text: • Education and Awareness: The Company's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and receive communications on the Company's evolving information security policies and procedures.


text: The Company's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of the Company's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. The Company regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.

companyName: BlackRock Finance, Inc.

secItem: Item 1C


text: As of December 31, 2023, BlackRock is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect BlackRock's business strategy, results of operations, or financial condition. For additional information on whether and how risks from cybersecurity threats are reasonably likely to materially affect BlackRock, see "A cyber-attack or a failure to implement effective information and cybersecurity policies, procedures and capabilities could disrupt operations and lead to financial losses and reputational harm, which may cause BlackRock's AUM, revenue and earnings to decline." under Part I, Item 1A, Risk Factors herein.


text: Cybersecurity Governance BlackRock's Board of Directors is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of the Company's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on the Company's cybersecurity program, technology resilience risk management and related developments from members of the Company's information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at the Company and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions. He also holds the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Risk Management and Strategy Martin Marietta prioritizes the management of cybersecurity risk and the protection of information across the enterprise by embedding data protection and cybersecurity risk management in its operations. The Company's processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into the Company's overall risk management system and processes.

companyName: MARTIN MARIETTA MATERIALS INC

ticker: MLM


text: As a foundation of this approach, the Company has implemented a layered governance structure to help assess, identify and manage cybersecurity risks. Martin Marietta's cybersecurity policies encompass incident response procedures and information security. In order to help develop these policies and procedures, the Company monitors the privacy and cybersecurity laws, regulations and guidance applicable to, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks. The Company partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise, to monitor and test the performance and effectiveness of its cybersecurity controls and defenses. As described in Item 1A "Risk Factors" of this Form 10-K, the Company faces risks from cybersecurity threats that could have material adverse effect on its business including its business strategy, results of operations or financial condition. While the Company has experienced attacks on the security of its information technology systems to date, management is not aware that the Company has experienced a material cybersecurity incident during the 2023 fiscal year.


text: As part of its overall risk management approach, the Company prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, day-to-day executive risk management and employee training. The Audit Committee, comprised of independent directors from the Board, oversees the Board's responsibilities relating to the operational (including information technology risks, business continuity and data security) risk affairs of the Company. The Audit Committee is informed of such risks through quarterly reports from the Senior Vice President, Chief Information Officer (CIO), who oversees the implementation and compliance of information security standards and mitigation of cybersecurity related risks, assesses and manages the cyber risk management program, informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of the cybersecurity incident management team and supervises such efforts. The Company's cybersecurity incident management team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes as well as managing enterprise risk. The Incident Response Leadership Committee, which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents. The CIO communicates to the Audit Committee regarding the activities of the Incident Response Leadership Committee.


text: The Company also holds annual employee trainings on cybersecurity, conducts phishing tests and generally seeks to promote awareness of cybersecurity risk through communication and education of its employees.


text: The Company's cybersecurity risk management strategy is comprised of several key elements. We assess our information technology and data management/storage systems and related policies and practices and to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. We leverage a variety of technologies to attempt to mitigate the risk of cybersecurity threats and incidents. The Company has a multi-layer approach to its technology solutions, including employing applications used for perimeter, network, end point and application security as well as for data recovery, in each case tailored to the Company's systems, data, risk profile and mitigation strategy. From time to time we use third-party service providers and software to augment and test our technology solutions and further support our risk mitigation strategy.

companyName: CTS CORP

ticker: CTS


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate our systems) and test that awareness using knowledge assessments and simulations. The training is administered to employees on a rolling basis, and we use a third-party provider for the content periodically update the training to incorporate new cybersecurity-related developments.


text: The oversight of our cybersecurity risk is integrated into our enterprise-wide risk management process. We annually review cybersecurity risk as part of our enterprise risk management process and evaluate whether to integrate those findings into our overall cybersecurity strategy. We have a Cybersecurity Strategy Committee, which is a cross-functional team of business representatives led by our Vice President of IT & Digitization, which is responsible for spearheading the ongoing development and execution of our cybersecurity strategy. The Cybersecurity Strategy Committee meets regularly and at other times as needed, and periodically updates the Company's management on its progress and activities.


text: Like many other companies, from time to time, we detect attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there can be no assurance that our efforts to prevent or mitigate cybersecurity incidents will be successful. Please see "Risks Related to Technology and Data Privacy" in "Risk Factors" in Section 1A of this Annual Report on Form 10-K.


text: Our cybersecurity program is overseen by a Vice President of IT & Digitization and information technology team (collectively, the "IT Team") responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The IT team includes members with experience developing and implementing enterprise-wide cybersecurity strategies and initiatives, managing risks relating thereto, and evaluating industry standards and regulations.


text: While our Board has the ultimate oversight responsibility for the risk management process, the Audit Committee is responsible for oversight of our cybersecurity strategy and risks. The Audit Committee is provided with quarterly and as needed updates on the Company's cybersecurity strategy and risks. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.


text: In the event of a reported potential cybersecurity incident, our IT Team decides whether such incident triggers our Cybersecurity Threat Evaluation and Response Plan (the "Response Plan"). If triggered, the Company's cybersecurity response team, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team, as appropriate and as set forth in the Response Plan, are responsible for developing, recommending and implementing measures to address the cybersecurity incident, including when appropriate, assessing, containing and mitigating its impact, notifying members of the Company's management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The IT Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.


text: Cyber criminals and malicious nation-state governments sponsored cyberthreat activity is becoming more sophisticated and effective every day, which we recognize includes increased targeting of the manufacturing sector and companies. All companies that utilize technology are subject to cyberthreat of breaches of their cybersecurity programs. To mitigate the threats to our Company, we take a comprehensive approach to cybersecurity risk management and technology infrastructure protections as a top priority.

companyName: PGT Innovations, Inc.


text: Our board of directors (the "Board") in conjunction with the Audit Committee and members of management are actively involved in the oversight of our risk management program, of which cybersecurity represents a vital component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats, including but not limited to, our ability to sufficiently defend against all types of sophisticated tactics, techniques, and procedures ("TTPs") used by malicious nation-state governments sponsored cyberthreat activity We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.


text: Having been a target of cyber criminals in November 2022, we are keenly aware of the risks and consequences that a cybersecurity incident unleashes on the technology function within a company. While this previous cyber-attack did not materially affect us and, in our belief, is not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors" for additional details regarding cybersecurity risks.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the U.S. Center for Internet Security ("CIS") and other applicable industry standards. Our defense-in-depth cybersecurity program is designed to focus on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability ("CIA") of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain cybersecurity incident controls and procedures that are designed to ensure prompt escalation of incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: Annually, we conduct a cybersecurity risk assessment with quarterly updates to the Audit Committee of the Board that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., cybersecurity alerts and advisories from the U.S. Cybersecurity & Infrastructure Security Agency, relevant technology vendors, related companies, industry trends, and evaluations by third parties and consultants). The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: Technical Safeguards We regularly assess and deploy technical cyber-safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, third-party cybersecurity threat assessments and incident response experience.


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate them for effectiveness of those plans. Our incident response and business recovery plans address — and guide our employees, management, Audit Committee, and the Board on — our response to a cybersecurity incident.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use various inputs in such random risk assessments, including information supplied by providers and third parties.


text: In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our cyber and data security efforts. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness on how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by external consultants and auditors. These assessments include various activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022 and 2023, we conducted an independent cyber security maturity assessment and external penetration test to assess our controls against the NIST Cybersecurity Framework. The results of significant assessments are reported to management, the Audit Committee and Board. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also completed cybersecurity attestations that demonstrate our dedication to protecting the data entrusted to us.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive at least quarterly reports, or more frequently if deemed necessary, from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our Senior Vice President ("SVP") of Production Innovations & Technology, Vice President ("VP") of Information Technology, Director of Information Security & Infrastructure, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of management's Security Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our SVP has served in various roles in both engineering, operations, and information technology for over 20 years. He holds an undergraduate degree in mechanical engineering and a master's in business administration. Our VP of Information Technology has served in various roles in information technology and information security for 20 years. He holds an undergraduate degree in both industrial technology and distribution. Our Director of Information Security & Infrastructure has served in similar roles within information technology for over 25 years including risks arising from cybersecurity threats at several large publicly traded companies. He holds an undergraduate degree in criminal justice. Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity incidents and threats, at several large publicly traded companies.


text: The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others, could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC


text: Additionally, the Audit Committee, which consists solely of independent directors, is responsible for overseeing cybersecurity risks and related initiatives. The Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. The Company's management team reviews the findings, if any, of these assessments, assesses the identified risks, and takes action based on the Company's risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the Company's internal audit services team evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the Company's networks, the Company's information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. The Company contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, the Company has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates to reduce the Company's risk.


text: The Company has also implemented various safeguards to protect the availability of its data and the integrity of its network, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company conducts bi-annual cybersecurity awareness training for all employees, new-hire cybersecurity training, periodic simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Under the leadership of the Company's Senior Vice President of Information Technology, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems. Certain members of the Company's information technology department, including the Senior Vice President of Information Technology, have obtained specialized security certifications and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Senior Vice President of Information Technology and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors through the committee's charter. At least once each year, senior members of the Company's information technology team (including the Senior Vice President of Information Technology) and internal audit services team brief the Audit Committee on information security matters, including results from risk assessments, the Company's policies and its internal control function.


text: The Company has experienced issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events that could have harmed the Company's information systems. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."


text: We have established a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data and products in a manner consistent with industry best practices and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We are currently ISO 27001 certified for our surgery planning ecosystem and plan to continue to maintain this industry certification. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management framework. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. We maintain separation of duties between our cybersecurity organization and other IT functional areas as well as established roles that define the responsibility of the cybersecurity team within our organization.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Under our program, cybersecurity issues are analyzed by subject matter experts, including those in information security, information technology, risk, and other areas to evaluate potential security, financial, operational, reputational and other risks, as well as to identify any potential data breaches or other cybersecurity incidents. Matters involving potential data breaches and other cybersecurity incidents are considered against applicable escalation and notification requirements. We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats.


text: We engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide annual independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, vulnerability remediation consulting, security remediation services, patching, and external audit services.


text: Like other large multi-national corporations, we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents. To date, there have not been any previous cybersecurity incidents that materially affected us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors - We are dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems or data, including from data breaches and cybersecurity events, our business could be adversely affected.


text: The Audit Committee of the Board of Directors oversees our cybersecurity program. It considers cybersecurity risk individually and within our overall risk management framework. We obtain periodic assessments of our cybersecurity program from independent third party experts, the results of which assessments are reported to the Audit Committee. Additionally, cybersecurity threats and incidents determined through our cybersecurity program to present potential material impacts to our financial results, operations, and/or reputation are required to be immediately reported to the Audit Committee in accordance with our escalation framework.


text: Our Chief Information Security Officer ("CISO") leads our cybersecurity program through our global information security operations team. Our CISO has over 20 years of experience in information technology security obtained in civilian and military roles, and regularly reports on cybersecurity matters to our Audit Committee. As of December 31, 2023, our Cybersecurity, Risk and Compliance team consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.


text: We have established processes providing for timely review of cybersecurity incidents by a cross-functional subcommittee of our Disclosure Committee to evaluate such incidents for potential disclosure, and to ensure that the members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. This subcommittee consists of leading representatives from our information security, accounting, legal and internal audit functions and may be supplemented by other subject matter experts depending on the nature of cybersecurity incidents under review. The subcommittee meets on a periodic and ad hoc basis to receive reports about cybersecurity incidents and our cybersecurity program. The subcommittee escalates certain cybersecurity incidents to the Disclosure Committee within our escalation framework. Additionally, our escalation framework requires that any cybersecurity incidents determined to be material be immediately reported to the Audit Committee.


text: Our cybersecurity risk management is integrated in our overall risk management program and is based on recognized cybersecurity industry frameworks and standards, including those from the National Institute of Standards and Technology, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies and defined procedures for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, malware defenses and zero trust principles. We work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we regularly train our employees on cybersecurity awareness and, confidential information protection. We routinely test our employees using simulated phishing attacks. Risks from cybersecurity threats have not materially affected our company, business strategy, results of operations or financial condition; however, we remain subject to cybersecurity risks in the future. See Item 1A. Risk Factors – "Our systems, networks and business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, including information technology system failures, and security breaches."

companyName: Adeia Inc.

ticker: ADEA


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. Our information technology team led by our Vice President of Information Technology (VP of IT) frequently collaborates with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices, and industry trends.


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We routinely conduct risk and compliance assessments of third-party service providers that request access to our information assets. We re-asses our third-party vendors in an ongoing basis.


text: Our cybersecurity risk management is integrated into our comprehensive business continuity program and enterprise risk management. Our information technology team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness.


text: Governance of Cybersecurity Risk Management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The board of directors has delegated to the audit committee the responsibility of reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, regularly reports on its review with the board of directors.


text: Management is responsible for day-to-day implementation of risk management strategies and recommends process improvements. Our VP of IT has primary oversight of material risks from cybersecurity threats. Our VP of IT has more than 25 years of experience across various engineering, business and management roles focused on information technology, including roles at global, public companies, as well as across multiple industries including fintech, research, and high tech. Our VP of IT regularly presents updates to the audit committee regarding Company cybersecurity matters and developing industry trends.


text: We have retained an outside cybersecurity firm for our managed security services, which reports to our VP of IT. The cybersecurity firm has professionals with more than 20 years of experience working in information technology-related roles and degrees in Information Technology, including cybersecurity, Certified in Risk and Information Systems Control (CRISC), and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA). The cybersecurity firm has extensive experience is supporting firms in applied knowledge of information technology governance and security frameworks that include: ISO 27000, NIST, HITRUST, ISC2, ITIL, and COBIT.


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and regular evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to management and the audit committee, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our VP of IT meets with the audit committee quarterly to review our information technology systems and discuss key cybersecurity risks. In addition, our chief financial officer reviews with the audit committee, at least annually, our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board of directors.


text: Saia maintains cybersecurity processes, technologies and controls to help us assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of Saia's overall enterprise risk management process. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats.

companyName: SAIA INC

ticker: SAIA


text: We regularly perform evaluations of our information security program and our information technology infrastructure, including through the use of tools and services for network and endpoint monitoring, vulnerability assessments and penetration testing, among other things. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have an incident response program to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Saia contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We consider cybersecurity matters when selecting and overseeing our third party service providers and we administer a standardized information gathering questionnaire to evaluate cybersecurity risk in third parties. We seek to require third parties who could pose significant cybersecurity risk to us to be contractually responsible for the risk and to agree to cybersecurity assessments in connection with new vendor engagements and annually thereafter.


text: Saia has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation. The annual cybersecurity training consists of threat avoidance when working remote, proper password construction techniques, identifying and reporting suspicious activity, social engineering and insider threats. Additionally, we have implemented a regular phishing assessment that provides feedback and additional training as needed to enhance the annual training program. Our information technology professionals also receive additional training related to their position.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Saia's Director of Information Security and Compliance, who reports to the Executive Vice President and Chief Information Officer, has primary oversight of our cybersecurity risk management and strategy processes. The Director of Information Security and Compliance has served in information security roles since 2001 and led the information security function for a large health care system prior to joining Saia. He has a Bachelor of Science degree in Information Technology with a Concentration in Information Assurance and Security.


text: The Director of Information Security and Compliance assesses our cybersecurity readiness through internal assessment tools as well as third-party control testing, vulnerability assessments and evaluation against industry standards. We maintain compliance structures that are designed to elevate issues relating to cybersecurity to our Director of Information Security and Compliance and to our Executive Vice President and Chief Information Officer.


text: The Board of Directors has oversight responsibility for Saia's strategic and operational risks. Although the Board has delegated oversight responsibility for certain risks to its committees, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board regularly receives reports from the Executive Vice President and Chief Information Officer concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, internal assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO") or a member of the IT Risk Management function.


text: Our CTO is the primary senior management team member responsible for assessing, monitoring and managing material risks from cybersecurity threats, and works closely with out IT Risk Management team members. The CTO and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.


text: We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. Cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2013 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and conducts security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.


text: Cybersecurity threats, including previous incidents, have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts.


text: Our Board of Directors provides oversight of risks from cybersecurity threats. The Security and Privacy Management Committee (the "SPMC") consists of our Chief Financial Officer, General Counsel, Vice President of Information Technology, Chief Human Resources Officer, Director of Information Security and Director of Environmental Health and Safety. The SPMC is tasked with ensuring risks are adequately addressed within our governance framework.


text: We maintain a dedicated team of cybersecurity professionals. The Director of Information Security, the Information Security team, the SPMC, the Vice President of Information Technology, and the Information Technology leadership team are principally responsible for assessing and managing cybersecurity risks for our company. These individuals possess relevant expertise in cybersecurity risk management and are equipped to address the evolving nature of cyber threats. Our Director of Information Security has over 20 years of cybersecurity experience, holds several professional certifications and is an adjunct faculty member teaching courses on information security management and governance. Our cybersecurity professionals have a proven track record of executing strategic security objectives across various sectors, including utility, government, healthcare, and consulting. They bring with them experience in designing, implementing, and managing information security programs focused on quality, performance, and compliance.


text: Our information security team and our third-party security service providers actively monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, ensuring timely response and resolution. Processes are in place to inform relevant management positions and committees about emerging threats and incident response activities. The Director of Information Security provides regular updates on cybersecurity risks and incidents to the Board of Directors, the SPMC, and IT leadership.


text: We and our customers and suppliers have an increasing reliance on our technology systems and infrastructure. We aim to safeguard the digital infrastructure of Expeditors, enabling the highest levels of customer service while managing and minimizing risk and maintaining global compliance. The cybersecurity and risk management program within Expeditors is defined through strategy, execution, management, and oversight, with continual assessments to verify the program's overall effectiveness.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Identifying and assessing cybersecurity risks and threats is integrated into our overall enterprise risk management program. Our Enterprise Cybersecurity Committee defines the strategy, prioritizes, and sets the expectations for execution of the cybersecurity program, leveraging an industry-standard cybersecurity framework, the National Institute of Standards and Technology cybersecurity framework (NIST CSF). (i) strategic development and continuous iteration of a risk strategy in line with our information services and business goals; (ii) engineering and architecture of cybersecurity preventative and response solutions and capabilities;


text: (iii) governance, risk, and compliance defining policies, standards, and systems of control and measurement in line with industry best practices and regulatory requirements;


text: (iv) cybersecurity operations designed to prepare, identify, contain, eradicate, and recover from cyber-related incidents; and (v) identity and access management defining global practices for access, authentication, and authorization to technology systems.


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.


text: In February 2022, we determined that our Company was the subject of a targeted cyber-attack which resulted in having to shut down most of our connectivity, operating and accounting systems globally to manage the safety of our entire global systems environment, and we initiated our cybersecurity incident response plan. We had limited ability to conduct operations for a period of approximately three weeks, including but not limited to arranging for shipments of freight or managing customs and distribution activities for our customers' shipments. While we continue to incorporate learnings from the cyber-attack, we do not expect to have a further material adverse impact on the Company's business from this cyber-attack. Since the cyber-attack, we have accelerated investments in our CSRM program, strengthened the security of our systems and networks and enhanced continued monitoring of the known information security environment. We also added a Chief Information Security Officer (CISO) to our IS leadership.


text: Our Board of Directors provides direct oversight of and evaluates our CSRM at least annually. The Board's oversight is led by James Dubois, former CISO and Chief Information Officer (CIO) with the Microsoft Corporation, who communicates with cybersecurity leadership throughout the year. The Board is provided updates via our Enterprise Risk Management program quarterly, while meeting with the CISO at least annually.


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience.


text: The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.


text: We have established and implemented security measures, controls and procedures in an effort to safeguard our information technology systems and to prevent unauthorized access to these systems and any data processed and/or stored in these systems. We evaluate the adequacy of our third-party service providers' cybersecurity measures through periodic due diligence and contractual obligations.

companyName: AMERISAFE INC

ticker: AMSF


text: We analyze the probability and impact of cybersecurity risks using recognized cybersecurity standards and frameworks for our industry and have identified certain material risks from cybersecurity threats. As part of this analysis, we also work to determine whether these material risks would be a threat to our business continuity. To help minimize our risks related to cybersecurity threats and incidents, we maintain physical controls, including a centralized electronic card access control system, uninterruptable power supply units, and environmental controls; and technical controls, including firewalls, signature and behavior-based monitoring, intrusion detection systems, encryption and backups, and mobile application management. We engage third parties in connection with our processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: No known risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, our business strategy, results of our operations, or our financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For more information about these risks, please see "Risk Factors – General Risk Factors" in this annual report on Form 10-K.


text: As part of our overall risk management system, we assess, identify and provide oversight over cybersecurity risks to our information technology systems and our business continuity. We have identified key risk drivers and characteristics, and have incorporated these into our risk assessment matrix, which we use for day-to-day risk mitigation. Our risk assessment matrix provides us with a means to assess the probability and impact of material risks from cybersecurity threats. As a result of this process, we have identified and implemented controls and mitigation methods to manage these risks.


text: The Risk Committee of our Board of Directors meets with management to review and provide oversight of certain operational areas where we have identified key risks to our business, including our cybersecurity practices. The Risk Committee reviews our strategies, governing and management framework, security principles, and training and evaluations for cybersecurity threats. As part of this review, each quarter the Chief Risk Officer presents key cybersecurity metrics and analysis to the Risk Committee.


text: The Chief Risk Officer manages a team that assesses day-to-day cybersecurity. We actively maintain an Incident Response Plan, and in the event of a cybersecurity breach or incident, the Chief Risk Officer leads our response and initial risk assessment to mitigate impact and initiate any recovery process. Following identification of a cybersecurity breach or incident, incidents of medium or high severity level are elevated to an Incident Response Team. In addition to leading the response to such incidents, the Incident Response Team evaluates whether an incident is material and the associated public reporting implications. Incidents that are reviewed by the Incident Response Team are promptly elevated to the Risk Committee.


text: The Chief Risk Officer stays informed through multiple sources: technology and cybersecurity news, bulletins from the federal Cybersecurity and Infrastructure Security Agency, Information Sharing and Analysis Center feeds, and threat intelligence feeds from multiple sources. We also utilize a security operations center that acts as a centralized hub dedicated to monitoring, detecting, and responding to cybersecurity threats.


text: The Chief Risk Officer holds the Certified Risk Manager designation, and has more than 30 years of technology experience, including 15 years overseeing cybersecurity processes, risk assessment and risk management.


text: The Company's risk management program includes procedures, systems, and processes for assessing, identifying, and managing material risks from cybersecurity threats. Overall, we address cybersecurity risks through Board of Directors (the "Board") and management oversight and a system of controls and procedures designed to protect the confidentiality, integrity, and availability of the Company's information assets. The Company employs a comprehensive system of monitoring, detection, internal reporting, and prompt escalation of certain cybersecurity incidents, plans for incident response and recovery, technical safeguards, third-party risk management, and mandatory training and awareness campaigns.

companyName: MANITOWOC CO INC

ticker: MTW


text: Governance and Management Oversight The Board, in conjunction with the Audit Committee of the Board ("Audit Committee"), oversees the Company's Enterprise Risk Management process, which includes cybersecurity risks. The Board and the Audit Committee receive regular presentations and discuss topics on cybersecurity risks with management, including the Director of Cybersecurity and the Senior Vice President Global Information Systems. The presentations and discussions address a range of topics, including recent cybersecurity developments, the threat environment, evolving standards and technology, vulnerability assessments and related remediation plans, education and training programs, and cybersecurity insurance. The Board also receives periodic training on recent developments and trends in cybersecurity from a third-party advisor. Based on the Company's procedures, the Board and Audit Committee receive prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, and regular updates until such threat or incident has been addressed.


text: The Director of Cybersecurity and the Senior Vice President Global Information Systems work closely with the CEO, CFO, General Counsel and other members of management to design, implement and maintain policies, procedures and practices to protect the Company's information systems and promptly respond to any cybersecurity threats or incidents, consistent with the Company's response and recovery plans. The Global Information Services team monitors the prevention, detection, and mitigation systems in real time and reports such threats and incidents to the Director of Cybersecurity, Senior Vice President Global Information Systems, the CEO, CFO, General Counsel, and other members of management, when appropriate. The process provides for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Global Information Services team has relevant educational and industry experience. The Director of Cybersecurity has served in various roles in information technology and security at Manitowoc for over 29 years, including the last five years overseeing cybersecurity. The Senior Vice President Global Information Systems has been with Manitowoc for over 23 years, leading the Global IS team since 2022.


text: Controls, Procedures and Technical Safeguards The Company has enterprise security policies, controls and procedures designed to protect the confidentiality, integrity, and availability of our information assets. Among other areas, the comprehensive system addresses intrusion detection, encryption, device hardening, and monitoring through various controls, including phishing protection solutions, administrative password management tools, system patching, encryption, and intrusion prevention and detection systems.


text: The Company regularly engages in assessments, testing and subsequent remediation of our policies, procedures and practices that are designed to address cybersecurity threats and incidents. These efforts include a variety of third-party vendors and activities, including audits, assessments, penetration tests, threat modeling, tabletop exercises and vulnerability testing. We have also engaged a third party to perform an independent review of our information security environment. The results of such assessments, audits and reviews, along with remediation and development plans, are reported by management to the Board and Audit Committee.


text: The Company deploys technical safeguards designed to protect the Company's information systems, including firewalls and systems for anti-malware, intrusion detection and prevention. The technical safeguards are regularly evaluated, tested, and improved through vulnerability assessments and updated cybersecurity intelligence. The Company also maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and such plans are tested, evaluated and updated on a regular basis.


text: The company evaluates and oversees cybersecurity risks presented by third parties, including vendors, and service providers, and the systems of third parties that could impact our business. We seek vendor partners who are reliable, reputable and maintain cybersecurity programs. We also rely on contractual terms for indemnification and to ensure vendors and service providers employ industry best practices to protect confidential information.


text: The Company uses employee training and education as part of the comprehensive system designed to protect the Company's information systems. Through mandatory training and ongoing awareness campaigns, including phishing simulations, we are educating our personnel about cybersecurity risks and providing them with the tools to identify, prevent and report potential cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: NEVRO CORP


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), Vice President of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CISO oversees our cybersecurity risk management in partnership with our Vice President of Information Technology, Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our Vice President of Information Technology has developed expertise in cybersecurity and compliance, enterprise architecture and rod mapping, data and analytics, digital transformation, and customer service through her extensive experience in information technology. She earned her Bachelor of Science in Accounting and emphasis in Information Systems Management from North Dakota State University. Our CISO has worked for 30 years in product development and information technology, including the areas of infrastructure and application architecture. In the last 15 years, he has worked in security for healthcare, pharmaceutical and technology companies, the last six years as CISO. He earned his Bachelor of Science in Electronic Engineering from Universidade Federal do Rio de Janeiro in Brazil.


text: The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as National Institute of Standards and Technology (NIST) and Federal Financial Institutions Examination Council (FFEIC), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: The Program is integrated into the Company's enterprise risk management program. The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations including reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at required new employee orientation and subsequently receive information security tips via email each business day. Employees also receive monthly security awareness video training and are required to complete annual computer-based training. The Company also provides information security awareness training to business customers and individuals in our communities.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts accommodate for the ever-evolving information and cyber security threat landscape. The Chief Information Security Officer ("CISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Program is included in the Company's enterprise risk management program. The CISO is responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our CISO has over 20 years of related experience, and others on our Corporate Information Security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.


text: The Program is overseen by the Company's Risk Committee, First Technology Services Board of Directors, Technology Risk Committee, and Security Advisory Committee. Additionally, the First Financial Trust and Asset Management Board of Directors oversee the Program as it relates to the trust subsidiary. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: The Company's Board of Directors and subsidiary technology and trust companies' Boards of Directors monitor the Program including policies and practices. The Company's Risk Committee and technology company's Board of Directors oversees areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The CISO also provides periodic cybersecurity updates to the Audit Committee and the Audit Committee Chairman is member of the Risk Committee. The management-level Technology Risk Committee and Security Advisory Committee oversee management of the Program and related assessments. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions" and "Our business may be adversely affected by security breaches at third-parties." in Item 1A- Risk Factors.


text: Berkshire recognizes that maintaining processes for identifying, assessing, and managing cybersecurity threats is important in dealing with its significant business risks. As such, Berkshire has implemented a framework for cybersecurity and cyber-related information management across Berkshire's diverse groups of businesses. The framework permits each Berkshire Business Group ("Business Group") to tailor solutions to identify, manage, and mitigate risks based on their own assessment of their unique cybersecurity risks in conjunction with each Business Group's overall risk management processes. At the same time, the framework helps enable consistent and appropriate compliance in reporting material cyber events and risks across Berkshire.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: Each Business Group's Chief Information Security Officer ("CISO") on at least an annual basis is to provide a report to the Business Group's senior management, regarding the state of their cybersecurity program and its material cyber risks. These reports are also shared with Berkshire's internal audit group to inform and enhance the overall company's risk management processes. In addition, each Business Group is required to maintain an incident reporting process to report significant cybersecurity events to Berkshire. Berkshire and its Business Groups engage and partner with a wide range of third parties to assess, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes us, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.


text: The Audit Committee of Berkshire's Board of Directors has responsibility for oversight of Berkshire's cybersecurity risk management program. The Audit Committee receives periodic reports regarding the number of and impact from cybersecurity incidents reported through Berkshire's cybersecurity incident reporting process. Additionally, the Audit Committee is updated on cybersecurity trends and common deficiencies. Furthermore, the Audit Committee approves and receives updates on the workplan performed by Berkshire's internal audit group that focuses on information technology and cybersecurity risks. This includes audit procedures related to internal and external penetration testing, attack simulations, vulnerability assessments, cybersecurity program reviews and other audits designed to investigate specific risks. The frequency of these updates is determined by the Audit Committee in conjunction with Berkshire's senior management. In addition to the Audit Committee's oversight, the senior management of Berkshire's Businesses Groups are responsible for the day-to-day operations of protecting their businesses' information systems. Each Business Group is required to report significant cybersecurity events to Berkshire. Berkshire's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.


text: TEC assesses, identifies, and manages material risks from cybersecurity threats under the governance of its Cyber Security Framework and Information Security Policy, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical facilities and/or cyber assets, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, TEC's Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes. TEC's Corporate Security group is responsible for protecting physical assets including critical facilities, protection of employees, and related physical security risks.

companyName: TAMPA ELECTRIC CO


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting the National Institute of Standards and Technology Cybersecurity Framework policy and standards. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.


text: TEC's IT Business Continuity – Emergency Contingency Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to TEC's executive leadership and Board of Directors based on an assessment of the risk and other specified criteria. TEC has established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within Emera's enterprise crisis management framework.


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.


text: While to date TEC has not detected a significant compromise of its cybersecurity systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that TEC could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "TEC is exposed to potential risks related to cyberattacks and unauthorized access, which could cause system failures, disrupt operations or adversely affect safety" for a further discussion of risks related to cybersecurity.


text: The Company's entire Board of Directors is engaged in risk management oversight, including the oversight of risks from cybersecurity threats. In accordance with the NYSE listed company rules, the Audit Committee assists the Board of Directors in its oversight of Domino's company-wide risk management and the process established to identify, assess, measure, monitor and manage risks, including major information security and cybersecurity risks, with input from the Company's internal committee dedicated to assessing and managing enterprise risk comprised of members of the Company's Executive Leadership Team who report directly to our Chief Executive Officer in addition to other senior leaders within the Company (the "Enterprise Risk Committee").

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Cybersecurity and related matters are a recurring topic at meetings of the Audit Committee and the Company's Executive Vice President and Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") provide the Audit Committee with an update on the Company's cybersecurity risk profile and strategy at multiple Audit Committee meetings each year. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.


text: At an operational level, the Company's cybersecurity strategy is shaped by its CISO who is ultimately responsible for implementing the Company's cybersecurity policies, procedures and strategy under the oversight of the Enterprise Risk Committee. The Company's CISO regularly provides updates to the Enterprise Risk Committee at relevant meetings and provides additional updates to the Company's Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and CTO on a regular basis in between the meetings of the Enterprise Risk Committee. Such updates are designed to ensure the Enterprise Risk Committee and Company executives remain informed about and are able to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's CISO has multiple decades of experience in the cybersecurity and information security fields with relevant experience supplemented by undergraduate and post-graduate degrees in information technology and security and completion of additional related executive education, along with holding several industry-recognized cybersecurity certifications. The Company's CTO supplements the expertise and experience of the CISO.


text: Under the oversight of the Enterprise Risk Committee, relevant information regarding the Company's cybersecurity profile and any cybersecurity threats or incidents is then communicated during the regular updates to the Audit Committee in a process designed to ensure the Board of Directors and Audit Committee maintains appropriate oversight of the Company's cybersecurity strategy and risk profile.


text: Cybersecurity is a key component of the Company's overall risk management system, and the Company believes it has implemented robust processes that are designed to effectively manage risks from cybersecurity threats. Domino's cybersecurity program is embedded into the Company's enterprise risk management framework from both a resource allocation and strategic initiative perspective and is supported by an extensive catalog of layered security controls that are designed to prevent and detect internal and external security threats and safeguard privacy and personal data of customers, team members, franchisees and other business partners. Domino's maintains this comprehensive information security program with a dedicated team that is responsible for directing, coordinating, planning and organizing information security activities throughout the Company and is led by the Company's CISO.


text: The Company leverages a combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Critical Security Controls as the scale against which to assess its information security program and invest in its ability to proactively defend against security risks within its environment. Domino's conducts annual risk assessments, both internally and through the use of third parties, to evaluate the effectiveness of its security controls and identify new threats and vulnerabilities and appropriate controls to mitigate risks and supplements these regular assessments with ongoing monitoring. Additionally, Domino's participates in ongoing and periodic assessments of its external platform and applications to include running a responsible disclosure program to ensure that vulnerabilities that are discovered can be reported and appropriately remediated. Domino's has been certified as compliant with the Payment Card Industry Data Security Standard ("PCI DSS") standards and has several dedicated teams of specialists within its information security department that routinely conduct internal and external vulnerability and penetration assessments in accordance with both PCI DSS and industry accepted practices. This team keeps the Company's management informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents and leads the Company's processes to oversee and identify risks from cybersecurity threats associated with the Company's use of its third-party service providers. The Company additionally has established and maintains a dedicated Security Operations Center (SOC) team that is responsible for quickly identifying and treating events that could pose risk to its technology environments and that has a documented incident response plan in place.