text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, and review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance, and regulation concerns.


text: Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.

companyName: Denali Therapeutics Inc.

ticker: DNLI

secItem: Item 1C


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Industrial Logistics Properties Trust

ticker: ILPT


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify, assess and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: Venture Lending & Leasing IX, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: We consider our information technology ("IT") and information systems to be valuable and vital assets and must be protected as such. We maintain a series of policies and supporting procedures designed to help ensure the security and confidentiality of our IT and information systems and to help ensure that they are properly protected from a variety of threats such as error, fraud, embezzlement, sabotage, terrorism, extortion, industrial espionage, service interruption, and natural disaster. Information is protected according to its sensitivity, value, and criticality with particular focus given to protecting confidential information, such as personal identifying information, unpublished financial results and other data deemed proprietary to us. Our cybersecurity network, including management, employees and service providers, prioritizes protecting and otherwise managing our information assets, and recognizes that information security is an important part of our business.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances in any given quarter are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors. We have focused on the following cybersecurity initiatives.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed with the BrightSpire IT Partner's attention to and integration of certain information security standards issued by the SEC, the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adaptation to and mitigation of new threats, leverage of internal team resources to focus on business priorities, and effectively meeting and managing evolving regulatory requirements in real time. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching, including four to six sessions each calendar year (addressing spam, phishing, information security protocols, use of social media); and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We migrated and maintain our company data and communication services to a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our independent financial auditor, and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review (including findings on phishing campaigns and vulnerability patchwork initiatives) and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape (for example, the impact of artificial intelligence). In coordination with the Information Security Group, the General Counsel provides reports of material cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicit detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. Since inception in January 2018, we have not experienced any material cybersecurity or information security incidents. We have not incurred any expenses due to material information security incident penalties or settlements.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors quarterly. We have focused on the following cybersecurity initiatives.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed to leverage certain information security standards, such as those issued by the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adapt and mitigate new threats, leverage of internal team resources to focus on business priorities, and addressing evolving regulatory requirements. Our response plans require prompt notification to the Information Security Group in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching; and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We maintain our company data and communication services with a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our internal financial auditor and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape. In coordination with the Information Security Group, the General Counsel provides reports of significant cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board or ad hoc as appropriate. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicits detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. Since inception in January 2018, we are not aware of any cybersecurity or information security incidents that have materially affected us to date. We have not incurred any expenses due to material information security incident penalties or settlements. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. Refer to the risk factor "We are highly dependent on information systems and third-parties, and system failures or cybersecurity incidents incurred by us or the third-parties that we rely on could significantly disrupt our ability to operate our business." in the section entitled "Risk Factors—Risks Related to Our Company and Our Structure" for more information regarding our cybersecurity risks.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate certain losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, including for example, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Construction Partners, Inc.

ticker: ROAD


text: We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. Dedicated members of our information security team, led by our Senior Vice President, Information Technology and our Director of Information Security, continuously monitor threat intelligence feeds, handle vulnerability management and respond to incidents. In addition, we periodically perform simulations and drills at a technical level.


text: Internally, we have a security awareness training platform that includes training to reinforce our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to evaluate our cybersecurity controls and a cybersecurity firm to conduct continuous threat detection, response and remediation.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Role of the Board. Our board of directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the board of directors in particular is responsible for overseeing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the board of directors, including members of the Audit Committee, receive periodic reports from management and our third-party service providers to assess the primary cybersecurity risks we face.


text: Our Senior Vice President, Information Technology and our Director of Information Security are together responsible for the day-to-day management of our cybersecurity risks. These professionals have extensive experience in the information technology area, including cybersecurity. In particular, our Senior Vice President, Information Technology has more than 30 years of professional experience in the field of management information systems and information security, including with other companies in our industry. Further, our Director of Information Security has more than 20 years of experience in the information security area, with a career spanning roles with the U.S. Air Force, healthcare, academia and private consulting, and holds various certifications related to cybersecurity.


text: Security Incident Response Plan. We have a security incident response plan in place. The incident response plan is a set of coordinated procedures that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.


text: Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee (the "Committee"). The Committee oversees the implementation of the cybersecurity risk management program.


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. Hycroft's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this 2024 Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: T Stamp Inc

ticker: IDAI


text: Our risk management strategy includes, among other elements: • Identification: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel. • Assessment: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. • Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.


text: The Company's cybersecurity policies and procedures are fully integrated into its broader risk management framework, reflecting a holistic approach to cybersecurity risk management. Regular cybersecurity risk assessments are conducted to identify potential threats and vulnerabilities, with detailed mitigation strategies developed and implemented accordingly.


text: Trust Stamp has adopted an Information Security Incident Response Plan that establishes policy and protocol to follow in response to an information security incident or event impacting Trust Stamp. This policy applies to all Trust Stamp employees holding management responsibilities. Incidents are reported by users via various methods including verbally, email, or other methods. The Development Operations team via the Chief Technology Officer or Executive Vice President is the main point of contact for technical support issues. It is to be expected that potential security incidents will be raised through this channel.


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.


text: Board of Director Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.


text: Management's Governance Management's roles and responsibilities in cybersecurity oversight are clearly defined, with specific committees or positions designated for managing cybersecurity risks. The day-to-day management of cybersecurity is the responsibility of the Chief Technology Officer who oversees our technology team. These include procedures for incident response and regular reporting of cybersecurity information to the Board of Directors (the "Board"), ensuring effective communication and oversight. Cybersecurity risk management is seamlessly integrated into the Company's overall business strategy and decision-making processes, demonstrating a proactive approach to managing cybersecurity risks.


text: The Company has established clear criteria for determining the materiality of cybersecurity incidents, which include assessing potential or actual financial impacts, reputational damage, and operational disruptions. Documented incidents are meticulously recorded, detailing their nature, scope, and financial implications, ensuring transparency and accountability. The timeliness of Form 8-K filings following material cybersecurity incidents is strictly adhered to, with a thorough process in place for documenting any reasons for delayed disclosures. This ensures compliance with SEC requirements and maintains stakeholder confidence in the Company's cybersecurity posture.


text: We review cybersecurity risk as part of our overall enterprise risk management program with a goal of ensuring that cybersecurity risk management remains a top priority in our business strategy and operations.


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2024.


text: Board of Director's Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.


text: The Company recognizes the critical importance of developing, implementing, and maintaining effective cybersecurity measures to protect our information systems and provide for the confidentiality, integrity, and availability of our data, as well as that of our customers, business partners and employees. Our cybersecurity processes are integrated into our overall enterprise risk management framework so that cybersecurity risks can be evaluated and managed alongside other business risks. Such integration supports our effort to promote a company-wide culture of cybersecurity risk management.

companyName: IBEX Ltd

ticker: IBEX


text: Risk Assessment. Our in-house security teams and third-party security firms periodically evaluate the Company's cybersecurity policies, processes, and practices. Such evaluations may include audits, assessments, penetration testing, threat modeling, tabletop exercises, and similar activities focused on evaluating the effectiveness of our cybersecurity processes and planning. The Company updates its cybersecurity policies, standards, processes, and practices periodically, as appropriate, based on the insights gained from these assessments, evolving industry standards, cybersecurity threat intelligence, changes to our infrastructure, and client-specific requirements.


text: The Company considers the following factors in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and degree of risk; potential impact, if a risk materializes; and the feasibility, cost and impact of controls. The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, cyber insurance, and physical security controls. The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.


text: We have, and will continue to, integrate AI into our solutions, as well as explore potential third-party partnerships to help us be better positioned to offer our clients robust solutions. While AI offers significant benefits, it also presents risks and challenges. AI solutions are evolving and are not infallible, and we may encounter issues with data sourcing, technology integration, program bias into decision-making algorithms, security challenges and the protection of personal information and privacy. The Company typically conducts a risk assessment to identify potential threats and vulnerabilities in the third-party partners' systems, including reviews of data security, the AI model security, and compliance with applicable laws, regulations, and standards related to AI and data security.


text: Third-Party Risks. We have established processes to oversee and identify cybersecurity risks presented by third parties. Under these processes, contracts with third parties are to be reviewed for proper contractual controls, to include provisions mandating the implementation and maintenance of appropriate cybersecurity measures as well as legal recourse in the event of a security incident. We periodically conduct assessments of key vendor and business partners' cybersecurity practices and require them to adhere to our security standards, as appropriate. Additionally, we may perform additional due diligence on select third-party service providers by collecting and reviewing certifications when available. The Company also conducts periodic audits of third-party processes and certifications to consider their use of industry best practices.


text: Business Continuity, Incident Response and Disaster Recovery. The Company has established and maintains business continuity, incident response, and disaster recovery plans designed to address the Company's response to cybersecurity incidents and other potential disruptions. Our IT Security, Operations and Compliance teams routinely evaluate and update these plans to enhance our incident response preparedness. The Company also leverages third party incident response and threat detection services.


text: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company's information security policies, standards, processes, and practices by the CTO as needed.


text: As indicated above, we utilize a risk-based methodology to determine which security controls are appropriate for a particular circumstance, and it is possible we may not implement suitable controls if we fail to perceive, or underrate, a particular risk. Though we have confidence in the security measures and processes we deploy to protect from cybersecurity threats, neither ibex nor others we rely on may be able to completely, continuously, and successfully execute security controls as intended.


text: The Company's Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company's enterprise risk management framework. The Company's management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance. Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives. Our Vice President for IT Data Security ("VP, IT Data Security") reports to our Chief Technology Officer ("CTO") and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.


text: Our current VP, IT Data Security, has led our Data Security Department for nine years and holds more than seventeen years of experience in cybersecurity, including security operations, cloud security, and risk management. He has extensive experience with enterprise information security controls and frameworks, such as ISO 27001, PCI DSS, SOC 2 Type II, and HITRUST. Additionally, he holds multiple certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager).


text: The CTO and VP, IT Data Security meet regularly with the Cybersecurity Committee to review the Company's management of information security risks, and the Cybersecurity Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CTO. In addition to scheduled meetings, the CTO, Cybersecurity Committee, and CEO maintain a regular dialogue regarding emerging or potential cybersecurity risks, which may include input from our third party vendors and other external sources. Together, they receive updates on significant developments in the cybersecurity domain from the CTO, as needed and quarterly. These updates, as well as other cybersecurity matters, are provided to the Company's Board by the CTO to support the Board's proactive and responsive oversight of cybersecurity related risks. The Board and executive management meet regularly to review cybersecurity risks and developments as part of our enterprise risk management framework.


text: The Company previously experienced a cybersecurity incident in August of 2020. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. "Risk Factors - Unauthorized or improper disclosure of personal information, breach of privacy, whether inadvertent or as the result of a cyber-attack or improperly by our employees, has resulted in liability and could harm us." which should be read in conjunction with the foregoing information.


text: The Company considers the following factors in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and degree of risk; potential impact, if a risk materializes; and the feasibility, cost and impact of controls. The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, data encryption, backup and recovery systems, cyber insurance, and physical security controls. The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.


text: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company's information security policies, standards, processes, and practices by the Chief Technology Officer ("CTO") as needed.


text: The Company's Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company's enterprise risk management framework. The Board receives periodic updates from management on cybersecurity strategy, risk assessments, and significant developments but is not involved in day-to-day operational decision-making. The Company's management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance. Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives. Our Chief Information Security Officer ("CISO") reports to our CTO and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.


text: Our current CISO has led our Data Security Department for ten years and holds more than eighteen years of experience in cybersecurity, including security operations, cloud security, and risk management. He has extensive experience with enterprise information security controls and frameworks, such as ISO 27001, PCI DSS, SOC 2 Type II, and HITRUST. Additionally, our CISO holds multiple professional certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager).


text: The CTO and CISO meet regularly with the Cybersecurity Committee to review the Company's management of information security risks, and the Cybersecurity Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CTO. In addition to scheduled meetings, the CTO, Cybersecurity Committee, and CEO maintain a regular dialogue regarding emerging or potential cybersecurity risks, which may include input from our third party vendors and other external sources. Together, they receive updates on significant developments in the cybersecurity domain from the CTO, as needed and quarterly. These updates, as well as other cybersecurity matters, are provided to the Company's Board by the CTO to support the Board's proactive and responsive oversight of cybersecurity related risks. The Board and executive management meet regularly to review cybersecurity risks and developments as part of our enterprise risk management framework.


text: We have implemented additional technical and procedural safeguards over time to strengthen our security posture, including enhanced incident response protocols and employee awareness training. Although cybersecurity threats in the last fiscal year have not materially affected the Company's business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. "Risk Factors - Unauthorized or improper disclosure of personal information, breach of privacy, whether inadvertent or as the result of a cyber-attack or improperly by our employees, has resulted in liability and could harm us." which should be read in conjunction with the foregoing information.


text: We have implemented a comprehensive cybersecurity program designed to protect the confidentiality, integrity, and availability of our information systems and data. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and zero trust model, incorporates industry best practice standards, and includes policies, standards, procedures, controls and technology platforms that help manage cybersecurity risk.

companyName: nVent Electric plc

ticker: NVT


text: Our Board of Directors oversees cybersecurity risk management and is supported by the Audit and Finance Committee of the Board (the "Audit Committee"). The Audit Committee interacts with the Executive Leadership Team ("ELT"), including our Chief Technology Officer ("CTO"), and other members of management with respect to cybersecurity matters. The Board of Directors and the Audit Committee receive periodic reports from management on the effectiveness of the cybersecurity program and any material cybersecurity incidents that have occurred. The Board of Directors and the Audit Committee work with management to help ensure that our cybersecurity program is effective in addressing the risks associated with cybersecurity threats and are committed to continuously improving our cybersecurity program to stay ahead of emerging threats. The CTO oversees our cybersecurity program, including assessing and managing material risks from cybersecurity threats. The Chief Information Security Officer ("CISO") reports to the CTO and leads the cybersecurity program and team.


text: The CTO has served in various roles in information technology and information security for over 25 years. The CTO holds a PhD in engineering and degrees in technology and management. The CISO has served in various roles in information technology and information security for over 25 years, including serving as a cybersecurity leader for public companies for more than 10 years. The CISO holds a degree in engineering and a master's degree in business.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We track cybersecurity risk as an enterprise risk through our enterprise-wide risk management ("ERM") framework. The Board of Directors is actively involved in oversight of our ERM framework and receives regular reports on risks, including cybersecurity risks. We engage third parties to conduct assessments, tests, and simulation exercises to validate and further mature our cybersecurity program, the results of which are reported to the Executive Leadership Team, including CTO, and the Board of Directors. We maintain cybersecurity insurance coverage to help mitigate the financial impact of a cybersecurity incident.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity incidents, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, all of which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and business continuity plans that address our response to, and mitigation and remediation of, a cybersecurity incident. We have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents to the ELT and the Audit Committee when appropriate, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We maintain a comprehensive, risk-based approach to assessing and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness We have implemented a security awareness and training program designed to educate employees on the importance of information security and to help them identify and respond to potential security incidents. The program includes annual required cybersecurity training for professional employees, role-based cybersecurity training, and a phishing awareness program for all employees.


text: Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain disruption, or other similar incidents may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, Risk Factors, "Increased cybersecurity threats and computer crime pose a risk to our systems, networks, products and services, which expose us to potential regulatory, financial and reputational risks." for a discussion of cybersecurity risks.


text: Our Board of Directors oversees cybersecurity risk management and is supported by the Audit and Finance Committee of the Board (the "Audit Committee"). The Audit Committee interacts with the Executive Leadership Team ("ELT"), including our Chief Technology Officer ("CTO"), and other members of management with respect to cybersecurity matters. The Board of Directors and the Audit Committee receive periodic reports from management on the effectiveness of the cybersecurity program and any material cybersecurity incidents that have occurred. The Board of Directors and the Audit Committee work with management to help ensure that our cybersecurity program is effective in addressing the risks associated with cybersecurity threats and are committed to continuously improving our cybersecurity program to stay apprised of emerging threats. The CTO oversees our cybersecurity program, including assessing and managing material risks from cybersecurity threats. The Chief Information Security Officer ("CISO") reports to the CTO and leads the cybersecurity program and team.


text: The CTO has served in various roles in technology for over 25 years and in information security including product security for over a decade. The CTO holds a PhD in engineering and degrees in technology and management. The CISO has served in various roles in information technology and information security for over 25 years, including serving as a cybersecurity leader for public companies for over a decade. The CISO holds a degree in engineering and a master's degree in business.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We track cybersecurity risk as an enterprise risk through our enterprise-wide risk management ("ERM") framework. The Board of Directors is actively involved in oversight of our ERM framework and receives regular reports on risks, including cybersecurity risks. We engage third parties to conduct threat assessments, information system penetration tests, and simulation exercises to validate and further mature our cybersecurity program, the results of which are reported to the Executive Leadership Team, including CTO, and the Board of Directors. We maintain cybersecurity insurance coverage to help mitigate the financial impact of a cybersecurity incident.


text: We have established and maintain comprehensive incident response and business continuity plans that address our response to, and mitigation and remediation of, a cybersecurity incident, which includes the support of external cyber-specialist resources when deemed necessary, in addition to managed services to support our Security Operations Center function. We have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents to the ELT, and the Board of Directors when appropriate, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Education and Awareness We have implemented a security awareness and training program designed to educate employees on the importance of information security and to help them identify and respond to potential security incidents. The program includes annual required cybersecurity training for professional employees, role-based cybersecurity training, and a phishing awareness program for all employees. Additionally, the ELT and Board of Directors have conducted cybersecurity incident and response simulation exercises.


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to the Company, our customers, suppliers, or dealers, or other key stakeholders.

companyName: Fisker Inc./DE


text: We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks and have requirements for our suppliers to do the same. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. Our ability to monitor the cybersecurity practices of our suppliers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.


text: To effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by our Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, education, and risk management processes. This responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remediation measures, and maintaining our cybersecurity program.


text: Our cybersecurity program aligns to internationally recognized standards and best practices for cybersecurity and data protection. We perform, internal and externally sourced, security testing, 3rd party attack simulations, application scanning, and IT Security Controls Assessments, to identify vulnerabilities and evaluate cyber defense capabilities in the enterprise and in our vehicle product systems. We also perform phishing and social engineering simulations and provide cybersecurity training to Company personnel with access to Company information and/or digital assets. We disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT"), Automotive Information Sharing and Analysis Center ("Auto ISAC"), FBI InfraGard; and review customer, media, and third-party, cybersecurity reports; and respond to third-parties or security researchers who notify us of vulnerabilities they can detect in our cyber defenses.


text: Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") cloud incident management platform, that provides a log aggregation and analytics solution for threat and vulnerability monitoring. • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on endpoints. • Cloud Security Posture and Workload Protection (CSPM/CWPP) infrastructure, container, and workload monitoring for threats and compliance posture; and • Corporate incident response plans, including a product security incident response plan. • Supplier Risk Management processes to monitor contractual cybersecurity requirements, assess and manage 3rd party cyber and data risk in service and technical engagements.


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with key business partners, service providers, government, and law enforcement agencies, to understand the range of cybersecurity risks in the global operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, our CISO is a member of the FBI InfraGard and FBI Executive Advisory Board. Our membership in these public and private sector groups assists in our efforts to protect the Company against both enterprise and in-vehicle security risks.


text: The Company's global cybersecurity incident response is overseen by our Chief Information Security Officer. Our Chief Information Security Officer has served in that role for over 2 years and has over 2 decades of cybersecurity governance, engineering, and operations experience for large global brands. Our Chief Information Security Officer reports to the Vice President of IT. The Vice President of IT reports directly to the Senior Vice President of Enterprise, Digital Operations, and Transformation.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by senior management and/or disclosure committee using processes that leverage subject-matter expertise from across the Company. Furthermore, we may engage third-party advisors as part of our incident management processes. Any cybersecurity incident that is identified as having the potential to be highly significant or material to the Company are brought to the attention of the Chief Technology Officer and /or General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. Our Chief Information Security Officer briefs the Board annually.


text: As part of its oversight duties, the Audit Committee receives regular updates on our cybersecurity posture and information security risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into, and oversight of our cybersecurity processes, and in the event the Company determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ, that we believe are designed to prevent, detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the probability or risk of an incident. Risk management measures cannot provide absolute security, and may not be sufficient in all circumstances, or mitigate all potential risks.


text: Our Cybersecurity program makes a reasonable and ongoing effort to keep pace with a rapidly changing threat and regulatory landscape.


text: We rely on sophisticated information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management and strategy program, which is integrated in our enterprise risk management program.

companyName: Avantor, Inc.

ticker: AVTR


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We also perform formal risk assessment activities annually, aligned to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information security professionals monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: We also engage consultants and other third-party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with external cybersecurity firms, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response, risk remediation and resilience capabilities, including by working with an external retained incident response team, receiving third-party threat intelligence, participating in incident tabletops, and performing assessments and controls testing on our enterprise environment.


text: Our program includes procedures to oversee and identify cybersecurity risks and threats of our third-party service providers, which include third-party evaluations performed by our team of information security professionals, review of independent assessment documentation, and continuous monitoring of third-party independent posture scoring. We also include security and data protection provisions in our contractual arrangements with third-party service providers where applicable. Additionally, we have purchased a cybersecurity risk insurance policy that would reduce the costs associated with a covered cybersecurity incident if it occurred.


text: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data, or otherwise had a material impact on Avantor's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on how material cybersecurity attacks may impact our business.


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Vice President of Information Security & Risk Management and Chief Information Security Officer (CISO), in coordination with our Chief Information Officer, leads a team of information security professionals and manages our cybersecurity risk management program and activities. This involves monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies. Our CISO has over 25 years of experience working in the information technology and services industry who is a subject matter expert in a variety of areas including information security, and IT risk.


text: Our CISO reports quarterly and more regularly, as needed, to our executive leadership team composed of our Chief Executive Officer, Chief Financial Officer, and Chief Information Officer on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology leaders also meet regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics. We have also developed a cross functional disclosure working group to assess elevated cybersecurity incidents and, as appropriate, report on such events to Avantor's standing Disclosure Committee to conclude on the materiality of the incident and any need for regulatory reporting.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit and Finance Committee. The Audit and Finance Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of Avantor's information technology operations, including cybersecurity risks and information security. The CISO and Chief Information Officer report to the Audit and Finance Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging through regular and requested updates on our strategy and evolving threat landscape.


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We also perform formal risk assessment activities annually, aligned to the National Institute of Standards and Technology (NIST) 800-171 and Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information security professionals monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: Although no cybersecurity incident during the year ended December 31, 2024 resulted in an interruption of our operations, known losses of critical data, or otherwise had a material impact on Avantor's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on how material cybersecurity attacks may impact our business.


text: Our CISO reports to our executive leadership team composed of our Chief Executive Officer, Chief Financial Officer, and Chief Information Officer on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology leaders also meet regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics. We have also developed a cross functional disclosure working group to assess elevated cybersecurity incidents and, as appropriate, report on such events to Avantor's standing Disclosure Committee to conclude on the materiality of the incident and any need for regulatory reporting.


text: Our cybersecurity program incorporates a robust process for the assessment, identification, and management of material risks from cybersecurity threats. This begins with our threat intelligence program that integrates several methods to identify potential threats to the Company, including paid/unpaid threat feeds, custom threat alerts, keeping abreast of the latest threats to the technologies that exist within our information systems and daily dialogue with industry peers to the threats to the hospitality industry as a whole.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Information regarding these threats is then built into our security tools. This takes the form of hardening systems through vulnerability identification and patching, as well as enabling early detection and response capabilities across our network and endpoints. Any detected threat or potential cybersecurity incident is handled by our hybrid Security Operations Center, or "SOC" which utilizes both internal and external resources for monitoring 24/7 and is responsible for triaging and appropriately handling or escalating the potential incident.


text: Other than the incidents that occurred prior to the Spin-Off, described in more detail in "Item 1A. Risk Factors—Failure to maintain the security of personally identifiable and proprietary information, non-compliance with our contractual obligations regarding such information or a violation of our privacy and security policies or processes with respect to such information could adversely affect us" as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation, or financial condition. There is no guarantee that such risks will not evolve in the future and materially adversely affect the Company or that our processes to manage cybersecurity risks, including those described here, will operate effectively and as designed.


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer, Chief Information and Distribution Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.


text: Our CISO has been with Wyndham since 2012, and has worked in the cybersecurity industry for 19 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010, and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Information and Distribution Officer, Chief Compliance Officer and Chief Financial Officer, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Plan ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. Within this plan, there are also engagement processes for our external cybersecurity incident response firm, which also assists Wyndham's cybersecurity team by annually testing the CIRP through custom tabletop exercises. The CIRP provides a process for escalating certain cybersecurity incidents to the IRC and to other members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.


text: Information Security Program Access to our information systems is managed through our Identity and Access Management process, which governs the appropriate level of access for each user on an ongoing basis. Wyndham performs a certification process bi-annually to ensure the accuracy and completeness of each user's access.


text: Tracking and measuring of the above certification processes takes place within our Information Security Program. This program reports on the risks and remediation progress across our information systems, as well as measures them against our own standards and processes, which have been developed in part using the National Institute of Standards and Technology Cybersecurity Framework 2.0. The Information Security Program also measures the overall cybersecurity program against other key regulatory standards such as the Payment Card Industry standard known as PCI 4.0 and the Sarbanes-Oxley Act of 2002.


text: Third Party Risk Program The Company's third-party risk program includes a process for assessing and overseeing the risk profile of third parties we do business with at the time of contract execution and also in the event that the scope of the work done with any third party materially changes.


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data, or have a potentially material impact on individuals' data and respective rights.


text: The data from the threat intelligence program mentioned above also feeds into a third-party risk evaluation to ensure that any impactful event (cyber or otherwise) experienced by a third-party doing business with Wyndham is considered in the risk profile of that organization.


text: Cybersecurity Insurance To help mitigate the financial risks associated with any cyber security incidents, Wyndham Hotels also maintains cyber insurance that is renewed annually and covers both cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer and Head of Strategy, Chief Commercial Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.


text: Our CISO has been with Wyndham since 2012 and has worked in the cybersecurity industry for over 20 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010 and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Commercial Officer, Chief Compliance Officer and Chief Financial Officer and Head of Strategy, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data or have a potentially material impact on individuals' data and respective rights.


text: Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.

companyName: ChampionX Corp


text: Our Enterprise Risk Committee has delegated to our Senior Vice President and Chief Information Officer (CIO) primary responsibility for assessing and managing our material risks from cybersecurity threats. The CIO has served in various roles in information technology and information security for over 25 years, including serving as vice president of global infrastructure and operations, infrastructure security, access management, cloud security, disaster recovery and change management, and vice president of enterprise business applications, architecture and operations. The CIO holds a master's degree in technology policy management and a doctorate in information technology management, in addition to serving on multiple advisory boards within academia and industry. The other senior leaders who collaborate with the CIO on reviews of the Company's IT system and cybersecurity risk environment include a senior director of global IT cybersecurity and a senior director of global infrastructure, each of whom have over 20 years of experience managing risks in various roles, including risks arising from cybersecurity threats.


text: We are committed to deploying recognized cybersecurity systems, methods, and best practices. ChampionX uses the National Institute of Standards & Technology Framework (NIST Framework), a toolkit to make an internal assessment of our cybersecurity capabilities and to develop priorities. We take action to assess and manage our technology and cybersecurity environment and to identify material risks from cybersecurity threats directed at our company and those associated with our use of third-party service providers, including the following: • Enterprise cybersecurity maturity assessments performed periodically by a qualified third-party entity which we use to develop a multi-year strategy, investment, and project roadmap focused on improving and enhancing the Company's security posture; • An annual cybersecurity tabletop exercise and assessment, facilitated by an independent third party, focused on testing our incident response processes and capabilities; and • Regular cybersecurity assessments of various components of our technology environment to help ensure we continuously improve and strengthen our cybersecurity posture.


text: Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.


text: The Board's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2023, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.


text: Each employee is responsible for taking proper security precautions when using the Company's network and IT systems. ChampionX provides IT and cybersecurity training to employees at least once a year, regularly distributes cybersecurity tips, and conducts regular education campaigns to heighten employee awareness of phishing and other cybersecurity threats.


text: We have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. However, cybersecurity attacks and other threats to the Company's and our customers', partners', vendors' and other third-parties' systems, networks, products and services could materially affect the Company in the future. See "Risk Factors—Risks Related to our Business—We are subject to information technology, cybersecurity and privacy risks." in Part I, Item 1A.


text: Our Cybersecurity Risk Management Protocols and Strategy Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.


text: Our Cybersecurity Governance Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.


text: The Board 's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2024, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.


text: Risk Management & Strategy Our cybersecurity program includes policies and procedures designed to protect our systems and operations as well as sensitive information and data from anticipated cybersecurity threats. This program is a key component of our approach to enterprise risk management.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi factor authentication for remote access and certain internal systems; • domain name service threat detection; and, • internal incident response procedures based on NIST Special Publication 800-61.


text: We also conduct periodic phishing attack simulations to evaluate users' vulnerability to emerging email threats. We conduct remediation training where failures occur. On a quarterly basis, our cybersecurity team also conducts scenario-based tabletop exercises with critical business teams to simulate disasters and cyberattacks. The tabletop exercises test and fine-tune our business continuity plans and incident response procedures.