text: We have not identified any cybersecurity threats during the last two fiscal years that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Please refer to our Risk Factors in Item 1A for more information on the risks associated with cybersecurity attacks.


text: To effectively prevent, detect, and respond to cybersecurity threats, the Company employs a multi-faceted cybersecurity risk management program supervised by our Senior Director of Technology Infrastructure and Operations ("Sr Director of Tech"), who reports directly to our CEO. The Sr Director of Tech is responsible for leading our enterprise cybersecurity strategy. This responsibility includes establishing processes designed to prevent and monitor potential cybersecurity risks, assessing potential cybersecurity incidents, implementing mitigation measures, and maintaining the cybersecurity program itself. We do this so that we can continuously enhance our cybersecurity capabilities and strengthen our defensive posture.

companyName: AIR T INC

ticker: AIRT

secItem: Item 1C


text: Our capabilities, processes, and other security measures also include, without limitation: • Endpoint Detection and Response software, which monitors for malicious activities on external-facing endpoints (computers, servers, etc.). • Managed Detection and Response partnership with a third-party security firm, which monitors these endpoints on a continual basis. • Cloud monitoring, running on primary public and private cloud environments. • Disaster recovery and incident response plans, including a ransomware response plan. • Training for all personnel with access to digital assets.


text: Cybersecurity risk management is an integral part of overall enterprise risk management. As part of its enterprise risk management efforts, the Board of Directors meets with the executive leadership team to assess and respond to critical business risks. These assessments include a review of our cybersecurity programs, as well as an overview of trending cyber threats based on industry intelligence and potential mitigation strategies. Performing these assessments regularly enables the Company to determine key business objectives and the IT assets and capabilities needed to achieve them. In addition, the assessments also provide the executive leadership and the Board of Directors an understanding of the Company's security landscape and allows it to prepare to respond to threats. Cybersecurity threats continue to be identified as one of the Company's significant risks, with our Sr Director of Tech assigned as the risk owner. Our Sr Director of Tech has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data analytics and customer service through his twenty years of experience in the information technology space. He holds a Bachelor's degree from the University of North Carolina, Charlotte.


text: The Board of Directors has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. The Audit Committee serves and functions as the Board of Directors primary oversight body to monitor the Company's cybersecurity and related information technology risks. The Audit Committee receives periodic updates from the Sr Director of Tech on the Company's policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the Sr Director of Tech provides to the Board of Directors annual updates on our cybersecurity and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.


text: We may engage third-party advisors to monitor threats and to scan for vulnerabilities. When a cybersecurity threat or incident is identified by our third-party advisor, it is reported directly to our Sr Director of Tech. The Sr Director of Tech in conjunction with professionals throughout the organization, including information technology specialists, accountants, and lawyers, determine severity and response, then manage it to conclusion in accordance with our cybersecurity incident response processes. We may engage third party advisors as part of our incident response processes to assist with digital forensics among other efforts. The Sr Director of Tech, together with the cross-functional team, report material or potentially material incidents to our executive leadership and the Audit Committee. The Sr Director of Tech provides further updates regarding root causes and remediation efforts. In the event the Company determines it has experienced a material cybersecurity incident the Board of Directors is notified.


text: In an effort to deter and detect cyber threats, we engage a third-party service provider to periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use and mobile security, and further educates employees on the importance of and process for reporting all potential incidents immediately.


text: The Company continuously monitors the risk associated with its third-party service providers. The Company mandates that our key third-party service providers undergo an annual SOC 1 audit, which assist in identifying risks from cybersecurity threats. In cases where a waiver is granted, the Company ensures that alternative measures are in place to maintain rigorous oversight. The Company reviews all SOC1 audit reports to ensure our third-party service providers are maintaining adequate IT security and business process controls. This review process is part of our commitment to confirming that these third-party service providers are safeguarding our operations and data integrity.


text: Cybersecurity risk oversight and management is a critical component of the Company's overall enterprise risk management and top priority for the Company and its Board of Directors. The Company's Board of Directors have delegated management of Enterprise Risk Management, which includes cybersecurity, to the HEI/Hawaiian Electric Audit and Risk Committees and ASB Risk Committees (collectively, the ARCs). The ARCs exercise their oversight responsibility of cybersecurity through quarterly (or more frequently if necessary) cybersecurity risk updates and incidents, if any, by management (primarily the Utilities' Chief Information Security Officer and Chief Information Officer, and the ASB Director, Information Security). In early 2023, in recognition of the increased cybersecurity threats and heightened cybersecurity risks facing the Company, the ARCs formed the Cybersecurity Working Group (CWG) comprised of three directors, one from each of the Company's Board of Directors. The purpose of the CWG is to oversee and conduct periodic meetings with management to discuss cyber risk, risk treatment, and operational activities relative to cyber risk treatment and to report matters to the ARCs. The CWG also evaluates cybersecurity areas highlighted by the ARCs including areas the CWG deems higher risk or topical and reports back to the ARCs on a quarterly basis. The CWG also coordinates with the Company's management on semi-annual trainings and annual tabletop exercises for the Board of Directors.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Electric utility System overview. The Utilities rely on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties, to support a variety of business processes and activities, including procurement and supply chain, invoicing and collection of payments, customer relationship management, human resource management, the acquisition, generation and delivery of electrical service to customers, and to process financial information and results of operations for internal reporting purposes and to comply with regulatory, financial reporting, legal and tax requirements. The Utilities use their systems and infrastructure to create, collect, store, and process sensitive information, including personal information regarding customers, employees and their dependents, retirees, and other individuals.


text: The Utilities have a cybersecurity program in place, which is integrated into the overall risk management program and includes a risk management strategy and risk assessment policy, which are disseminated and maintained by the Chief Information Security Officer (CISO), revisited annually and, which govern the enterprise cybersecurity risk and maturity assessment process. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), and leverages a risk-based approach to optimize its security investment and advance its security program's maturity and security posture over time.


text: The Utilities cybersecurity program adopts security measures designed to protect the confidentiality, integrity, and availability of information technology systems, network infrastructure and other assets. The Utilities' security measures, such as awareness and training, monitoring, etc. are designed to prevent, detect, and minimize the effects of a cybersecurity incident. These measures are periodically evaluated and audited against the NIST CSF by internal audit and independent third-party cybersecurity specialists.


text: The CISO actively monitors developments in the area of cybersecurity and is involved in various related government and industry groups and briefs the Company's Board quarterly or as needed on relevant cybersecurity issues. The Utilities continue to make investments in their cybersecurity program, including personnel, technologies, cyber insurance and training of Utilities personnel.


text: The Utilities have disaster recovery and incident response plans in place to protect their businesses from information technology service interruptions. The disaster recovery plans are established to help prevent the loss of customer data, service interruptions and disruptions to operations or damage to important facilities. In addition, the Utilities also maintain cyber liability insurance that covers certain damages caused by cyber incidents.


text: Despite the Utilities security measures, all of their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, power or communication failures or similar events.


text: To date, the Utilities are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Utilities, including their business strategy, results of operations or financial condition. For further information, see "The Company is subject to information technology and operational system failures, network disruptions, cyber attacks and breaches in data security that could materially and adversely affect its businesses and reputation" in Item 1A. Risk Factors.


text: Cybersecurity governance is a critically important part of managing security and risk, and helps ensure that the Utilities' cybersecurity program aligns with its business objectives, complies with government and industry regulations, and achieves the goals that leadership has set out for managing security and risk.


text: The Company's Board of Directors oversees risks from cybersecurity threats. Oversight includes quarterly or as needed reporting from the CISO on the overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.


text: The CISO has over 30 years of experience in assessing and managing cyber risks, is responsible for day-to-day management of cybersecurity risks and regularly reports to the Board of Directors through the CWG.


text: Digital information, information technology and automation are essential components of the ASB's operations and growth strategy. ASB relies on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties to support a variety of business processes and activities. Such activities include delivery of banking services to retail and commercial customers, customer relationship management and processing financial information and results of operations for internal and external reporting purposes. We primarily use third-party systems and infrastructure to create, collect, store, and process sensitive information, including personal information of customers, employees and their dependents.


text: ASB's Management Committee establishes the Bank's strategy and makes risk-informed decisions, which includes assessing and responding to cybersecurity risk. The Bank's Risk Committee of the Board of Directors oversee risks from cybersecurity threats. Oversight includes quarterly or as needed reporting on cybersecurity risk management activities, program maturity, current and emerging cybersecurity risks, and the cybersecurity threat landscape. ASB maintains a cybersecurity program that is integrated into the overall risk management program and is overseen by the Director, Information Security and governed by an Information Security policy, standards and procedures. The cybersecurity program employs a risk-based approach for managing risks through a combination of automated tools, manual processes, and third-party assessments to identify, assess, mitigate and monitor potential cybersecurity risks. In addition to policies, standards and procedures, ASB's cybersecurity program also includes periodic risk and maturity assessments, awareness and training, monitoring, and an incident response plan.


text: Periodic risk assessments are conducted that are aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and ASB leverages the results of such assessments to help optimize security investments and advance the cybersecurity program's maturity and security posture over time. The Bank's Risk Committee of the Board annually reviews and approves ASB's Information Security Policy and Gramm-Leach-Bliley Act programs and receives quarterly, or as needed, reporting on any key cybersecurity developments.


text: The Bank actively monitors cybersecurity developments and is involved in various industry groups and cybersecurity professional organizations. While the Bank continues to make investments in the cybersecurity program, including personnel, technologies and training of Bank personnel, there can be no assurance that these systems or their expected functionality will be implemented, maintained, or expanded effectively; nor can security measures completely eliminate the possibility of a cybersecurity breach.


text: While in depth processes and technological solutions are in place to help minimize the potential for a successful cyberattack, ASB maintains a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents. The Response Plan includes (1) detection, (2) analysis, which may include timely notice to the Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review.


text: ASB maintains a formal information security training program for all teammates that includes training on matters such as phishing and email security best practices. Teammates are also required to complete compulsory training on data privacy and the Code of Conduct.


text: The Bank engages with third parties to assess and test its cybersecurity posture including having independent third parties perform internal and external penetration testing as well as social engineering and phishing testing of teammates. Results of third-party testing are reported to the Management Committee and Risk Committee of the Board.


text: ASB relies on its information technology systems and networks in connection with many of its business activities. Some of these networks and systems are managed by third-party service providers and are not under the Bank's direct control. The Bank has implemented processes to manage the cybersecurity risks associated with its use of third-party service providers.


text: To date, ASB is not aware of any risks from cybersecurity threats, including or as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Bank, including their business strategy, results of operations or financial condition. For further information, see "Cybersecurity Events or other disruptions of our information technology systems could adversely affect our business" in Item 1A, Risk Factors of this Annual Report.


text: HEI does not have an information technology (IT) or cybersecurity risk management (CRM) department, including the resources or expertise, to manage IT/CRM-related matters and processes. HEI relies on Hawaiian Electric to provide most of its IT/CRM-related services pursuant to a Service Level Agreement (SLA), amended, as of November 1, 2023 between HEI and Hawaiian Electric. HEI also employs third party cybersecurity consultants to assist in managing CRM-related matters. The SLA outlines specific services that Hawaiian Electric provides to HEI which includes support on all IT/CRM-related matters, IT service desk support, electronic file storage and backup, hardware and software installation, inventory and maintenance, standard networking and telecommunication support, and other various IT/CRM matters, including periodic reporting to HEI's board of directors and CWG. Refer to Hawaiian Electric's cybersecurity discussion for more information.


text: The SLA services provide by Hawaiian Electric are mainly for applications and systems on Hawaiian Electric's infrastructure, networks and servers. The SLA does not cover support for certain software applications that were procured outside of Hawaiian Electric's procurement and IT policies and procedures. These include the HEI's general ledger application itself, excluding the infrastructure that the general ledger application is installed on, and certain cloud-based software. Although these applications are not supported by Hawaiian Electric, security measures and internal control procedures related to user access and periodic security reviews have been implemented on these applications and are performed on an on-going basis in accordance with Hawaiian Electric's IT policies and procedures. These controls are required to protect HEI's financial and other sensitive information, as well as to prevent cybersecurity breaches on Hawaiian Electric's infrastructure, networks and servers. In the event of a cybersecurity breach on these unsupported applications, HEI employs third party cybersecurity consultants to assess and resolve issues resulting from a breach, depending on its severity. Hawaiian Electric may also provide guidance and support to assist HEI in assessing and resolving cybersecurity breaches. HEI has also formulated disaster recovery plans, which are updated on an annual basis, involving all of its applications, including those applications not supported by Hawaiian Electric.


text: HEI's cybersecurity governance is primarily integrated within Hawaiian Electric's cybersecurity governance plan and processes. HEI's board of directors and CWG are tasked with overseeing risks from cybersecurity threats through routine quarterly, or as needed, updates and periodic deep-dive sessions. These updates provide updates on cybersecurity incidents, as well as overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.


text: The HEI CFO oversees all IT and cybersecurity matters at HEI, including having oversight responsibility for the services delivered under the SLA. Since the HEI CFO does not have the expertise in cybersecurity, the HEI CFO works with the Hawaiian Electric CISO and, if necessary, with third-party cybersecurity consultants on assessing, identifying, and managing material cybersecurity matters impacting HEI. There were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect HEI, including its business strategy, results of operations or financial condition.


text: Cybersecurity risk oversight and management is a critical component of the Company's overall enterprise risk management and top priority for the Company and its Board of Directors. The Company's Board of Directors has delegated management of Enterprise Risk Management, which includes cybersecurity, to the HEI and Hawaiian Electric Audit and Risk Committees (collectively, the ARCs). The ARCs exercise their oversight responsibility of cybersecurity through quarterly (or more frequently if necessary) cybersecurity risk updates and reports of incidents, if any, by management (primarily the Utilities' Chief Information Officer and Chief Information Security Officer). In early 2023, in recognition of the increased cybersecurity threats and heightened cybersecurity risks facing the Company, the ARCs formed the Cybersecurity Working Group (CWG), which is currently comprised of two directors, one from each of the HEI and Hawaiian Electric Boards of Directors. The purpose of the CWG is to oversee and conduct periodic meetings with management to discuss cyber risk, risk treatment, and operational activities relative to cyber risk treatment and to report matters to the ARCs. The CWG also evaluates cybersecurity areas highlighted by the ARCs including areas the CWG deems higher risk or topical and reports back to the ARCs on a quarterly basis. The CWG also coordinates with the Company's management on regular trainings and tabletop exercises for the Board of Directors.


text: Electric utility System overview. The Utilities rely on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties, to support a variety of business processes and activities, including procurement and supply chain, invoicing and collection of payments, customer relationship management, human resource management, the acquisition, generation and delivery of electrical service to customers, and to process financial information and results of operations for internal and external reporting and compliance with regulatory, financial reporting, legal and tax requirements. The Utilities use their systems and infrastructure to create, collect, store, and process sensitive information, including personal information regarding customers, employees and their dependents, retirees, and other individuals.


text: The Utilities have a cybersecurity program in place, which is integrated into the overall risk management program and includes a risk management strategy and risk assessment policy, which are disseminated and maintained by the Chief Information Security Officer (CISO), revisited annually and govern the enterprise cybersecurity risk and maturity assessment process. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), and leverages a risk-based approach to optimize security investment and advance the security program's maturity and security posture over time.


text: The Utilities' cybersecurity program adopts security measures designed to protect the confidentiality, integrity, and availability of information technology systems, network infrastructure and other assets. The Utilities' security measures, such as awareness and training, monitoring, etc. are designed to prevent, detect, and minimize the effects of a cybersecurity incident. These measures are periodically evaluated and audited against the NIST CSF by internal audit and independent third-party cybersecurity specialists.


text: The CISO actively monitors developments in the area of cybersecurity and is involved in various related government and industry groups and briefs the Company's Board quarterly or as needed on relevant cybersecurity issues. The Utilities continue to make investments in their cybersecurity program, including personnel, technologies, cyber insurance and training of Utilities personnel.


text: The Utilities have disaster recovery and incident response plans in place to protect their businesses from information technology service interruptions. The disaster recovery plans are established to help prevent the loss of customer data, service interruptions and disruptions to operations or damage to important facilities. In addition, the Utilities also maintain cyber liability insurance that covers certain damages caused by cyber incidents.


text: Despite the Utilities' security measures, all of their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, power or communication failures or similar events.


text: To date, the Utilities are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Utilities, including their business strategy, results of operations or financial condition. For further information, see "The Company is subject to information technology and operational system failures, network disruptions, cyber attacks and breaches in data security that could materially and adversely affect its businesses and reputation" in Item 1A. Risk Factors.


text: Cybersecurity governance is a critically important part of managing security and risk, and helps ensure that the Utilities' cybersecurity program aligns with its business objectives, complies with government and industry regulations, and achieves the goals that leadership has set out for managing security and risk.


text: The Company's Board of Directors oversees risks from cybersecurity threats. Oversight includes quarterly or as needed reporting from the CISO on the overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.


text: The CISO has over 30 years of experience in assessing and managing cyber risks, is responsible for day-to-day management of cybersecurity risks and regularly reports to the Board of Directors through the CWG.


text: All Other segment HEI does not have an information technology (IT) or cybersecurity risk management (CRM) department, including the resources or expertise, to manage IT/CRM-related matters and processes. HEI relies on Hawaiian Electric to provide most of its IT/CRM-related services pursuant to a Service Level Agreement (SLA), amended, as of November 30, 2023 between HEI and Hawaiian Electric. HEI also employs third party cybersecurity consultants to assist in managing CRM-related matters. The SLA outlines specific services that Hawaiian Electric provides to HEI, which includes support on all IT/CRM-related matters, IT service desk support, electronic file storage and backup, hardware and software installation, inventory and maintenance, standard networking and telecommunication support, and other various IT/CRM matters, including periodic reporting to HEI's Board of Directors and CWG. Refer to Hawaiian Electric's cybersecurity discussion for more information.


text: The SLA services provided by Hawaiian Electric are mainly for applications and systems on Hawaiian Electric's infrastructure, networks and servers. The SLA does not cover support for certain software applications that were procured outside of Hawaiian Electric's procurement and IT policies and procedures. These include the HEI's general ledger application itself, excluding the infrastructure that the general ledger application is installed on, and certain cloud-based software. Although these applications are not supported by Hawaiian Electric, security measures and internal control procedures related to user access and periodic security reviews have been implemented on these applications and are performed on an on-going basis in accordance with Hawaiian Electric's IT policies and procedures. These controls are required to protect HEI's financial and other sensitive information, as well as to prevent cybersecurity breaches on Hawaiian Electric's infrastructure, networks and servers. In the event of a cybersecurity breach on these applications not supported by Hawaiian Electric, HEI employs third party cybersecurity consultants to assess and resolve issues resulting from a breach, depending on its severity. Hawaiian Electric may also provide guidance and support to assist HEI in assessing and resolving cybersecurity breaches. HEI has also formulated disaster recovery plans, which are updated on an annual basis, involving all of its applications, including those applications not supported by Hawaiian Electric.


text: HEI's cybersecurity governance is primarily integrated within Hawaiian Electric's cybersecurity governance plan and processes. HEI's Board of Directors and CWG are tasked with overseeing risks from cybersecurity threats through routine quarterly, or as needed, updates and periodic deep-dive sessions. These updates cover cybersecurity incidents, as well as overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.


text: The HEI CFO oversees all IT and cybersecurity matters at HEI, including having oversight responsibility for the services delivered under the SLA. Since the HEI CFO does not have expertise in cybersecurity, the HEI CFO works with the Hawaiian Electric CISO and, if necessary, with third-party cybersecurity consultants on assessing, identifying, and managing material cybersecurity matters impacting HEI. There were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect HEI, including its business strategy, results of operations or financial condition.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our cybersecurity program prioritizes threat mitigation, while focusing on maintaining the integrity and resilience of our systems. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as guidelines in the development of our cybersecurity program. We also adhere to applicable Payment Card Industry Data Security Standards. The cybersecurity risk management process and related governance processes are integrated into our broader enterprise risk management framework, which is designed to appropriately identify, prioritize, manage, and oversee risks.

companyName: HOME DEPOT, INC.

ticker: HD


text: Overseeing our cybersecurity efforts on a day-to-day basis is our cybersecurity team, led by our Chief Information Security Officer ("CISO"). Our cybersecurity team, in partnership with third parties, designs and implements our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates. We continue to make investments to enhance our ability to identify, protect from and detect security risks within our environment.


text: We maintain a range of tools and services to aid in and inform our monitoring and mitigation of cyber risks. Throughout the year, internal teams conduct targeted audits and penetration tests. We engage third parties to independently evaluate our cybersecurity maturity on an annual basis and perform a risk assessment, as well as to provide expertise as needed on various cybersecurity programs and issues. We maintain a security operations center that is staffed around the clock to detect, mitigate, and respond to cyber threats. In the event we identify a cybersecurity incident, we have defined procedures to respond to and recover from such incident as quickly as possible. Our policies and procedures are reviewed periodically to ensure they remain aligned with current regulatory requirements and the current threat landscape. We also have established classification and retention policies focused on limiting the risk of unauthorized exposure of customer, associate, and business data. We maintain cybersecurity insurance to help provide protection against losses arising from significant security incidents.


text: The Company has an Incident Response Team ("IRT"), a cross-functional group with the expertise, authority and resources to act quickly, efficiently and appropriately to investigate, coordinate the response to, remediate, and communicate regarding a cybersecurity incident. The IRT uses a detailed incident response plan that outlines and coordinates the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. In addition, our IRT engages in tabletop exercises at least annually to simulate a response to a cybersecurity incident and uses the findings to improve our processes, plans and technologies.


text: We provide data security and privacy awareness and training to all associates upon hire and on an annual basis, with additional customized, role-based training provided to targeted internal audiences. In addition, we conduct periodic awareness campaigns and regular phishing email simulation tests to reinforce our new-hire and annual training and promote ongoing awareness of risks.


text: Vendor Security. We have a vendor risk management program that works to classify service provider or business partner risk based on several factors, including but not limited to data type accessed and/or retained. Using a risk-based approach, we perform diligence and security risk assessments for certain vendors and service providers and include appropriate obligations in our contractual arrangements.


text: Cybersecurity Risks. We have not experienced any material cybersecurity incidents in the past fiscal year. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot provide full assurance that our cybersecurity risk management processes will be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Part I, Item 1A. "Risk Factors".


text: Our efforts to create a secure digital environment start with the governance and oversight of our data security and privacy policies and strategy. At the Board level, cybersecurity is overseen by the full Board and by the Board's Audit Committee, which has primary responsibility for overseeing cybersecurity and privacy risks. At least quarterly, the Board and/or the Audit Committee receives reports on data protection and cybersecurity matters from senior information technology ("IT") leaders, including our Chief Information Officer ("CIO") and CISO, as well as the Chair of our Data Security and Privacy Governance Committee (discussed below). In addition, at least annually, our full Board holds a meeting dedicated to cybersecurity topics. Periodically, our Board receives presentations on cybersecurity matters from third-party cybersecurity experts.


text: Our CISO, who reports to our CIO, joined the Company in 2021 after working with the Company as a third-party consultant since 2019. During a nearly two-decade tenure at a leading professional services firm, he worked with clients on managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs and initiatives addressing emerging cybersecurity threats. Our CISO has significant prior cybersecurity experience, including experience protecting company, customer and associate data across a diverse set of industries. He holds a Bachelor of Science degree in Information Systems and has achieved several relevant certifications, including Certified Information Security Manager, Certified Information Systems Security Professional, and Certified Information Privacy Professional. Our CISO leads a team of over 500 associates focused on cybersecurity.


text: We have three management-level committees that support our cybersecurity, privacy and data governance efforts. They are led by our Data Security and Privacy Governance Committee, which provides management-level governance over cybersecurity matters, including discussion of cybersecurity priorities, emerging risks, awareness and training programs, risk mitigation efforts, and regulatory compliance. This committee is chaired by our Vice President – Internal Audit and Corporate Compliance and is composed of a cross-functional team of senior leaders, including our CEO. The committee generally meets quarterly and is supported by our Security and Technology Risk Leadership Committee and our Privacy and Data Governance Committee. The activities of the Data Security and Privacy Governance Committee are reported to the Audit Committee and/or the full Board by the Chair of the committee, as appropriate.


text: The Security and Technology Risk Leadership Committee provides leadership and oversight of our cybersecurity program. It is chaired by our CISO and composed of Company technology leaders as well as a cross-functional group of representatives from other departments. Our Privacy and Data Governance Committee provides leadership and oversight of our privacy and data governance programs. It is chaired by our Chief Privacy Officer and composed of a cross-functional group across approximately 20 departments. These committees generally meet monthly or every other month and report to the Data Security and Privacy Governance Committee on a regular basis.


text: Cybersecurity Risks. We have not experienced any material cybersecurity incidents in the past fiscal year. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, our cybersecurity risk management processes may not be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Part I, Item 1A. "Risk Factors."


text: Our efforts to create a secure digital environment start with the governance and oversight of our data security and privacy policies and strategy. At the Board of Directors (the "Board") level, cybersecurity is overseen by the Board and by the Board's Audit Committee, which has primary responsibility for overseeing cybersecurity and privacy risks. During fiscal 2024, the Board and/or the Audit Committee received quarterly reports on privacy, data protection and/or cybersecurity matters from senior information technology ("IT") leaders, including our Chief Information Officer ("CIO") and CISO, as well as the Chair of our Data Security and Privacy Governance Committee (discussed below). In addition, our Board held a meeting dedicated to cybersecurity topics. Periodically, our Board receives presentations on cybersecurity matters from third-party cybersecurity experts.


text: We have three management-level committees that support our cybersecurity, privacy and data governance efforts. They are led by our Data Security and Privacy Governance Committee, which provides management-level governance over cybersecurity matters, including discussion of cybersecurity priorities, emerging risks, awareness and training programs, risk mitigation efforts, and regulatory compliance. This committee is chaired by our Vice President – Internal Audit and Corporate Compliance and is composed of a cross-functional team of senior leaders, including our CEO. The committee generally meets quarterly and is supported by our Security and Technology Risk Leadership Committee and our Privacy and Data Governance Committee. The activities of the Data Security and Privacy Governance Committee are reported to the Board or the Audit Committee by the Chair of the committee, as appropriate.


text: Our Cybersecurity Risk Management Strategy includes a myriad of tools and resources that are designed to ensure the integrity of our information systems. We place a particular emphasis on protecting the privacy of our patient data pursuant to the HIPAA Security Rule. Our cybersecurity risk management process is integrated with our larger risk management system and is considered a core function of our overall risk management strategy.

companyName: FONAR CORP

ticker: FONR


text: Our strategy is based around the identification, mitigation, avoidance and response to material cybersecurity risks. We employ physical and electronic safeguards to control access to our systems.


text: We employ additional electronic safeguards to control/limit access to the data contained in those systems. We review and re-assess these processes on a rolling basis with the assistance of both internal staff and outside vendors, including assessors, consultants, auditors, and other third parties. Some steps we take include the use of standard security protocols such as password maintenance, multi-factor identification, and penetration testing. We take other steps as may be situationally appropriate for the specific risk presented.


text: We require all of our employees to receive cybersecurity training as part of their initial onboarding process, and employees are required to complete additional training throughout the year.


text: We evaluate all of our vendors and third-party partners for material cybersecurity risks and take steps to mitigate risk through insurance and contractual risk transfer provisions when appropriate.


text: Our Information Technology department works collaboratively with our third party vendors to coordinate a mutually beneficial approach to cybersecurity in the specific context in which risk is presented. These collaborations sometimes take place on a rolling basis, and sometimes take place on a semi-annual or annual basis.


text: At the present time, risks from cybersecurity threats have not materially affected the Company. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.


text: The audit committee of our Board of Directors provides oversight of cybersecurity risks. It receives regular reports from management, including our General Counsel, on various cybersecurity matters during each board meeting. Such reports include information on current cybersecurity risks facing the organization, cybersecurity incidents involving our partners and/or other participants in our industry, and routine updates on the status of our internal cybersecurity risk management plan.


text: Our General Counsel oversees and manages our cybersecurity program. Our General Counsel acts as the coordinator of our cybersecurity team, which includes representatives from our Information Technology department and Compliance department. In addition, he regularly interacts with various department heads from both our New York and Florida regions regarding the prevention, detection, mitigation and remediation of cybersecurity risks. Our General Counsel has an educational background in computer science and has relevant work experience in cybersecurity insurance and risk management, in addition to his relevant legal experience.


text: The Company has implemented and maintain multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data, and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.

companyName: GENTEX CORP

ticker: GNTX


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cybersecurity insurance. The Company has obtained Trusted Information Security Assessment Exchange (TISAX) certification labels within the United States and Germany.


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services and legal counsel.


text: We have an incident response plan that includes scenario-based playbooks for managing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.


text: For the year ended December 31, 2023, there have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our information technology and cybersecurity experts. In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our VP of Information Technology and Information Security Officer ("VP of IT"), who is supported by other members of management, as necessary. Our VP of IT is responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. The Company also has an IT Executive Steering Committee comprised of the VP of IT, CFO, General Counsel, CTO and VP of Operations. The VP of IT provides regular cybersecurity updates to the audit committee. The Company's VP of IT has served in this role for two years and has more than 24 years of relevant experience. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The VP of IT is responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident.


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of Information Technology and Information Security Officer, General Counsel, CFO and/or Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.


text: The Company has implemented and maintains multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as to safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data, and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training, and cybersecurity insurance. The Company has obtained Trusted Information Security Assessment Exchange (TISAX) certification labels within the United States, Germany, and China. The Company is also continues working on its ISO 27001 certification.


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services, and legal counsel.


text: For the year ended December 31, 2024, there have been no risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: Our Board addresses cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our information technology and cybersecurity experts. In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Vice President of Information Technology and Information Security Officer ("VP of IT"), who is supported by other members of management, as necessary. Our VP of IT is responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. The Company also has an IT Executive Steering Committee comprised of the VP of IT, CFO, General Counsel, Chief Operating Officer and Chief Technology Officer and Vice President of Operations. The VP of IT provides regular cybersecurity updates to the Audit Committee. The Company's VP of IT has served in this role for three years and has more than 25 years of relevant experience. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The VP of IT is responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident.


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of IT, General Counsel, CFO and/or Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.


text: We have implemented a comprehensive cybersecurity risk management strategy to evaluate, detect, and mitigate significant risks posed by cybersecurity threats. The Information Security Risk component of our overall Risk Management Policy outlines our approach to manage processes, people and technology to address and meet the ever-changing challenges in the global IT security landscape. Our program aims to safeguard our systems, data, and operations against cyber threats, maintain business continuity, ensure compliance with relevant privacy and other regulations, and fulfill our commitments to members, customers, suppliers, employees, and other stakeholders.

companyName: CSP INC /MA/

ticker: CSPI


text: Our cybersecurity program is designed to align with and meet the rigorous standards set by industry frameworks such as NIST, SOC 2 Type 2, and other relevant guidelines. By adhering to these frameworks, we ensure that our security measures are robust, comprehensive, and effective in protecting our systems, data, and operations. This commitment not only helps us maintain compliance with regulatory requirements but also demonstrates our dedication to providing a secure environment for our members, customers, suppliers, employees, and other stakeholders.


text: Risk Assessment; Third Party Assessments and Audits An information security Risk Assessment (RA) is conducted annually or following any significant changes to the operating or sensitive data environments to identify vulnerabilities and implement appropriate controls and risk mitigation strategies. These assessments can be conducted on any entity within CSPi or any external entity that has signed a Third-Party Agreement with CSPi, covering information systems, applications, servers, networks, and related processes. The IT Manager, along with the responsible department, oversees the execution, development, and implementation of remediation programs. The RA process involves assembling a team, defining the scope, identifying business and IT owners, conducting interviews, reviewing controls and incidents, developing a threat/risk matrix, and preparing an executive summary with recommendations. The Executive Team reviews and approves the recommendations, and a project is initiated to implement the necessary controls and procedures, which are tested quarterly.


text: Incident Response Planning Our incident response policies and procedures are aligned with applicable laws and state policies. They encompass the identification of roles and responsibilities, investigation, containment and escalation procedures, documentation and preservation of evidence, communication protocols, and lessons learned.


text: We have established robust incident reporting policies and procedures. These include training employees and contractors to recognize and report incidents promptly upon discovery, as well as preparing and submitting follow-up written reports.


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business.


text: A formal process exists through our enterprise risk management matrix developed by the management team of the Company that tracks the Company's material risks, associated mitigation and remediation strategies and direct accountability which is submitted quarterly to the Audit Committee for review and oversight.


text: The management team consists our Vice President and General Manager of the High Performance Products segment, which has developed cybersecuritiy software at the Company that multiple Fortune 500 companies are currently using. In addition, he has been the Chief Technical Officer and served in various roles at several cybersecuritiy companies over his 40 year career. He holds a Bachelor of Science in Business and Engineering as well as a Masters of Science in Finance. Also on the team is the Vice President of Managed services at the Technology Solutions segment, who has over twenty years of technology experience including the monitoring and management of other oganization's security systems.


text: Risk Assessment; Third Party Assessments and Audits An information security Risk Assessment (RA) is conducted annually or following any significant changes to the operating or sensitive data environments to identify vulnerabilities and implement appropriate controls and risk mitigation strategies. These assessments can be conducted on any entity within CSPi or any external entity that has signed a Third-Party Agreement with CSPi, covering information systems, applications, servers, networks, and related processes. The IT Manager, along with the responsible department, oversees the execution, development, and implementation of remediation programs. The RA process involves assembling a team, defining the scope, identifying business and IT owners, conducting interviews, reviewing controls and incidents, developing a threat/risk matrix, and preparing an executive summary with recommendations. The executive team reviews and approves the recommendations, and a project is initiated to implement the necessary controls and procedures, which are tested quarterly.


text: A formal process exists through our enterprise risk management matrix developed by the management team of the Company that tracks the Company's material risks, associated mitigation and remediation strategies and direct accountability which is submitted quarterly to the Audit Committee of the Board of Directors for review and oversight.


text: The management team includes our Vice President and General Manager of the HPP segment, who has developed cybersecurity software at the Company. In addition, he has been the Chief Technical Officer and served in various roles at several cybersecurity companies over his 40 year career. He holds a Bachelor of Science in Business and Engineering as well as a Masters of Science in Finance. Also on the team is the Vice President of Managed Services at the TS segment, who has over twenty years of technology experience including the monitoring and management of other organization's security systems.


text: The Company's information security program is designed with the goal of maintaining the safety and security of our systems and data and we employ a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our board of directors.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and, as discussed below, periodically reports to the Information Technology/Cybersecurity Committee ("IT/Cybersecurity Committee") of our board of directors.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), regulatory guidance, and other industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our CISO and our Chief Information Officer ("CIO"), along with key members of their teams, regularly collaborate with peer banks, industry groups, law enforcement, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. Further, we deploy technical safeguards that are we believe are designed to help protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. The program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the IT/Cybersecurity Committee of our board of directors. Furthermore, our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out internally and by our third-party service providers.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board-approved management committees, as discussed further below, and to the IT/Cybersecurity Committee of our board of directors. The Incident Response Plan is coordinated through the CISO and key members of management are embedded into the plan by its design. This pIan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Lastly, we leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: Our CIO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CIO and CISO have served in their positions since joining the Company in June, 2022 and January, 2022, respectively. Our CIO, who reports directly to the Chief Operating Officer, has 30 years of experience in various technology and security leadership positions across multiple industries including banking, insurance services, utilities, technology service providers, and as a member of the US Air Force. Prior to joining us, our CIO served as a CIO for multiple banks leading both technology and cybersecurity. Our CISO, reporting directly to the CIO, has over 35 years of experience in various technology and security leadership positions across multiple industries including banking, healthcare, automotive, mining, education, engineering, construction, and dairy product production.


text: Our board of directors has approved various management committees including the IT/Cybersecurity Committee, which provides oversight and governance of the technology program and the information security program, as well as oversight and governance of the Company's data and its storage. This committee is chaired by the CIO and includes various employees within the enterprise information security department, including the CIO and CISO, and other key departmental managers from throughout the entire company, including information technology, risk, compliance, operations and human resources/training. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security, data risks and incidents. The committee reports its findings to the management Enterprise Risk Committee. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The CISO reports on key issues, including significant cybersecurity and/or privacy incidents, discussed at management committee meetings and the actions taken in connection with those meetings to the IT/Cybersecurity Committee of the board of directors on a quarterly basis (or more frequently as may be required).


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The IT/Cybersecurity Committee of the board of directors regularly reviews our cybersecurity program with management and reports to the Board of Directors. The IT/Cybersecurity Committee meets at least quarterly (or more frequently as may be required), and receives updates from the CISO on topics with respect to the cybersecurity program. The IT/Cybersecurity Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The management IT/Cybersecurity and Risk Committees each provide reports of their activities to the full board of directors at each board meeting in the event all board members are not present at the relevant board committee meetings.


text: Cybersecurity Incidents In February 2023, we experienced a cyberattack that resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, the consequences of which may be material. See "Item 1A. Risk Factors - We experienced a criminal cyberattack in February 2023, which resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, all of which could damage our reputation or create additional financial and legal exposure." in Item 1A. Risk Factors which is incorporated by reference into this Item 1C.


text: In addition, we have experienced unrelated incidents involving unauthorized access to certain confidential information and systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer's systems and/or emails, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers' private information, including credit card information, financial data, social security numbers or passwords. Some of these incidents have occurred at third-party providers, including third parties who provide us with various systems and/or services. For example, in 2023, one of our third-party vendors experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer. To date, none of these incidences have materially affected or are reasonably likely to materially affect the Company or our financial position or results of operations.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, see "Risks Related to Operations, Technology Systems, Accounting and Internal Controls" in Item 1A. Risk Factors which is incorporated by reference into this Item 1C.


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. Further, we deploy technical safeguards that we believe are designed to help protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. The program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the IT/Cybersecurity Committee of our board of directors. Furthermore, our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out internally and by our third-party service providers.


text: Our board of directors has approved various management committees including the IT/Cybersecurity Committee, which provides oversight and governance of the technology program and the information security program, as well as oversight and governance of the Company's data and its storage. This committee is chaired by the CIO and includes various employees within the enterprise information security department, including the CISO, and other key departmental managers from throughout the entire company, including information technology, risk, compliance, operations and human resources/training. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security, data risks and incidents. The committee reports its findings to the management Enterprise Risk Committee. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The CISO reports on key issues, including significant cybersecurity and/or privacy incidents, discussed at management committee meetings and the actions taken in connection with those meetings to the IT/Cybersecurity Committee of the board of directors on a quarterly basis (or more frequently as may be required).


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The IT/Cybersecurity Committee of the board of directors regularly reviews our cybersecurity program with management and reports to the Board of Directors. The IT/Cybersecurity Committee meets at least quarterly (or more frequently as may be required), and receives updates from the CISO on topics with respect to the cybersecurity program. The IT/Cybersecurity Committee reviews and approves our information security and technology strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The management IT/Cybersecurity and Risk Committees each provide reports of their activities to the full board of directors at each board meeting in the event all board members are not present at the relevant board committee meetings.


text: Through this ongoing engagement with these internal teams and certain third-party service providers, our CIO and our Managing Director of Information Security monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report on cybersecurity incidents. The Company has a notification process in our incident response plan that contains requirements for timely notification to senior management by the CIO and to the Board of Directors by the CEO for incidents that reach established thresholds as well as procedures for external reporting.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: The Company's Managing Director of Information Security has more than 25 years of cybersecurity experience throughout various industries, including the utility sector, and reports directly to the Company's Senior Vice President and CIO. The Senior Vice President and CIO, who has over 30 years of work experience in the information technology field, is responsible for the Company's information technology program and oversees the management and development of all business technology and security for the Company and its subsidiaries. The Senior Vice President and CIO is also responsible for compliance with applicable federal standards and critical infrastructure protection and reports to the Company's President and CEO.


text: Enterprise-wide, proactive cybersecurity risk mitigation is imperative to the Company. The Company's cybersecurity efforts and programs align with the National Institute of Standards and Technology's Cybersecurity Framework and meet or exceed the requirements set forth by the BPU. We also utilize the Cybersecurity Capability Maturity Model, or C2M2, from the U.S. Department of Energy to evaluate and improve our cybersecurity processes and programs for our critical infrastructure.


text: The information set forth under Part I, Item 1A. Risk Factors - Risks Related to Technologies of this Annual Report on Form 10-K is hereby incorporated by reference. As of September 30, 2025, our financial position, results of operations, cash flows or business strategy have not been materially affected by risks from cybersecurity threats. However, the Company cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: Cybersecurity risk oversight is a responsibility of the Board of Directors. The Board of Directors, through the Audit Committee, provides oversight for matters related to the security of information technology systems and procedures, including data privacy and cybersecurity and related risks.


text: The Audit Committee oversees the Company's security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity. Senior leadership, including the Senior Vice President and CIO, updates the Audit Committee and the Board of Directors at least quarterly regarding cybersecurity risks, strategies and policies.


text: The Company's management is responsible for identifying, managing and mitigating cybersecurity risk and communicating cybersecurity risks facing the Company to the Audit Committee and Board of Directors.


text: As part of its cybersecurity risk management program, the Company leverages its cybersecurity organization, led by the Company's Managing Director of Information Security, to design and implement cybersecurity controls and to assess and report on cybersecurity risks. Members of the cybersecurity organization hold relevant degrees or industry-recognized certifications in cybersecurity, with relevant work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. The members of the cybersecurity organization are expected to keep their knowledge, skills and training current by participating in industry events and continuing education programs as applicable.


text: The Company also maintains an internal, cross-functional Cyber Resiliency Committee, which includes members of senior management from Information Technology, Cybersecurity, Enterprise Risk Management, Internal Audit, Corporate Communications, Legal, Finance and Corporate Physical Security. The Managing Director of Information Security chairs this committee, which is responsible for: • establishing cybersecurity policies and standards that align with our corporate objectives and regulatory requirements; • monitoring compliance with cybersecurity policies and standards across the organization; • ensuring that cybersecurity strategies are integrated with the organization's overall governance structure; • reviewing and approving significant cybersecurity investments and initiatives; • providing guidance on cybersecurity risk tolerance levels and ensuring that cybersecurity risks are communicated to the Audit Committee and Board of Directors; and • facilitating cross-departmental collaboration to address cybersecurity challenges and responses.


text: Through ongoing engagement with these internal teams and certain third-party service providers, our CIO and our Managing Director of Information Security monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report on cybersecurity incidents. The Company has a notification process in our incident response plan that contains requirements for timely notification to senior management by the CIO and to the Board of Directors by the CEO for incidents that reach established thresholds as well as procedures for external reporting.


text: The Corporation's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Corporation's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Corporation has appointed a CISO to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. We utilize industry standards that include the NIST Cybersecurity Framework and the Financial Services Sector Cybersecurity Profile. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and forensic testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: The Corporation uses an integrated cybersecurity incident response plan ICIRP designed to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Corporation and with our Board of Directors, notify law enforcement and other government agencies, and notify customers and employees. The ICIRP provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the CIRST. The CIRST facilitates coordination across key stakeholders of the Corporation. The Corporation's CISO and key members of management are members of the ICIRP. The Corporation provides the CISO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Corporation's data for the benefit of our customers, employees and shareholders. We periodically engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Corporation's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives.


text: The Corporation maintains a third-party risk management program designed to identify, analyze and monitor risks, including cybersecurity risks, associated with vendors and outside service providers. Our vendor risk management team collaborates closely with the information security team to ensure third parties meet certain information security control requirements. Our information security team proactively monitors our internal systems and email gateways for phishing email attacks. Remote connections are also assessed and monitored given a portion of our workforce works remotely.


text: Our Board of Directors provides direction and oversight over the Corporation's enterprise-wide risk management program, including risks related to cybersecurity. The Risk Committee is responsible for overseeing the Corporation's information security program and execution. The Risk Committee promotes collaboration and cooperation between various elements within the Corporation relative to information security.


text: Cybersecurity incidents are managed through the ICIRP, which provides direction to management allowing for the timely transfer of information throughout the organization. Our policy requires material incidents to be reported within four business days after an incident is determined to be material with the materiality determination to be completed without unreasonable delay. Management's Disclosure Committee has developed a plan to facilitate making timely determinations as to whether and when incidents should be disclosed. If a material incident occurs, the Corporation will describe in detail the material aspects and nature, scope and timing of the incident, along with the impact to its financial condition and results of operations.


text: To our knowledge, previous cybersecurity incidents have not materially affected the Corporation, its business strategy, financial condition or results of operation. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A. Risk Factors."


text: The Corporation's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with oversight from our Board of Directors, proactively manages the Corporation's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Corporation has appointed a CISO to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. We utilize industry standards that include the NIST Cybersecurity Framework and the Financial Services Sector Cybersecurity Profile. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and forensic testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.


text: The Corporation uses an integrated cybersecurity incident response plan ICIRP designed to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Corporation and with our Board of Directors, notify law enforcement and other government agencies, and notify customers and employees. The ICIRP provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the CIRST. The CIRST facilitates coordination across key stakeholders of the Corporation. The Corporation's CISO and key members of management are members of the ICIRP. The Corporation provides the CISO and the information security team with a comprehensive suite of security tools and techniques to protect the confidentiality, integrity and availability of the Corporation's data for the benefit of our customers, employees and shareholders. We periodically engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities include internal audits, vulnerability assessments and penetration testing. The Corporation's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives.


text: The Company's Board of Directors has oversight of risks from cybersecurity threats. The Board reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. The Board relies on management and its use of the third-party consultants for expertise for assessing and managing the Company's risks from cybersecurity threats. In conjunction with management, the Board considers the nature of the work provided by the Company's operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: MYR GROUP INC.

ticker: MYRG


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Cybersecurity and Information Technology Risks."


text: Cybersecurity remains a top financial services industry risk due to increases in the quantity and sophistication of cyberattacks, which include ransomware, supply chain, and other prevalent attack methods resulting in unauthorized access to systems or sensitive data.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: The Company maintains a formal and comprehensive enterprise-wide Information Security and Cybersecurity Program (the "Information Security Program") that protects the confidentiality, integrity, and availability of the Company's information assets and to manage reasonably foreseeable cybersecurity risks and threats. The Information Security Program includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, compliance to banking regulations, annual audits, and reviews of vendors who handle sensitive information.


text: As a regulated financial institution, the Company must adhere to the security requirements and expectations of the applicable regulatory agencies, which include requirements related to cybersecurity, data privacy, vendor security risk management, systems availability, and business continuity planning, among others. The regulatory agencies have established responsibility guidelines for the Board of Directors and senior management, which include establishing policy, appointing and training personnel, implementing review and testing functions, and ensuring an appropriate frequency of reporting. The Company is examined annually, and its Information Security Program, policies and standards are designed to meet regulatory requirements and industry standards to implement physical, administrative, and technical controls to comply with the Gramm-Leach-Bliley Act ("GLBA"), Sarbanes-Oxley Act ("SOX") of 2002, and industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC").


text: The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Legal Officer, Chief Technology Officer, and Information Security Manager more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.


text: The Company has complex information systems used for a variety of functions by customers, employees, and vendors. In addition, third parties with which the Company does business or that facilitate business activities (e.g., vendors, exchanges, clearing houses, central depositories and financial intermediaries) could also be sources of cybersecurity risk to the Company, including breakdowns or failures of their systems, misconduct by the employees of such parties, or cyberattacks which could affect their ability to deliver a product or service to the Company.


text: Our systems are regularly targeted by attacks aimed at disrupting services, misusing or accessing customer data without authorization, seeking financial extortion, or executing fraudulent activities. To date, no such incidents have significantly impacted the Company's operations or adversely affected our customers, nor have they materially influenced our operational results. Nevertheless, it is important to acknowledge that we cannot guarantee the prevention or detection of sophisticated cyber-attacks. In the event of significant service disruptions, unauthorized access leading to the misuse of customer information, or fraudulent activities affecting our or third-party systems, the Company may face operational, regulatory, legal, and reputational challenges, which could adversely affect our business and financial conditions.


text: The Company's Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company's Information Security Program through ongoing initiatives. The Company's Information Security Program focuses on the following key areas to mitigate cyber risks: i. Risk Assessment – At least annually, a risk assessment is conducted that incorporates security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.