text: Assessments and Risks Associated With Cybersecurity Threats While we have assessed our cybersecurity risk management program periodically in the past, in the second half of 2023, we started to utilize a leading industry cybersecurity framework in our assessments. Specifically, we use this framework to assess our cybersecurity controls against industry best practices in the areas of: identify and protect assets, detect and respond to suspicious activity, as well as recover from cybersecurity incidents. Based on the results of our initial assessment, we have developed a multi-year plan that allows us to focus on the highest priorities. Under the plan, we are required to make additional investments to enhance our processes and practices over a period of time.


text: Additionally, as part of our continuous overall cybersecurity posture assessment, we conduct incident simulations based on recent public cybersecurity incidents, incorporating the tactics, techniques and procedures threat actors have used when targeting organizations. We leverage results from these simulations to take corrective action or otherwise augment our abilities to defend and protect our information systems.

companyName: Compass, Inc.

ticker: COMP

secItem: Item 1C


text: While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, they have not had a material adverse effect on our business, financial condition or results of operations. Our third party services providers have been also subject to a number of cybersecurity threats and incidents but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition or results of operations.


text: Our Information Security team oversees our cybersecurity risk management program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity threats and incidents. Our Information Security team is segmented into six subteams and includes a dedicated Governance, Risk and Compliance subteam that is responsible for risk assessment, risk mitigation strategies, regulatory compliance, audits, internal governance and policy enforcement.


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from security and compliance, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.


text: Our Chief Information Security Officer ("CISO") recently left the Company and we are in the process of recruiting a new, permanent CISO. We have engaged a temporary third-party CISO (sometimes referred to as a "Virtual CISO") to oversee the cybersecurity risk management program and assist the Information Security team. Our Virtual CISO has over 20 years of experience working in the Information Security field, and is a Certified Information Systems Security Professional. Specifically, she has experience managing and administering enterprise infrastructure, network communications, and information security. Our Virtual CISO receives regular reports from the Information Security team and will provide advice to the team with incident responses, execute any remediation plans, assist with drafting policy, and perform industry standard simulations and security assessments. The Virtual CISO reports to our Senior Vice President and Head of Engineering.


text: Our Virtual CISO will report quarterly to the Audit Committee of the Board of Directors ("the "Audit Committee"), which is responsible for overseeing the Company's cybersecurity risk management program and cybersecurity risks. As part of that report, our Virtual CISO is expected to cover topics such as (i) an overview of our overall cybersecurity strategy and posture, (ii) results and recommendations from cybersecurity risk assessments and audits, (iii) vulnerabilities in our information systems, (iv) progress towards pre-determined risk-mitigation goals, (v) identified and potential cybersecurity risks and threats, (vi) cybersecurity incidents of certain impact in accordance with the Company's cybersecurity policies, and (vii) programs related to mitigation of cybersecurity risks and potential threats, among other things. The Audit Committee reports to the full Board of Directors regarding its activities, including reports that it receives from our CISO.


text: Once hired, we expect our permanent CISO to continue strengthening our information security posture, assist with incident response and any remediation plans, and provide quarterly reports to the Audit Committee, as we transition from using a Virtual CISO.


text: Overview of the Cybersecurity Program Compass operates a cybersecurity program designed to identify, assess, and mitigate cybersecurity risks to protect our information assets, ensure business continuity, and maintain stakeholder trust. Guided by industry best practices, including the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and the Center for Internet Security ("CIS") Critical Controls, we focus on continuous improvement to address emerging threats and vulnerabilities. We recognize the evolving nature of cybersecurity threats and regularly enhance our security controls, processes, and policies to adapt to these risks.


text: As part of our cybersecurity program, we undertake various activities and programs, including, but not limited to: detective, preventative, corrective, and technical controls; identity and access management systems; periodic risk assessments, including penetration testing; periodic end-user training and simulations; incident response; vulnerability management; infrastructure and application security; corporate security; and policies for the handling of personally identifiable information and other restricted data.


text: We closely monitor privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans that provide for the response, containment, eradication, reporting, and disclosure of security incidents. We also carry customary cybersecurity risk insurance and have a retainer in place for third-party incident response and forensics resources.


text: Cybersecurity is an ongoing priority, and we have developed and implemented a cybersecurity risk management program designed to identify, assess, prioritize, and mitigate cybersecurity risks to ensure our compliance with applicable privacy and cybersecurity laws.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program and is a crucial component of our risk assessment process. For instance, we report on, review, and consider the results and findings from external and internal security and privacy assessments as part of our risk program. Additionally, we analyze how cybersecurity risks interact with operational, financial, compliance, and reputational risks.


text: When appropriate, we also engage third-party service providers to evaluate, test, or assist with specific elements of our cybersecurity risk management program. For instance, we utilize external assessors, including security researchers and penetration testers, to identify and report vulnerabilities in our information systems.


text: Further, our cybersecurity risk management program includes a third-party risk management program to assess and manage cybersecurity risks associated with our use of third-party services providers that have access to our information systems and/or employee, agent or agent client confidential information. For example, we perform certain due diligence before engaging third-party service providers and consider potential cybersecurity risks and exposures in our choice among providers. We also generally require our third-party service providers that could potentially introduce cybersecurity risks to our information systems or sensitive consumer personal information to contractually agree to maintain a cybersecurity risk management program aimed at mitigating those risks and be subject to external cybersecurity audits.


text: Cybersecurity Risks Associated With Cybersecurity Threats While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, as of the date of this Annual Report, they have not had a material adverse effect on our business, financial condition or results of operations. Our third-party service providers have also been subject to a number of cybersecurity threats and incidents, but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition, or results of operations.


text: Please refer to the "Risk Factors" section of this Annual Report for additional information related to the cybersecurity risks that could potentially impact our business.


text: Our Information Security team oversees our cybersecurity program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk management program, our security controls, and our response to cybersecurity threats, and incidents.


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering, Chief Information Security Officer ("CISO") and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from information security, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.


text: In 2024, we hired a new Chief Information Security Officer to oversee the cybersecurity program and lead the Information Security team. Our CISO has over 17 years of experience building security teams and driving security initiatives for public, high-growth, and regulated companies. He is a Certified Information Systems Security Professional and reports to our Senior Vice President and Head of Engineering.


text: Our CISO reports quarterly to the Audit Committee of our board of directors (the "Audit Committee"), which is responsible for overseeing the Company's cybersecurity risk management program and cybersecurity risks. As part of that report, our CISO covers topics such as (i) an overview of our overall cybersecurity strategy and posture, (ii) results and recommendations from cybersecurity risk assessments and audits, (iii) vulnerabilities in our information systems, (iv) progress towards pre-determined risk-mitigation goals, (v) identified and potential cybersecurity risks and threats, (vi) cybersecurity incidents of certain impact in accordance with the Company's cybersecurity policies, and (vii) programs related to mitigation of cybersecurity risks and potential threats, among other things. The Audit Committee reports to the full board of directors regarding its activities, including reports that it receives from our CISO.


text: We have established a cybersecurity risk management process that aims to identify, assess, mitigate, monitor, and report on the IT risks and cybersecurity threats that may affect our business objectives, performance, reputation, and compliance. We conduct an overall annual cybersecurity risk assessment to identify and prioritize the IT risks that may impact our business strategy, results of operations, and financial condition. We have processes and controls that help prevent, detect, and recover from security incidents and we also perform regular security assessments to test the resilience of our IT systems and networks against potential attacks and vulnerabilities. Our employees are provided awareness training on a regular basis to help them identify, avoid, mitigate, and report cybersecurity threats.

companyName: CONSTELLIUM SE

ticker: CSTM


text: We use security assessments, penetration testing, and table-top or red teaming exercises with third parties to assess our security posture and to continuously improve our processes. We also use our Internal Audit function to conduct additional reviews and assessments. Our third-party service providers are subject to security risk assessments at the time of onboarding, on a continuous basis and upon detection of an increase in risk profile. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and to investigate security incidents that have impacted such providers, as appropriate.


text: Our Chief Information Officer/Chief Digital Officer ("CIO/CDO"), together with the Company's security team, is responsible for assessing, monitoring, and managing our cybersecurity risks. Our CIO/CDO has significant experience in IT security, information security, and cybersecurity having served in a variety of senior roles at the Company prior to serving as CIO/CDO. Our CIO/CDO also has experience with implementing various security and infrastructure transformation and improvement programs.


text: The Company has an Enterprise Risk Management ("ERM") Committee and process in place that reviews and evaluates the overall risks to the Company, including its cybersecurity risks. The ERM process has the input of senior management and other internal stakeholders, and the cybersecurity risk management process is incorporated into our ERM review. Cybersecurity risks to the Company are reviewed, evaluated, and discussed on a quarterly basis and, when necessary, on an ad-hoc basis with our Executive Committee and other members of the management team.


text: We maintain controls and procedures that are designed to ensure prompt review and escalation of certain cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner to comply with cybersecurity incident reporting requirements.


text: Our Board, in coordination with the Audit Committee, oversees the management of the Company's cybersecurity program and risks from cybersecurity threats. Our Audit Committee receives annual reports on cybersecurity risks resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The CIO/CDO also informs the Audit Committee on the prevention, detection, mitigation, and remediation of cybersecurity incidents, including significant security risks and information security vulnerabilities. The Audit committee reports any significant matters to the Board.


text: We rely on our IT systems to effectively manage and operate our business, including such processes as data collection, accounting, financial reporting, communications, supply chain, order entry and fulfillment, other business processes, and in operating our equipment. A cybersecurity incident could disrupt our business and could result in transaction errors, processing inefficiencies, limited equipment utilization, the loss of sales, customers, or intellectual property, causing our business and financial results to suffer. Although such risks have not materially affected our business, financial conditions, results of operations or reputation to date, we have, from time-to-time experienced cybersecurity incidents in the normal course of business. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors".


text: As an energy transition, renewable energy and investment management company that acquires, constructs and operates renewable energy and energy efficient projects, as well as finances the construction and/or operation of these and other sustainable development projects and businesses and provides through GCM investment management services to funds within the sustainable infrastructure and renewable energy industry, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: Greenbacker Renewable Energy Co LLC


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed to align with internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed to ensure the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is periodically informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors and incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.


text: We monitor and respond to a range of cyber threats, including threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.


text: Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Refer to Part I —Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations," for additional discussion about cybersecurity-related risks.


text: Our Board of Directors and certain members of our senior management team have specific oversight responsibilities with respect to cybersecurity risk.


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures, and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sector. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.


text: How Senior Management is Informed of and Monitors Incidents Certain members of our senior management team are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is under the direction of our VP of Technology (in coordination with certain members of our senior management team), who receives reports from our information technology team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Certain members of our senior management team are notified as appropriate when the information technology team identifies an emerging risk or material issue.


text: Reporting to our Board of Directors Given the importance of information security and privacy to our stakeholders, our Board of Directors receives an annual presentation from our senior management team discussing our program for managing information security risks, including cyber and data security risks. Our senior management team receives regular reports on our cybersecurity readiness, our risk profile status, our cybersecurity program, material cybersecurity risks and mitigation strategies, third-party assessments of our cybersecurity program and other cybersecurity developments. Our senior management team reports to the Board of Directors and the Audit Committee on such topics, as needed, and at regularly scheduled meetings of the Board of Directors and Audit Committee as part of the business, legal and regulatory update portions of such meetings.


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed with consideration of internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed for the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors, and it incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates, where appropriate, to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.


text: We monitor and respond to a range of cyber threats, including any threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management, and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization designed to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such as systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sectors. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.


text: Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to continually improve.

companyName: Snap Inc

ticker: SNAP


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and notification provisions, and ongoing monitoring of vendors, as appropriate.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants.


text: The material cybersecurity threats identified through these processes are managed by our CISO and, where appropriate, our risk and compliance committee, in consultation with management. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO on a quarterly basis to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee are also notified in the event of a material cybersecurity incident.


text: Our CISO, Jim Higgins, has over 30 years of experience in the technology sector, including senior leadership roles in product security, information security engineering, and cloud enterprise. Mr. Higgins assisted the Linux Foundation in starting the Open Source Security Foundation to help increase awareness and promote technical solutions to address validation of Open Source software. Mr. Higgins has worked in information security at Chevron, Eastman Kodak, and Google, and, mostly recently, spent two years as the CISO of Block, Inc. (formerly Square).


text: Our CISO also regularly meets with our CEO and other members of our management team (or their designees), including our General Counsel, Chief Financial Officer, Chief Communications Officer, and Senior Vice President of Engineering, including as part of the cybersecurity incident response process.


text: Our CISO, and where necessary our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. We maintain internal aliases, which employees may use to identify a cybersecurity or privacy threat or incident, for escalation, investigation, containment, and remediation. A report to the alias triggers our Security Incident Response Policy and associated plans, which has defined roles for our cross-functional incident response team. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.


text: Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to improve.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our controls. We conduct penetration testing or other application security testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and incident notification provisions, and ongoing monitoring of vendors, as appropriate. We also conduct employee training on data protection, including cybersecurity, among other topics.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants. The material cybersecurity threats identified through these processes are managed by our CISO and are escalated to senior management and our risk and compliance committee, in each case where appropriate. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO periodically to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee will be notified in the event of certain cybersecurity incidents.


text: Our CISO also regularly meets with our CEO and other senior management, including as part of the cybersecurity incident response process.


text: Our CISO, and where appropriate our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of identified cybersecurity incidents, through our security incident response process. We maintain internal and external channels and signals to receive reports of cybersecurity or privacy threats or incidents. A reported incident triggers our Security Incident Response Policy or associated plans, which has defined roles for our cross-functional incident response team to investigate, contain, eradicate, and remediate the incident. The incident response team assesses the severity and priority of reported incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.


text: Mr. Higgins recently announced his intention to depart our company effective February 21, 2025 and, as a result, Eric Young, our Senior Vice President of Engineering, will act as our interim CISO while we conduct a search for a permanent replacement. Mr. Young has more than 25 years of experience working in the technology industry across a diverse range of business sectors and since June 2023 has overseen Mr. Higgins and our engineering security team, which comprises personnel with a broad range of experience in cybersecurity, information technology, and risk management. During Mr. Young's tenure at Snap, Mr. Young has been involved in our approach in assessing, identifying, and managing security incidents.


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management system through reporting of cyber risks to Technology and Information Security Oversight Committee, Operational Risk Committee, Enterprise Risk Committee, and Board Risk Oversight Committee. Risk Appetite statements are approved by the Board Risk Oversight Committee and the Board, and Key Risk Indicators are monitored on an ongoing basis by the Information Security team, and the Operational Risk and Enterprise Risk Committees. The Company performs regular Information Security focused Risk Assessments at the entity level, including but not limited to assessments based on the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (FFIEC CAT) and Ransomware Self-Assessment Tool (R-SAT), and National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: Independent Bank Group, Inc.


text: Engagement of Third Parties Information Security leverages third parties for cyber security services including but not limited to managed security services, external penetration testing, and tabletop exercises.


text: Oversight and Identification of Risks Associated with Third Parties Information Security, in coordination with Third Party Risk Management, reviews new vendors at onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to any third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and review of SOC reports. New technology projects are subject to a Security Architecture Review completed by Information Security. Information Security coordinates with Contract Management to perform contract reviews for security controls and notification processes. Information Security conducts annual IT Risk Assessments on Tier 1 applications, defined as those vendors of critical importance to the Company's core operations.


text: Risks from Cybersecurity Threats In the last fiscal year, we have not experienced any material cybersecurity incidents. For a full discussion of cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, result of operations, or financial condition, see Item 1A. Risk Factors.


text: Our Board Risk Oversight Committee is charged with overseeing the Company's management of credit, market, liquidity, operational (including information technology and cybersecurity), compliance, reputational and strategic risks, including the annual approval and recommendation to the Board of Directors of the Company's risk appetite statement and approval of the Company's risk management framework.


text: Risks from cybersecurity threats are monitored on an ongoing basis by the Information Security team, engaging the Cyber Incident Response Team, Cyber Crisis Team, the Core Team, and Extended Core Team, as needed, and escalated to the extent that incidents rise to the level of notification to the relevant risk or board committee or on an ad hoc basis.


text: Additionally, quarterly cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.


text: Management and Assessment of Risk The Enterprise Risk Sub-Committee (ERC) (a management committee) assists executive management and the Board of Directors with providing oversight of the Bank's enterprise risk management program.


text: The ERC and Board Risk Oversight Committee work together to facilitate effective risk management and timely escalation of substantive issues, including Operational Risk (which includes information technology and cybersecurity).


text: The Chief Information Security Officer (CISO), reporting to the Chief Risk Officer, is responsible for information security and cybersecurity risk management. The CISO has over 20 years of experience in cybersecurity in Financial Services and is a Certified Information Systems Security Professional (CISSP) and holds a SysAdmin, Audit, Network and Security Global Information Assurance Certification (SANS GCIA).


text: Incident and Risk Escalation Through Cyber Incident Response Plan Information Security maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains a Cyber Incident Response Plan (CIRP) that covers response and remediation processes for managing cybersecurity incidents. The CIRP outlines the cross-functional responsibilities for the Cyber Crisis Team, the Core Team and Extended Core Team during a notification incident. The Core Team consists of the Chief Information Security Officer, Chief Legal Officer, Chief Information Officer, and Director Operational Risk Management to manage the incident. The Extended Core Team consists of other business area leaders who may need to be engaged based on the area of impact. All CIRP incidents are managed through an Incident Commander with communications being escalated to executive leadership as needed, who will then report to the Board. Key Performance Indicators and Key Risk Indicators related to monitoring and detection are presented to Technology and Information Security and Operational Risk Management Committees.


text: Incident and Risk Escalation to Board The Board Risk Oversight Committee oversees the ERC and works directly with the ERC to facilitate effective risk management and timely escalation of substantive issues from ERC and ERC's sub-committees, including Operational Risk (which includes information technology and cybersecurity). Quarterly, cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.


text: As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated cybersecurity risk leaders at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, multi-factor authentication, encryption, endpoint detection and response, email and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.

companyName: NEWS CORP

ticker: NWSA


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including a maturity assessment of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.


text: The Company's processes for identifying, assessing and managing cybersecurity risk are integrated into the Company's overall risk management process. The Company's internal audit group monitors the Company's risk profile and conducts regular enterprise-wide integrated risk assessments, with input from corporate and business unit management and personnel, to identify and assist the Board of Directors and senior executives in managing key existing and emerging risks for the Company and its businesses, including cybersecurity risk. The risk assessment process culminates in semi-annual reports to the Audit Committee and the Board of Directors. In addition to its own systems and technology, the Company relies on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. The Company has policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance, cybersecurity, privacy and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. The Company and its business units have developed, and seek to incorporate, standard contractual security requirements into their service provider agreements. The Company also performs cybersecurity assessments of third-party service providers where it deems appropriate given the nature of the engagement and the data and systems expected to be accessed.


text: Although the Company dedicates significant resources and efforts to protect against cybersecurity risks, the Company has experienced, and expects to continue to be subject to, cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the Company continues to face cybersecurity risks such as those described in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future. While the Company maintains cyber risk insurance, such insurance may not be sufficient to cover all losses from cybersecurity incidents.


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on NIST maturity assessments, employee training and technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO has been in his senior leadership role since 2020. He has held similar positions prior to joining News Corp, has over 30 years of experience in various cybersecurity and information technology infrastructure and risk management roles and holds an advanced degree in information systems. The Company's CISO has been in his senior leadership role since 2021 and has over two decades of industry experience in cybersecurity and other technology-related roles, including as the Director of Cyber and Telecom Policy in the White House, where he advised senior administration officials on cybersecurity, technology and telecommunications policy issues. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee, or the Board of Directors, as appropriate.


text: As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated business information security officers at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including an evaluation of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on the cybersecurity program and initiatives, employee training, technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO assumed his position in June 2025 after serving in various leadership and technology roles at the Company's subsidiary News Corp Australia since 2012, including as CTO from 2020. He has extensive experience in information technology infrastructure and risk management, digital media and the management of digital networks. The Company's CISO has been in his position since December 2024 after serving in various leadership and information security roles at the Company since 2021. He has over two decades of industry experience in cybersecurity, information governance and risk management at large media and technology companies. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee or the Board of Directors, as appropriate.


text: Our cybersecurity risk management program is managed by our Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Holding Co LLC


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology Cyber Security Framework, which establishes five areas of focus: identify, protect, detect, respond and recover. Our cybersecurity risk management program is designed to manage industry-specific threats, as well as threats arising from the overall evolving cybersecurity landscape and consists of two principal areas of focus: (i) enterprise systems, which consists of all business systems used in our daily operations and (ii) operational technology, which consists of all process control, supervisory control and data acquisition systems. Key elements of our cybersecurity management program include: • identifying, monitoring and mitigating the cybersecurity risks to our systems, assets, data and capabilities; • a critical response process for cybersecurity incidents, including the process for detection, investigation, containment and remediation of any such incidents; • establishment of disaster recovery plans; • testing, at least bi-annually, of select critical systems for disaster recovery and periodic walk-throughs of procedures for disaster recovery; • identity access policies that aim to identify and monitor for potential cyber intrusions; • periodic security tests, including monthly internal vulnerability scans, weekly external vulnerability scans, monthly phishing campaigns and recurring penetration testing by third-party cybersecurity firms; • table-top exercises, at least quarterly, for incident response preparedness for the Cybersecurity team and Information Technology department; and • annual drills for potential threats on various aspects of our technology assets based on the then-existing IT threat landscape for our industry. Pursuant to our incident response plan, the Cybersecurity team has defined roles in responding to all cybersecurity incidents to provide an efficient and organized approach to handling cybersecurity threats, with the CIO receiving all reports and status updates regarding cybersecurity threats. The incident response plan provides a documented framework for when and how the CIO informs and updates our Board, the executive officers and other internal parties and when external parties are notified or consulted about a cybersecurity threat and the status thereof.


text: We also utilize third-party cybersecurity vendors to assist us with various aspects of our cybersecurity risk management program. For example, in order to support our cybersecurity incident response procedures, we have retained several third-party cybersecurity firms to monitor the IT threat landscape for our industry. As part of our efforts to manage the risk of cybersecurity threats associated with the use of third parties, we monitor and evaluate the cybersecurity risk profiles of third-party technology providers and consider such risk profiles when selecting third-party technology providers. Any third-party service provider that is granted access to our network is required to comply with our policies regarding information technology and cybersecurity. We also engage several third-party cybersecurity firms to perform independent assessments of the effectiveness of our cybersecurity risk management program and assist us in the continued review of our cybersecurity risk management program in order to reflect the evolving landscape of cybersecurity.


text: To date, there have been no significant risks from cybersecurity threats, including as a result of any significant cybersecurity breaches or attacks that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Our CIO has 30 years of experience in highly regulated industries managing information security in complex, matrixed environments, seven of which are in his current role with the Company. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: The CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.


text: Our cybersecurity risk management program is managed by our current Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.


text: To date, there have been no significant threats, including as a result of any significant cybersecurity breaches or attacks, that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Our CIO assumed his position effective June 1, 2024, following the retirement of his predecessor. He previously served as the head of our Cybersecurity team. Our CIO has 28 years of experience in highly regulated industries managing information security in complex, matrixed environments. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: Our CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: We recognize the critical importance of maintaining the trust and confidence of our business partners, such as CROs, clinical trial investigators, patients, employees, subcontractors and other vendors. We are committed to protecting the confidentiality, integrity and availability of our business operations and systems, and its board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an essential element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Effect of Risk We face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks, phishing, and other security incidents, including perpetration by hackers and unintentional damage or disruption to hardware and software systems, loss of data, phony invoices, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we, together with our contracted third-party cybersecurity advisors, maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring of internal and external threats to ensure the confidentiality and integrity of its information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by management.


text: We, with assistance from our contracted third-party cybersecurity advisors, identifies, protects, and responds to our cybersecurity risks and incidents, through the following activities: • monitoring emerging data protection laws and implementing changes to processes that are designed to comply with such laws; • requiring employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employing technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, double verification software, and access controls; • performing backups of local hard drives and our financial systems in the cloud and on physical media that are stored off-site in locked locations; • providing mandatory training for our employees regarding cybersecurity threats; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our selection and oversight of third-party service providers, including our suppliers and manufacturers or those who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks in specified ways.


text: We do not have any in-house servers or systems. An integral part of our cybersecurity is the security built into this third-party software operated by large corporations such as Microsoft. Our control system, therefore, includes the review of annual Service Organization Controls reports in order to annually assess the controls of these software systems. To date, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for the board of directors and management. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks.


text: Our board of directors provides direct oversight over cybersecurity risk and receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer with the assistance of contracted third-party cybersecurity advisors. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including incident response processes.


text: We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners to conduct key operations across our enterprise.

companyName: Keenova Therapeutics plc


text: We have worked to develop our cybersecurity program to protect the confidentiality, integrity, and availability of systems and data. We have implemented administrative, technical, and physical safeguards that we believe are appropriate to the size and complexity of our business and the nature and scope of our activities. We evolve our cyber defenses to help minimize impacts from cyber threats to safeguard our assets and data.


text: Our program includes a number of safeguards. These safeguards include processes for endpoint security (such as anti-malware and endpoint detection and response tools), network security (such as firewalls, intrusion detection systems, and filtering), and vulnerability management (such as vulnerability scans and patch management). Applicable personnel are provided cybersecurity awareness training and receive periodic awareness through ad hoc communications on security topics, including how to report suspicious activity or potential incidents. However, vulnerabilities or threats identified through our cybersecurity program may take time to remediate or mitigate.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including thorough questionnaires and additional documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.


text: To assess, identify, and manage potential cybersecurity threats, our Security Operations Center ("SOC") team works in conjunction with a third-party managed security service provider to monitor systems and threats, including those on systems managed by third-parties, such as cloud platforms.


text: In the event of a potential or actual cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Incident Response Plan ("IRP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident or disruption. The IRP is tested using tabletop exercises.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a team that includes our Chief Information Security Officer ("CISO"), who reports to our VP of Information Systems. The CISO is supported by a SOC team, an Incident Response Manager, a Governance Risk and Compliance Manager, and cybersecurity architects. These individuals and groups are responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure our cybersecurity program functions effectively in the face of evolving cybersecurity threats. The individuals involved generally have significant experience in cybersecurity and related information technology, including responding to incidents and developing security policies, with our three most senior leaders having an average of 25 years of experience in cybersecurity. In addition to the day-to-day management of these risks, we hold a monthly meeting of an Information Risk Committee, which is comprised of representatives from our legal, human resources, compliance, and information technology departments. On a quarterly basis, we also hold a meeting of our Executive IT Steering Committee, which is comprised of members of the executive leadership, so that they can receive regular briefings on cybersecurity matters, including threats, events, and program enhancements.


text: Our full Board of Directors provides oversight for our cybersecurity program. At least annually, the CISO and the VP of Information Technology report to the Board of Directors on information technology, cybersecurity and information security-related matters, including relevant business activities, key risks and mitigation efforts, prior incidents, results of assessments and monitoring, and the potential impact on the Company's business.


text: Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.


text: As of December 29, 2023, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition in the last three years. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including the use of questionnaires and obtaining additional security documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.


text: We recognize the potential risks associated with the deployment and use of AI systems. We provide training for employees on AI use cases, opportunities, and risk management practices.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats To assess, identify, and manage potential cybersecurity threats, our Security Operations Center ("SOC") team works in conjunction with a third-party managed security service provider to monitor systems and threats, including those on systems managed by third-parties, such as cloud platforms.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a team that includes our Chief Information Security Officer ("CISO"), who reports to our Vice President ("VP") of Information Systems. The CISO is supported by a SOC team, an Incident Response Manager, a Governance Risk and Compliance Manager, and cybersecurity architects. These individuals and groups are responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure our cybersecurity program functions effectively in the face of evolving cybersecurity threats. The individuals involved generally have significant experience in cybersecurity and related information technology, including responding to incidents and developing security policies, with our three most senior leaders having an average of 25 years of experience in cybersecurity. In addition to the day-to-day management of these risks, we hold a monthly meeting of an Information Risk Committee, which is comprised of representatives from our legal, human resources, compliance, and information technology departments. On a quarterly basis, we also hold a meeting of our Executive Information Technology ("IT") Steering Committee, which is comprised of members of the executive leadership, so that they can receive regular briefings on cybersecurity matters, including threats, events, and program enhancements.


text: Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity, including AI. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.


text: As of December 27, 2024, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition for the past year. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: Our Cybersecurity Program includes the following processes: • Quarterly control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Testing and audits of our IT-related internal controls over financial reporting, excluding cybersecurity controls, by our internal auditors; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.


text: Through our incident response plan, we have designated a cybersecurity management committee, or the Cybersecurity Management Committee, composed of our executive officers and management representatives. Led by Our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Committee is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Committee for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018, and has more than 25 years of experience in various roles involving managing information security, technology infrastructure and IT operations.


text: Our Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to both the Board and the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). In addition, quarterly reports to the Audit Committee include our internal auditor's reviews of our information security programs and controls. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Committee) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial conditions. See "Risk Factors – General Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" in Part I, Item 1A of this Annual Report on Form 10-K for a discussion of these risks. To date, we have not experienced a material cybersecurity incident.


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, into our broader risk management structure to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.


text: Our Cybersecurity Program includes the following processes: • Annual control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Collaborating with our internal audit team to evaluate the effectiveness of our information technology security program and communicating results to our executive officers; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.


text: Through our incident response plan, we have designated a cybersecurity management team, or the Cybersecurity Management Team, composed of our executive officers and management representatives. Led by our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Team is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Team for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018. In this role, he manages and oversees the Company's network and information systems. Additionally, he works with the executive officers, management representatives and third-party experts to maintain the Company's Cybersecurity Program. Our Vice President of Information Technology & Corporate Facilities possesses extensive experience in technology and cybersecurity gained over his career spanning more than 25 years, including service as the executive director of Business Applications as well as a senior implementer and business consultant.


text: The Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). Our quarterly updates to the Audit Committee include a discussion of our information security programs and controls, including our internal auditor's review and our internal monitoring of cybersecurity risks. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Team) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, customer data, and the personal information of our employees (collectively, "Information Systems and Data").

companyName: PagerDuty, Inc.

ticker: PD