Crisis Response Team. Once elevated, these executives are ultimately responsible for the management, mitigation, and remediation of incidents.


text: We have instituted policies and processes dedicated to assessing, identifying, and managing risks from cybersecurity threats. Cybersecurity risks are managed as part of our enterprise risk management program. We are committed to safeguarding our critical information assets and data and have implemented a defense-in-depth strategy that is informed by industry standard cybersecurity frameworks. We benchmark against these frameworks and our internal risk assessment process to inform how we identify, protect, detect, respond to, and recover from risks, threats, vulnerabilities, and cybersecurity incidents across our information assets.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We have processes to oversee and identify material risks from cybersecurity threats associated with or use of third-party vendors. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.


text: We actively enhance our cybersecurity program through testing by third-party assessors and measure the results against industry standards. We also have standing engagements with incident response experts and external counsel to provide timely support to our incident response capabilities, and we regularly engage with external experts to analyze the threat landscape.


text: Our cybersecurity risk management is integrated into our business continuity program and enterprise risk management framework, which promotes proactive planning and preparedness to address potential threats. Members of our global information security team collaborate with subject matter experts within our organization to assess and refine our cybersecurity posture and incident response and preparedness, including evaluating and updating contingency plans, participating in tabletop exercises, threat hunting, red team engagements, and simulating real-world scenarios related to cyber incidents.


text: Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect our Company, business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see the section entitled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and administers its cybersecurity risk oversight function through the Audit Committee. The Audit Committee receives quarterly updates on our enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks.


text: Our chief information security officer is the senior director responsible for the cybersecurity organization, which has primary oversight of material risks from cybersecurity threats. Our chief information security officer reports to our chief information officer. Our chief information officer is responsible for the overall Information Technology (IT) organization.


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools, as well as third-party assessments, audits, penetration tests, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, as appropriate.


text: Our chief information officer meets with the Audit Committee each quarter to review our information technology systems and discuss key cybersecurity risks. In addition, at least annually, the chief financial officer reviews with the board of directors our global enterprise risk management program, which includes cybersecurity risks.


text: The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), who is responsible for the Company's overall cybersecurity strategy, policy, architecture and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor's degree in Information Systems and Master of Business Administration degree and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The Company's program is aligned to industry frameworks and controls from the National Institute of Standards and Technology that allow the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response and recovery. Depending on the type of system or data, additional controls may be assessed.


text: The Company maintains an Incident Response Plan that includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party service providers to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.


text: Assessing, identifying and managing cybersecurity-related risks is integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: The Board of Directors is responsible for general oversight of the Company's risk management program, including cybersecurity risks. The Board of Directors receives an annual report from senior management through the ORM program and material risk assessments and mitigation strategies, including with respect to cybersecurity risks.


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning, incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.


text: The Company's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but the Company cannot provide assurance that it will not be materially affected in the future by cybersecurity risks, threats or incidents. See Item 1A under the caption "Increased cybersecurity threats and more sophisticated computer crime pose a risk to our systems, networks, operations, products and services." for additional information on cybersecurity risks applicable to the Company.


text: We employ information systems to support our business. As is the case for other manufacturing companies of comparable size and scope, we, from time to time, experience attempted cyber-attacks on our information system. We also face risks associated with other potential significant failures or disruptions of our information technology networks. We utilize a risk-based, multi-layered information security approach that incorporates some of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have adopted and implemented this approach to identify and mitigate information security risks in a manner that we believe is commercially reasonable for manufacturing companies of our size and scope.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"), who reports to our Executive Vice President and Chief Financial Officer. Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, employee reports, law enforcement reports, or other third-party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a cybersecurity operations team with round-the-clock monitoring, and the CIO and Director of Cybersecurity receive regular reports on industry activity. Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CIO along with the Director of Cybersecurity will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, Chief Administrative Officer and General Counsel and Executive Vice President - Manufacturing. The Company may engage third-party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, our Executive Vice President, Chief Administrative Officer and General Counsel, in consultation with the CIO and Director of Cybersecurity, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U.S. securities laws. Following a cybersecurity incident, the Executive Vice President and Chief Financial Officer will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents involving us or third-parties, that have materially affected or are reasonably likely to materially affect the Company in 2024, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds bachelor's and master's degrees in business administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO has over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with third-party security partners surrounding monitoring and incident response services.