text: Verizon's Management Audit Committee (VMAC), which includes our CFO, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.


text: Verizon also operates a robust internal audit program. Each year, Verizon's internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. The results of the assessment are presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ

secItem: Item 1C


text: Board Oversight of Cybersecurity Risk The Audit Committee of the Board of Directors (Board) has primary responsibility for overseeing Verizon's risk management and compliance programs relating to cybersecurity and data protection and privacy.


text: As part of the Board's oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the full Board dedicated to Verizon's cybersecurity risks, threats and protections. The CISO provides a mid-year update to this annual review to the Audit Committee and, as warranted, additional updates throughout the year. The Audit Committee also receives a report from senior management on Verizon's cybersecurity posture and related matters at each of its other meetings during the year at which the CISO is not present.


text: Third Party Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Third Party Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyberattacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While none of the cyberattacks to which we have been subject to date have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience a material cyberattack in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyberattacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receives reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.

companyName: AT&T INC.

ticker: T


text: We maintain a Chief Security Office (CSO), which is charged with management-level responsibility for all aspects of network and information security within the Company. Led by our CISO and comprised of a large team of highly trained security professionals across multiple countries, the CSO is responsible for: a.establishing the policies, standards and requirements for the security of AT&T's computing and network environments;


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events, and overseeing the execution of corrective actions;


text: c.promoting compliance with AT&T's security policies and network and information security program in a consistent manner on network systems and applications; and d.providing security thought leadership in the global security arena.


text: Our CISO plays the key management role in assessing and managing our material risks from cybersecurity threats. The CISO also works closely with AT&T Legal to oversee compliance with legal, regulatory and contractual security requirements. The CISO has extensive technical leadership experience and cybersecurity expertise, gained from approximately 20 years of experience, including serving as the Chief Information Security Officer and Director of the Office of Cybersecurity at a U.S. government agency, in addition to serving as the Chief Information Security Officer of two large public companies. Prior to that, he served for 20 years in the U.S. military, in various information technology roles of increasing seniority. The security professionals in the CSO have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications.


text: We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity, or availability. Our program encompasses the CSO and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers; and the program is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence. AT&T Inc.


text: Dollars in millions except per share amounts With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: In 2023, we did not identify and were not aware of any cybersecurity breaches that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks or systems may have a material adverse effect on our operations" of Item 1A.


text: Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receive reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events and overseeing the execution of corrective actions;


text: We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity or availability. Our program encompasses the CSO and its policies, platforms, procedures and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. The program is integrated into our overall risk management framework and is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. When circumstances warrant, we also retain external cybersecurity experts to assist the CSO. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate AT&T Inc.


text: Dollars in millions except per share amounts with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence.


text: With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: In 2024, we did not identify and were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks, systems or data or those of our suppliers or vendors may have a material adverse effect on our operations or results of operations" of Item 1A.


text: Program and Strategy We understand the importance of maintaining a robust cybersecurity program to assess, identify, and manage the material risks associated with cybersecurity threats.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology ("NIST") framework, which organizes the management of cybersecurity risks into five categories: identify, protect, detect, respond, and recover.


text: The Chief Technology Officer of Brighthouse Financial (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity program. The Chief Information Security Officer of Brighthouse Financial (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team, as well as the services of third-party consultants, to assess and evaluate the effectiveness of our controls (in alignment with the NIST framework) and to improve our security measures and strategy. The cybersecurity team has also engaged a third party to measure the Brighthouse Financial cybersecurity program against the NIST cybersecurity framework. The results of this assessment confirmed the rigor of our cybersecurity risk management practices.


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents, as applicable. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, associates outside of our technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulations, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to company policies that we make available to all employees, our awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of whom have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. We have not experienced any cybersecurity incidents to date, directly or indirectly, that have materially impacted our business, financial condition, or results of operations. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Program and Strategy We understand the importance of maintaining a robust cybersecurity risk management program to assess, identify, and manage the material risks associated with cybersecurity threats.


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity risk management program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"), which provides standards, guidelines and best practices on managing cybersecurity risk, as well as the organization, improvement and assessment of Brighthouse Financial's cybersecurity risk management program.


text: The Chief Technology Officer of BHF (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity risk management program. The Chief Information Security Officer of BHF (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity risk management program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity risk management program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity risk management programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team. Brighthouse Financial also engages the services of third-party consultants to assess and evaluate the effectiveness of our controls (in alignment with the NIST Framework), to improve our security measures and strategy, and to review the Brighthouse Financial cybersecurity risk management program against the NIST Framework. The results of the most recent assessment of Brighthouse Financial cybersecurity risk management program confirmed the rigor of our cybersecurity risk management practices.


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that is designed to coordinate the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact of the incident, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, associates outside of our information technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulated phishing campaigns, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all associates. In addition to Company policies that we make available to all associates, our cybersecurity awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of which have access to our customer and associate data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. Based on the information available as of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. The Chief Compliance Officer of BHF also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. Furthermore, a material cybersecurity incident could harm our business and reputation and diminish our competitive position.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: In order to mitigate cybersecurity risk, LiveRamp maintains a security program based on widely known and accepted industry standards, including NIST CSF, ISO 27001, and SOC 2. Aligning to these standards allows our program to adjust to changing conditions such as new technology, industry best practices, or organizational risk tolerance.


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.


text: LiveRamp maintains a Security Charter which establishes the overall security program, appoints responsibility and authority to the Chief Information Security Officer (CISO), and establishes a Security Action Committee (SAC) to provide leadership and oversight. LiveRamp's CISO has over 20 years of experience as the Company's security leader, and maintains several industry standard security certifications. The members of the security leadership team, who report directly to the CISO, each have at least a decade of experience relevant to their area of responsibility.


text: The SAC includes leadership across our security, enterprise risk management, internal audit, engineering, product, data ethics, legal, and commercial teams. The SAC is responsible for reviewing and approving major updates to LiveRamp's security policies and standards, reviewing and recommending actions related to exceptions to the security program, ensuring that the security program is in alignment with business objectives, ensuring that the organization has appropriate training and awareness related to security, and providing leadership and support for the security program.


text: Cyber security is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.


text: Security Risk Management LiveRamp also maintains a security risk management program overseen by our CISO and aligned with the Company's overall Enterprise Risk Management strategy. The security risk management program includes processes for consistently identifying, classifying, analyzing, and documenting risk. Throughout the year, LiveRamp's security team conducts risk assessments focused on a particular product or compliance scope. Risks are documented and communicated to relevant stakeholders. In addition to internal teams and resources, LiveRamp leverages a variety of third parties in support of our security risk management efforts. Third-party managed services are used to support functions including our Security Operations Center, forensic incident response, and incident response tabletop exercises. Third-party providers are also utilized for penetration testing and for a bug bounty program. Third-party tooling is utilized in support of functions including threat intelligence, security logging, security information and event management (SIEM), vulnerability scanning, email protection, security awareness training, secure development training, cloud posture management, secret management, identity and access management, and anti-malware. Furthermore, following the shared responsibility model with our cloud service providers, we rely on their implementation of certain security controls, such as physical security.


text: External auditors regularly review LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent review of the capability maturity of LiveRamp's security program.


text: In order to mitigate risk associated with the use of third parties, LiveRamp maintains a third-party risk management program, incorporating the review of third parties by data ethics and security teams. A third party's inherent security risk is determined by identifying their level of access to our systems and data. Third parties with a high inherent risk or with access to sensitive data types undergo a review of their security controls, wherein LiveRamp reviews the third party's responses to a security due diligence questionnaire, external audit reports, penetration test reports, and/or security policies. A residual score is then determined based on the third party's controls and/or operational impact to LiveRamp. LiveRamp does not approve the use of any third parties with an inadequate security posture. For third parties handling personal information, LiveRamp also conducts legal and privacy due diligence to assess legal and privacy risks and apply mitigations where appropriate. LiveRamp security also conducts ongoing monitoring of existing third parties. On a cadence determined by the third party's residual risk level, controls are re-evaluated to ensure that the security controls of the third party have not been diminished.


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. While we do not believe our strategy, operations, and financials have been materially affected by risks from cybersecurity threats, we cannot provide assurances that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit/Finance Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.


text: Cybersecurity is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.


text: External auditors regularly examine LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent assessment of the capability maturity of LiveRamp's security program.


text: We rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: TRANSCONTINENTAL REALTY INVESTORS INC

ticker: TCI


text: The Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into its Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. The Corporation reassesses all suppliers on a regular interval.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit and IT Committees, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks.


text: The Corporation maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework, including processes for informing the General Counsel and the Board of Directors of material cybersecurity incidents. As described above, management is actively involved in assessing and managing the Bank's material cybersecurity risks. The CITSO and the VP of Information Security primarily lead these efforts. The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation's IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance. He also holds 20 industry recognized Technology and Security certifications. The VP of Information Security reports directly to the CITSO and has responsibility for leadership of the Bank's cybersecurity program. He holds a bachelor's degree in mathematics and computer science, as well as several industry recognized information security certifications.


text: The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into the Corporation's Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The Corporation's cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Risk owners regularly monitor cybersecurity risks and the evolving threat landscape and review and update the cybersecurity threat risk action plan in response to newly identified threats or risk mitigation actions. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. Management reassesses all suppliers on a regular interval.


text: The Corporation maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation's assets. Pursuant to the CSIRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the CITSO and the VP of Information Security primarily lead these efforts.


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. However, there can be no assurance that the Corporation's security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Corporation maintains cybersecurity insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that the Corporation' cybersecurity insurance coverage will be sufficient in the event of a cyber attack. See "Item 1A. Risk Factors" above for more information.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The boards of directors of the Corporation and the Bank have also established an IT Committee, consisting of at least three independent directors, along with non-voting members from management, including the President and CEO, the Chief Financial Officer, the CITSO, the SVP of Operations, the VP of Information Technology, and the VP of Information Security. The IT Committee assists the boards of directors of the Corporation and CNB Bank in fulfilling their respective governance responsibilities for CNB's information technology and related data security infrastructure under relevant regulatory safety and soundness requirements. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee and IT Committee, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board of Directors. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks. Several members of the Board of Directors, including the Chairperson of the Audit Committee, also have cybersecurity experience. As described above, management is actively involved in assessing and managing the Bank's material cybersecurity risks. The Corporation's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include the CEO, the CFO, the Board of Directors, the Audit Committee and external legal counsel. In addition, the incident response plan considers communications and reporting to customers, regulators and law enforcement.


text: The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation's IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance. He also holds 20 industry recognized Technology and Security certifications. The VP of Information Security reports directly to the CITSO and has responsibility for leadership of the Bank's cybersecurity program. He holds a bachelor's degree in mathematics and computer science, as well as several industry recognized information security certifications. The VP of Information Technology reports directly to the CITSO and has responsibility for leadership of the Bank's Information Technology program. He holds a bachelor's degree in information technology and has worked in the technology field for 29 years with 17 of those years in a financial institution in various technology management, security, and audit roles.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, RI Division of Banking and Connecticut Department of Banking. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our comprehensive ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), Center for Internet Security ("CIS") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive approach led by our Information Assurance team. The Information Assurance team works collaboratively across the organization to develop strategies for preserving the confidentiality, integrity and availability of Corporation and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made to management and the Audit Committee of the Board of Directors ("Audit Committee") in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations of our environment by third parties and consultants). The results of the assessment are used to develop plans for, and prioritization of, initiatives to enhance our security controls, and to make recommendations to improve processes.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and the Audit Committee on our response to a cybersecurity incident.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also provide quarterly training updates for our employees, which include social engineering exercises.


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, we engage with a third-party auditing firm to conduct cyber audits to assess our controls against the NIST Cybersecurity Framework and CIS controls on an annual basis. The results of these assessments are reported to management and Audit Committee. Cybersecurity processes and controls are adjusted based on the information provided from these assessments.


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee reports the results of their oversight function to the Board of Directors.


text: The Audit Committee directly oversees our cybersecurity program and receives regular reports from management about the status of our control environment based on the CIS controls, and the prevention, detection, mitigation, and remediation of cybersecurity incidents. This reporting also includes information concerning material security risks and information security vulnerabilities, cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our chief information officer ("CIO"), chief information security officer ("CISO") and chief technology officer ("CTO") have primary responsibility for assessing and managing material cybersecurity risks. Through the ongoing assessments they perform, including third-party assessments, they make recommendations on enhancing the security controls, and the continued maturity of our information technology and information assurance programs.


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 27-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 12-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. These plans address the prevention, detection, mitigation, and remediation of incidents, and include appropriate timely incident escalations to be followed during an incident.


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 28-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 13-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.


text: To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.

companyName: TORO CO

ticker: TTC


text: We assess and manage our cybersecurity risk using various mechanisms, starting with threat intelligence, which provides us a necessary viewpoint to help us identify trends, understand how certain attacks may affect us, and prepare for evolutions in threat actor behavior that may require changes to our security posture. We monitor emerging trends and regulations related to information security, and implement appropriate changes, as needed, to our cybersecurity risk management program.


text: To drive readiness, we perform periodic adversarial testing of our cybersecurity posture through penetration testing, using both internal resources and external expertise, as well as table-top and "red team" exercises to understand where processes or controls may be insufficient based on adversarial techniques. We have also implemented technical security controls, maintenance of certain backup and protective systems, physical and system securities measures, and data security protocols.


text: We maintain established information security policies and processes; deploy regular network and endpoint software updates on all company-managed systems and workstations to detect and prevent, among others, viruses, malicious code, unauthorized access, and phishing attempts; maintain a disaster recovery plan, and perform at least two disaster recovery exercises annually to validate and optimize our recovery efforts in event of a cybersecurity incident; and regularly engage third-party cybersecurity experts to conduct vulnerability assessments and penetration testing on our information networks, systems, and applications.


text: Our internal audit team performs regular assessments of our program and selected components. We also leverage retrospectives from previous cybersecurity incidents to understand weaknesses and to improve our security controls. We assess our critical suppliers regularly for cybersecurity risk and prescribe remediation activities when necessary. As a part of a collaborative defense approach, we regularly participate in multiple cybersecurity forums to share threat intelligence, best practices, and points of caution.


text: We train our employees through annual security training, phishing simulations, and regular communications about timely cybersecurity topics and threats. We have a documented and well-tested cybersecurity incident response plan that guides us in responding, containing, and eradicating cybersecurity threats that have breached our preventative controls. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. We regularly practice technical recovery.


text: Cybersecurity risks related to third-party IT providers and solutions are managed as part of our vendor security protocol that includes vendors, software, and cloud-based service providers. We partner with our vendors to minimize the customer data needed to provide services and ensure compliance with regulations. Vendors are reviewed annually to identify any changes to services, data requirements, and associated security and protections. Where applicable, vendors are contractually bound to protect customer data and support enforcement of all regulatory requirements. We proactively evaluate the cybersecurity risk of third-party IT providers and solutions by utilizing a repository of risk assessments and an external monitoring solution that includes threat intelligence to better inform us during contracting and vendor selection processes. When third-party risks are identified, we require those third-parties to agree by contract to implement appropriate security controls or refrain from doing business with them. Security issues are documented, tracked, and periodic monitoring is conducted for third-parties in order to mitigate risk.


text: The Company also contractually requires suppliers, vendors and other third-parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law.


text: Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Financial Officer, and General Counsel.


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program. The Audit Committee receives regular updates from management on the effectiveness of our cybersecurity program, reviews plans on how management will continually advance the program, and receives updates on special topics that help the committee provide effective oversight of the program.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Like most companies, our systems are continually subjected to sophisticated and evolving cybersecurity threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that materially impacted our operations or financial condition. Vulnerabilities could lead to significant additional expenses and an adverse effect on our reputation, business, results of operations, financial condition and cash flows. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to invest in our security controls, incident response capabilities, and third-party vendor management protocols. Additional information on cybersecurity risks we face is included in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.


text: To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. Cybersecurity risks are reviewed at least quarterly by the Enterprise Risk Management and Compliance team and escalated to senior management as appropriate. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.


text: Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and General Counsel.


text: The risks associated with the cybersecurity landscape are vast and ever-changing. Additionally, as a financial institution, the Corporation is subject to extensive federal and state regulatory and compliance requirements, many of which are associated with the protection and privacy of customer information. In response, the Corporation has created a layered and adaptable Information Security Program to protect the confidentiality, integrity, and availability of proprietary information and customer data. Continuous assessment and improvement of Information Security procedures and controls remains an integral part of the Corporation's overall risk management strategy and on-going business operations.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: Oversight and Governance The Corporation's Information Security Officer (ISO), with assistance from the Information Technology team, has the primary responsibility in maintaining, assessing, and updating the Information Security Program and for reporting cyber and information security matters to the Corporation's executive management and Board of Directors. The ISO maintains a presence on a variety of committees that work together to monitor and manage the Corporation's risk profile and approve any changes or enhancements to the risk management strategies, including the Board of Directors IT Committee and Audit Committee, and the Corporation's IT Steering Committee, Enterprise Risk Management Committee, and Vendor Management Committee. At least annually, the ISO also presents to the Board of Directors on the state of the Information Security Program. This includes an overview of the Program's strategy and processes for identifying and mitigating risks, employee security awareness and training efforts, and any enhancements or changes to the program since the previous report.


text: The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST).


text: Business Continuity and Incident Response Plans are maintained to ensure that critical business functions maintain uptime or can be restored as quickly as possible in the event that a natural or technological event occurs that impacts the Corporation or any of its service providers. The Information Security Officer and Information Technology Manager work together to maintain these plans and perform testing exercises that ensure the Corporation's back up technologies and procedures are working as intended and are available if the need should arise.


text: To help mitigate risks associated with third party vendors and service providers, the Corporation has implemented an extensive Vendor Management process, overseen by the Vendor Management Committee. All new vendors undergo due diligence analysis by the Corporation's Vendor Management team, including review of their cybersecurity, data and privacy protection, and business continuity practices of those vendors with access to Corporation or customer data. Annual due diligence follow-up reviews are performed for all existing vendors on an ongoing basis and the results are reported to the Vendor Management Committee.


text: Notwithstanding the Corporation's defensive measures and processes, the threat posed by cyber-attacks is extremely serious. The Corporation may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on it. While the Company has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, its systems and those of its customers and third-party service providers are under constant threat. It is possible that the Corporation could experience a significant cybersecurity event. The Corporation expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. Refer to Item 1A. "Risk Factors" for additional information related to cyber security risks.


text: The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and Cyber Risk Institute (CRI).


text: Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems and networks, or those of our managers, venture partners and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Ventas, Inc.

ticker: VTR


text: As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities. • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including monthly anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to our Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.


text: The Company has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our tenants, managers or business partners will be successful in preventing a cybersecurity incident, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our tenants, managers or business partners, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. For example, in November 2023, Ardent became aware of a cybersecurity incident, which Ardent determined to be a ransomware attack and which resulted in disruptions to certain aspects of Ardent's clinical and financial operations. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—The occurrence of cybersecurity incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of confidential or personal information or damage our or their business relationships and reputation. included in Part I, Item 1A of this Annual Report.


text: Our Board of Directors, directly and through its committees, routinely discusses significant enterprise risks with management and reviews the procedures we have in place designed to manage those risks. At Board and committee meetings, directors engage in analyses and dialogue regarding specific areas of cybersecurity risk, including those identified through our ERM process. In addition to the overall risk oversight function administered directly by our Board, the Audit and Compliance Committee of our Board also exercises oversight over managing the Company's cybersecurity risks. Management briefs the Audit and Compliance Committee at least once a year on cybersecurity controls, protocols, risk assessments and mitigation measures.


text: Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk.


text: Our business is subject to risk from cybersecurity threats and incidents. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or those of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.


text: As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Implement, maintain and regularly review incident response plans to manage cybersecurity threats and incidents and further improve our preparedness and response infrastructure. Such plans are informed by our testing and monitoring activities and set forth actions to be taken in responding to and recovering from cybersecurity incidents which include procedures for assessing the severity of such threats and incidents, escalating and disseminating information and containing, investigating and remediating threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities; • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including regular anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to the Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.


text: As of December 31, 2024, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business will be successful in preventing a cybersecurity incident, or mitigating or remediating a cybersecurity threat, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—Cybersecurity threats and incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of or unauthorized access to confidential or personal information or damage our or their business relationships and reputation" included in Part I, Item 1A of this Annual Report.


text: Role of our Board of Directors and the Audit and Compliance Committee As part of our Board of Directors' role in overseeing the Company's ERM program, which includes our cybersecurity risk management, our Board is responsible for overseeing management's identification, assessment and management of material cybersecurity risks which may reasonably be expected to impact the Company. While our Board has overall responsibility for enterprise risk oversight, our Board has delegated to the Audit and Compliance Committee responsibility for overseeing risks from cybersecurity threats and incidents. The Audit and Compliance Committee is responsible for overseeing the effectiveness of the Company's cybersecurity risk management initiatives, taking into account the Company's risk exposures. Management briefs the Audit and Compliance Committee at least once a year and our Board as appropriate on cybersecurity controls, protocols, risk assessments and mitigation measures.


text: Role of our Management Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team. Prior to joining Ventas, she spent approximately 12 years at a multinational hospitality public company where, in her most recent role, she was responsible for application management and support of enterprise-wide systems. This role also had responsibility for global service desk support for more than 100,000 employees.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk. As discussed above, management also provides regular reports to the Audit and Compliance Committee and to our Board as appropriate.


text: We have a cybersecurity program that is intended to assess, identify, and manage material risks from cybersecurity threats to our business. Our program includes policies and procedures for detection, assessment, response, mitigation, remediation, and reporting of cybersecurity incidents and threats. Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.


text: Our risk management approach and processes for cybersecurity extend to assessing and managing risks from cybersecurity threats associated with our use of third-party service providers, by employing vetting processes, including the conducting of security assessments and monitoring activities, to verify that third-party service providers adhere to our policies and contractual requirements.


text: In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.


text: As of April 1, 2024, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.


text: Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.