text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (H-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.


text: Our cybersecurity protection strategy incorporates a Vulnerability Management process and solution to assist in the identification of potential vulnerabilities in our systems. If vulnerabilities are identified, we utilize a follow-on process to remediate such vulnerabilities. A third-party software-as-a-service (SaaS) provider conducts code scanning and vulnerability assessments of our external-facing websites. Furthermore, multiple cybersecurity controls exist on and around our servers and end-user systems to prevent unauthorized system and data access and data leakage. Additionally, third-party vendors conduct yearly penetration tests to search for risks to our systems utilizing techniques commonly used by bad actors.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS

secItem: Item 1C


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover the network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our CIO and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.


text: Controls assessments are completed annually with respect to any remediation activities that have been identified and completed as part of the cybersecurity program. Avanos engages third-party vendors to conduct assessments and deliver their recommendations for improvement annually. Where appropriate, third-party vendors also assist with remediation projects.


text: We have a third-party risk management program. Prior to engaging third-party service providers, we conduct a cybersecurity risk assessment and utilize a third-party exchange service to gather security posture ratings across all of the third party's IT security, compliance and data privacy domains.


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to affect us, including our business strategy, results of operation or financial condition.


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2023, our Audit Committee met four times.


text: Our CIO (who has 14 years of cybersecurity experience) and our Associate Director of Global Cybersecurity (who has 25 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.


text: Avanos has implemented a comprehensive cybersecurity program to identify, assess and manage material risks from cybersecurity threats. In addition, we have instituted executive management and board oversight of the risks arising from cybersecurity threats. Cybersecurity Risk Management and Strategy.


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Director of Global IT Security and Compliance.


text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (Health-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover our network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our Vice President, Chief Information Officer (the "CIO") and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2024, our Audit Committee met four times.


text: Our CIO (who has 15 years of cybersecurity experience), our Director of Global IT Security and Compliance (who has 11 years of cybersecurity experience and 25 years in IT), and our Associate Director of Global Cyberseurity (who has 26 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. We recognize the significance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity, and availability of our data.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We have designed our cybersecurity risk management program and strategy to protect the confidentiality, integrity, and availability of our critical information technology systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, through which we identify, assess, prioritize, and mitigate risks across the Company to support the achievement of our strategic objectives.


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Information Officer ("CIO") leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.


text: We utilize ISO 27001 to identify, assess and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.


text: Third Party Engagements for Risk Management We engage a range of external experts, including cybersecurity consultants and auditors to support, evaluate and test our cybersecurity risk management systems. We engage a managed security service provider ("MSSP") that provides continuous threat intelligence by monitoring our network and connected devices to detect attacks and indicators of potential attacks.


text: Our collaboration with other third parties includes regular audits of our ISO 27001 compliance, penetration testing, threat assessments, and consultation on security enhancements. These partnerships provide expert knowledge and insights which are designed to ensure our cybersecurity strategies and processes are appropriate.


text: The Board's Role The Board is responsible for overseeing overall risk management for the Company, including annual or more frequent review and approval of the Enterprise Risk Management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated certain responsibilities for oversight of the Company's cybersecurity and information security framework, data protection, cybersecurity, and risk management to the Audit Committee of the Board. Our Board recognizes that cybersecurity protection is vital to maintaining our operations, and the trust of our business and supply chain partners, and of our Share Owners.


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, two regular Board meetings each year and each Audit Committee meeting include additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CIO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: The Company's Chief Information Officer has formal education in information technology and extensive experience over 20 years working in and leading information systems and technology functions. Our Chief Information Officer receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CIO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CIO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with us in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CIO and CIRT about the same.


text: Risks from Cybersecurity Threats As part of our overall risk mitigation strategy, we maintain insurance coverage for certain aspects of cybersecurity risks; however, such insurance may not be sufficient either in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks, and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item 1A - Risk Factors - "Our business may be harmed due to failure to successfully implement information technology solutions or a lack of reasonable safeguards to maintain data security, including adherence to data privacy laws and physical security measures."


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Legal and Administrative Officer leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.


text: We utilize ISO 27001 to identify, assess, and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, at two meetings each year, management includes additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.


text: Our cybersecurity risk management program is led by our Chief Legal and Administrative Officer (CL&AO), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CL&AO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: The Company's CL&AO has formal education in information technology and computer science, and extensive experience over 30 years leading information systems and network security functions, centered on technology-intensive telecommunication companies and electronics manufacturers. Our CL&AO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CL&AO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CL&AO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts, and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with our KESC, CIRT, and senior members of our information technology department in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CL&AO and CIRT about the same.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates from time to time from our management as appropriate on cybersecurity.

companyName: Pangaea Logistics Solutions Ltd.

ticker: PANL


text: Our Chief Financial Officer and our Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Global IT Director has 20 years of experience in the design, implementation, and support of information technology infrastructures.


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.


text: We utilize industry standard software packages such as RSA and Cisco Firepower to secure our networks. We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, we perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity training for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. F or additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.


text: Strategy for Handling Sensitive Data is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI


text: Over the ordinary course of our business, Arvana and its third-party service providers, such as charter booking services, collect, maintain, and transmit sensitive data including proprietary or confidential business information (such as operational data and personal information). The secure maintenance of this information is critical to our business and reputation.


text: Despite our efforts to implement robust security measures, in reliance on administrative, technical, and physical safeguards, our risk management strategies, and practices for protecting sensitive data are subject to certain limitations. A variety of factors give rise to these limitations including the evolving nature of cyber threats, resource constraints, and the inherent risks associated with the technologies we and third-party service providers employ. Arvana relies on third parties, including cloud vendors and consultants, for various business functions.


text: Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the operation of our business. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk.


text: Arvana's current risk management strategy may not fully account for or mitigate the risks posed by emerging technologies or the potential impact of these limitations on our business. Financial liabilities, damage to our reputation, and erosion of customer trust could negatively affect our business operations and financial condition.


text: We have adopted a cybersecurity governance structure to identify, assess, and manage material risks from cybersecurity threats that include a framework to respond to and assess internal and external threats to the security, confidentiality, and integrity of Arvana's data and information systems. Under which framework management is responsible for assessing and managing material risks that arise from cybersecurity threats. We have not engaged third-party qualified contractors or claim any management expertise from which to draw in the event of cybersecurity threats.


text: When identified by management, cybersecurity threats are to be immediately reported to Arvana's Audit Committee. The Audit Committee has primary responsibility for oversight of cybersecurity threats once a cybersecurity threat has been reported to it by management. Matters to be considered by the Audit Committee include management risks relating to data privacy, technology, and information security.


text: The Audit Committee must also consider Arvana's cyber security measures and the back-up of information systems, along with what steps Arvana has taken to monitor and control cybersecurity exposure. Further, the Audit Committee is tasked with the responsibility for conferring with management and Arvana's auditors as to the adequacy and effectiveness of information safeguards, cybersecurity policies, and internal controls that impact information security. The Audit Committee will be briefed on any material cybersecurity incidents that might adversely affect our business at least once each year, such brief will include topics such as risk assessment, risk management, control decisions, service provider arrangements, security incidents, responses with recommendations for changes or updates to policies and procedures.


text: Arvana has not experienced cybersecurity incidents in the past, it cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors.


text: A cybersecurity incident could materially affect our business, results of operations, financial condition, and reputation, in addition to potentially subjecting us to government investigations, litigation, fines or damages.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Weave Communications, Inc.

ticker: WEAV


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our Audit Committee and Board of Directors.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not to date been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see the section titled "Risk Factors" set forth in Part I, Item 1A of this Annual Report on Form 10-K.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security, who has over twenty years of cybersecurity experience across multiple industries. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our A udit Committee and Board of Directors.


text: We rely on information systems to communicate, control and manage our operations, prepare our financial and reporting information, analyze and store data and communicate internally and with third parties, including our service providers and customers. Our cybersecurity program focuses on ensuring the protection of our information systems, computer networks, infrastructure, and industrial control systems.

companyName: California Resources Corp

ticker: CRC


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Information Officer on cybersecurity risks at its regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee.


text: We take a risk-based approach to assess, identify, and manage cybersecurity risks, including evaluating the likelihood of a cybersecurity incident as well as the impact it would have on our business, reputation, assets, health and safety of individuals and the environment. Our controls are based on the NIST Cybersecurity Framework (CSF). The effectiveness of our controls are evaluated periodically to determine residual risk levels and guide ongoing program improvement and cybersecurity project work. Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements.


text: In accordance with our cybersecurity incident response plan, the severity of cybersecurity incidents is classified based on the degree of adverse impact on our business, scale of penetration, risk of propagation, significance of impact, impact on protected information, and our monitoring capability. Incident response is overseen by a cybersecurity incident response team steering committee comprised of members of management with the responsibility to inform senior management and/or the Audit Committee based on incident severity classification.


text: Our Chief Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team steering committee. Our Chief Information Officer has over 34 years of experience in information technology and cybersecurity, including leadership roles responsible for cybersecurity and data privacy for large publicly-traded and global companies. He graduated from Bellevue University with an M.S. in Computer Information Systems and an MBA.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We rely on information systems, computer networks and digital technologies to operate our business, including managing our operations, protecting sensitive data, communicating internally and externally, and preparing financial and operational information. Our cybersecurity program is designed to protect these critical systems and data while supporting business operations and growth objectives.


text: We maintain a comprehensive, risk-based approach to assess, identify and manage material risks from cybersecurity threats. Our controls are based on the NIST Cybersecurity Framework (CSF). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework and include: (i) regular assessment and monitoring of internal and external cybersecurity threats, (ii) evaluation of potential impacts on business operations, financial performance and stakeholder interests, (iii) periodic evaluation of control effectiveness to determine residual risk levels and guide program improvements, and (iv) integration of cybersecurity considerations into business strategy and technology decisions.


text: Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements. We regularly evaluate and adjust these processes based on changes in the threat landscape and business environment.


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Digital Information Officer on cybersecurity risks at regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee. We maintain a dedicated cybersecurity team responsible for program implementation and operational security activities.


text: Our Chief Digital Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team. Our Chief Digital Information Officer has over 27 years of experience in information technology, including leadership roles responsible for cybersecurity and data privacy. He graduated from California State University, Bakersfield with a Bachelor of Science degree in Computer Science.


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. As such, we have implemented an information security program, which includes cybersecurity risk management measures intended to prevent, detect, and respond to malicious cyber activities and other security incidents that could adversely affect the confidentiality, integrity, or availability of our, or our customers' information or information systems.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Our information security program is designed based on the National Institute of Standards and Technology ("NIST") 800-53 framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST framework as a guide in designing and implementing our information security program.


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.


text: Our information security program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs. The Audit Committee oversees management's implementation of our information security program and receives periodic reports from management on our material cybersecurity risks. Additionally, management updates the Audit Committee, as necessary, regarding material cybersecurity incidents. The full Board receives quarterly updates from management on our information security program.


text: Our information security program is principally managed by our information security team, which is led by our Information Security Officer. Our Information Security Officer reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Information Security Officer. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.


text: Our information security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.


text: Key elements of our information security program include but are not limited to the following: (i) risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including oversight of management's implementation of our information security program. The Audit Committee receives quarterly reports from our Chief Technology Officer on our information security program, including any material cybersecurity risks. Additionally, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our information security program is principally managed by our information security team, which is led by our Senior Director, Information Services and Security. Our Senior Director of Information Services and Security reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Senior Director of Information Services and Security. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations.


text: Our information security team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: GoDaddy maintains an enterprise-wide cybersecurity program designed to manage risks to the company's information systems from cybersecurity threats and cybersecurity incidents.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our board of directors (the Board) is committed to managing data privacy and cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee is responsible for overseeing and reviewing with management GoDaddy's cybersecurity matters. The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding the state of the company's cybersecurity risk management program, the company's current material cybersecurity risks, and general cybersecurity-related risks. The Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. In addition, the company's CISO and Chief Technology Officer (CTO) provide the full Board with written quarterly and annual reports on the state of the company's cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.


text: Management of Cybersecurity Risk GoDaddy management is responsible for identifying, assessing, and managing the company's material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures and maintaining the company's cybersecurity programs.


text: GoDaddy's CISO has primary responsibility for overseeing the company's programs for identifying, assessing, and managing the company's cybersecurity risks. The CISO reports directly to the company's CTO and also regularly provides reports and updates to the company's CEO on significant cybersecurity-related matters relevant to the company's cybersecurity risk. The company's CISO has more than 18 years' experience in cybersecurity, networking, and related technologies. The company's CTO has more than 25 years' experience in network security and other related technologies. The company's CEO has more than 27 years' experience in ecommerce technology, engineering, and other related areas.


text: The CISO, CTO, and CEO work together to assess and manage cybersecurity-related risks. The CISO is responsible for day-to-day operations working with an enterprise-wide cybersecurity team that provides 24/7/365 support. The CISO regularly confers with the CTO and CEO on cybersecurity matters, including providing notice of cybersecurity threats and incidents, including those that have the potential to have material effects. The CISO also provides written monthly and quarterly reports on the state of the company's cybersecurity program and cybersecurity risks to the CTO, CEO, and other key executives. As noted above, the CISO and CTO also provide regular reports to the Audit Committee and the Board.


text: The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO. The company's information security department performs functions that include but are not limited to general security operations, event monitoring, incident response, vulnerability management, policy and procedure development, security compliance, product development support, product security readiness testing, third-party vendor security assessments, and penetration testing. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization and the company's privacy, legal, third-party risk management, and corporate audit services teams. The company also has developed processes to integrate cybersecurity risk management within the company's product and software development processes.


text: In addition, product teams and business unit leaders are involved in cybersecurity risk management during product development with support from our enterprise-wide security team supervised by the CISO.


text: Third-Party Consultants and Auditors GoDaddy maintains industry certifications for some of the services we provide, including certifications relating to our GoDaddy Registrar, Registry, Domains, and Commerce businesses. We use third-party auditors and consultants in connection with obtaining and maintaining our certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.


text: We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. In particular, we host a substantial portion of our IT infrastructure and data on services maintained by Amazon Web Services. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following depending on the scope and nature of the engagement: • incorporating provisions in vendor contracts that require third parties meet certain minimum cybersecurity standards based on the nature of the product or service provided; • installing monitoring software and other tools to detect malicious software and activities in systems operated by third parties; • maintaining processes for monitoring for and applying updates and patches to third-party hardware and software to address vulnerabilities; and • performing security and data privacy assessments before engaging new vendors or acquiring new hardware and software.


text: We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. We apply similar controls to third-party providers of cybersecurity services that we apply to other IT hardware, software, and services described above. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity Threat Monitoring and Incident Response GoDaddy monitors for threats to our information systems on an ongoing basis through a combination of automated intrusion detection monitoring solutions, review of log data, and other related activities. We also require security training for all GoDaddy personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents that are not captured through our monitoring solutions. We also provide mechanisms for interested third parties, including security researchers and law enforcement to provide us notice of potential cybersecurity threats.


text: Potential and actual cybersecurity incidents primarily are handled by our internal incident response team, which is supervised by our CISO. Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts. Depending on the severity and scope of the incident, we may also engage external consultants. Security personnel and consultants retained by our service providers may also be involved in cases where our vendors experience a cybersecurity incident. In the event of a potentially material cybersecurity incident, we have defined processes for escalating the incident for determination of whether the incident is material and requires filing of a notification on Form 8-K or other notification required under applicable laws and regulations.


text: Board and Audit and Finance Committee Governance Our board of directors (the Board) manages cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding our company's cybersecurity risk management program and cybersecurity-related risks. The Audit Committee consists of Board members with diverse expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. Our CISO provides the full Board with written quarterly and annual reports on our cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.


text: Management of Cybersecurity Risk Our senior management is responsible for identifying, assessing, and managing the company's material cybersecurity risks. Our CISO oversees our programs for identifying, assessing, and managing our cybersecurity risks. Our CISO reports to our Chief Operating Officer (COO) and regularly provides updates to our CEO on significant cybersecurity-related matters. Our CISO also provides written monthly and quarterly reports on our cybersecurity program and risks to the CEO, Chief Technology Officer, and other key executives. Our CISO has more than 19 years' experience in cybersecurity, networking, and related technologies. Our CEO has more than 28 years' experience in e-commerce technology, engineering, and other related areas.


text: Our CISO works with an enterprise-wide cybersecurity team that provides 24/7/365 support. Our cybersecurity policies, procedures, and strategies primarily are implemented by our information security department. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to our technology organization and our privacy, legal, vendor risk management, and corporate audit services teams. We have also developed processes to integrate cybersecurity risk management within the company's product and software development processes. In addition, product teams and business unit leaders are involved in product-related cybersecurity risk management.


text: Third-Party Consultants and Auditors We use uses third-party auditors and consultants in connection with obtaining and maintaining industry certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.


text: Third-Party Cybersecurity Risk Management We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following: • including provisions in vendor contracts that set minimum cybersecurity requirements; • installing monitoring software to detect malicious software and activities in third party systems; • monitoring for and applying patches to third-party hardware and software to address vulnerabilities; and • performing security assessments before engaging new vendors or acquiring new hardware and software.


text: Despite our efforts, our control over and ability to monitor the security of third parties is limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by third parties. Additionally, any contractual protections with such third parties may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity Threat Monitoring and Incident Response We monitor for threats to our information systems through a combination of automated intrusion detection monitoring solutions, review of log data, and other activities. We require security training for all company personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents. We also provide mechanisms for interested third parties, including security researchers and law enforcement, to provide notice of potential cybersecurity threats. In addition, we monitor third-party sources for notice of cybersecurity incidents that may affect company vendors and other parties with whom we do business.


text: Potential and actual cybersecurity incidents are primarily handled by our internal incident response team, which is supervised by our CISO. Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts. Depending on the severity and scope of the incident, we also may engage external consultants. Security personnel and consultants retained by our service providers also may be involved in cases where our vendors experience a cybersecurity incident. We have processes for escalating an incident to determine whether it is material and requires notification required under applicable laws, rules and regulations.


text: We recognize the importance of maintaining the trust and confidence of its customers, clients, business partners and employees. Cybersecurity represents an important component of our overall approach to risk management. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials, employees and contractors, or Information Systems and Data.

companyName: Cidara Therapeutics, Inc.


text: The Incident Response Team, or the IRT, is a functional and collaborative team consisting of the Chief Legal and Operating Officer, Chief Financial and Business Officer, Senior Vice President, People and Culture, and Director, Information Technology, or IT. The IRT, together with the wider IT, Legal, and Finance teams, as well as external cybersecurity consultants, help identify, assess, and manage our cybersecurity threats and risks.


text: The Director, IT plays a pivotal role in our cybersecurity framework, actively identifying and assessing risks from cybersecurity threats. This is achieved through a variety of methods, including but not limited to, extensive audits, detailed assessments, and the engagement of outside cybersecurity consultants. In addition to these existing strategies, we have implemented several processes to increase our ability to identify, monitor, and assess material cybersecurity threats.


text: We subscribe to specialized reports and services that identify emerging cybersecurity threats, thereby keeping our defenses informed and up-to-date. The IT department systematically analyzes such reports of threats and actors, providing us with a deeper understanding of potential risks. We also conduct regular scans of the threat environment, providing real-time insights into the security landscape.


text: Evaluating our own and our industry's risk profile is an ongoing process, allowing us to continually tailor our cybersecurity measures to specific needs and vulnerabilities. We also coordinate with law enforcement agencies concerning threats, so that our approach benefits from broader insights and intelligence.


text: Conducting detailed threat assessments for both internal and external threats form a crucial part of our security strategy. Additionally, we leverage external intelligence feeds, integrating diverse sources of information to strengthen our overall cybersecurity posture. These concerted efforts are designed to achieve a comprehensive, dynamic, and proactive approach to managing and mitigating cybersecurity risks.


text: Our approach to cybersecurity is tailored to suit the specific environment in which we operate. We implement and maintain an array of technical, physical, and organizational measures, processes, standards, and policies, designed to manage and mitigate material risks arising from cybersecurity threats to our Information Systems and Data. This includes a comprehensive strategy featuring a dedicated cybersecurity staff and a regularly tested IT Security Incident Response Plan. Regular risk assessments, tabletop exercises, threat modeling, and vulnerability testing form the backbone of our technical measures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This is exemplified in the way our IT Security Incident Response Plan forms an integral part of the broader risk management framework, so that cybersecurity risks are visible and treated as strategic business risks.


text: Detailing the integration of cyber risk into our risk management, cybersecurity risk is addressed as a crucial component of our enterprise risk management program. The IT department works in close collaboration with executive management to prioritize risk management processes, with a particular focus on mitigating cybersecurity threats that could have a significant impact on our business. Furthermore, team members from the IT department or a relevant executive committee evaluate material risks from cybersecurity threats in alignment with our overall business objectives. These evaluations are then communicated to the audit committee of the board of directors. The audit committee assesses these risks as part of our overall enterprise risk, ensuring that cybersecurity is given due consideration in line with our strategic goals and governance framework.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example assessors, cybersecurity consultants, auditors, and outside legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, vulnerability scans related to the vendor, and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. CIDARA THERAPEUTICS, INC.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' and the IRT are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the Director, IT, Chief Legal and Operating Officer, and Chief Financial and Business Officer. The Chief Legal and Operating Officer and Chief Financial and Business Officer are responsible for providing information on materiality to the Director, IT and producing documentation of known and unknown facts about a cybersecurity incident and factors considered in the materiality assessment. Our Chief Legal and Operating Officer and Chief Financial and Business Officer hold degrees relevant to their areas of expertise and both have over 20 years of experience in their respective fields. The Director, IT is primarily responsible for assessing and managing material risks from cybersecurity threats; they have 23 years of experience in core infrastructure, data infrastructure and analytics, business platforms, and integrations.


text: The Director, IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Director, IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our IT Security Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the IRT. The IRT works with the IT department and external cybersecurity experts to help us mitigate and remediate cybersecurity incidents. In addition, our IT Security Incident Response Plan includes reporting to the board of directors for certain cybersecurity incidents.


text: The audit committee receives quarterly updates from the IRT concerning our cybersecurity threats and risk and the processes we have implemented to address them. On an annual basis the board of directors receives a report from the IRT highlighting any significant cybersecurity threats.


text: We recognize the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Cybersecurity represents an important component of our overall approach to risk management. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials, employees and contractors, or Information Systems and Data.


text: The Incident Response Team, or the IRT, is a functional and collaborative team consisting of the Chief Legal and Operating Officer, Chief Financial and Business Officer, Senior Vice President, People and Culture, and Director, Information Technology, or IT. The IRT, together with the wider IT, Legal, and Finance teams, as well as external cybersecurity consultants, help identify, assess, and manage our cybersecurity threats and risks.


text: The Director, IT plays a pivotal role in our cybersecurity framework, actively identifying and assessing risks from cybersecurity threats. This is achieved through a variety of methods, including but not limited to, extensive audits, detailed assessments, and the engagement of outside cybersecurity consultants. In addition to these existing strategies, we have implemented several processes to increase our ability to identify, monitor, and assess material cybersecurity threats.


text: We subscribe to specialized reports and services that identify emerging cybersecurity threats, thereby keeping our defenses informed and up-to-date. The IT department systematically analyzes such reports of threats and actors, providing us with a deeper understanding of potential risks. We also conduct regular scans of the threat environment, providing real-time insights into the security landscape.


text: Evaluating our own and our industry's risk profile is an ongoing process, allowing us to continually tailor our cybersecurity measures to specific needs and vulnerabilities. We also coordinate with law enforcement agencies concerning threats, so that our approach benefits from broader insights and intelligence.


text: Conducting detailed threat assessments for both internal and external threats form a crucial part of our security strategy. Additionally, we leverage external intelligence feeds, integrating diverse sources of information to strengthen our overall cybersecurity posture. These concerted efforts are designed to achieve a comprehensive, dynamic, and proactive approach to managing and mitigating cybersecurity risks.


text: Our approach to cybersecurity is tailored to suit the specific environment in which we operate. We implement and maintain an array of technical, physical, and organizational measures, processes, standards, and policies, designed to manage and mitigate material risks arising from cybersecurity threats to our Information Systems and Data. This includes a comprehensive strategy featuring a dedicated cybersecurity staff and a regularly tested IT Security Incident Response Plan. Regular risk assessments, tabletop exercises, threat modeling, and vulnerability testing form the backbone of our technical measures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This is exemplified in the way our IT Security Incident Response Plan forms an integral part of the broader risk management framework, so that cybersecurity risks are visible and treated as strategic business risks.


text: Detailing the integration of cyber risk into our risk management, cybersecurity risk is addressed as a crucial component of our enterprise risk management program. The IT department works in close collaboration with executive management to prioritize risk management processes, with a particular focus on mitigating cybersecurity threats that could have a significant impact on our business. Furthermore, team members from the IT department or a relevant executive committee evaluate material risks from cybersecurity threats in alignment with our overall business objectives. These evaluations are then communicated to the audit committee of the board of directors. The audit committee assesses these risks as part of our overall enterprise risk, ensuring that cybersecurity is given due consideration in line with our strategic goals and governance framework.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example assessors, cybersecurity consultants, auditors, and outside legal counsel. CIDARA THERAPEUTICS, INC.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, vulnerability scans related to the vendor, and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' and the IRT are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the Director, IT, Chief Legal and Operating Officer, and Chief Financial and Business Officer. The Chief Legal and Operating Officer and Chief Financial and Business Officer are responsible for providing information on materiality to the Director, IT and producing documentation of known and unknown facts about a cybersecurity incident and factors considered in the materiality assessment. Our Chief Legal and Operating Officer and Chief Financial and Business Officer hold degrees relevant to their areas of expertise and both have over 20 years of experience in their respective fields. The Director, IT is primarily responsible for assessing and managing material risks from cybersecurity threats; they have 23 years of experience in core infrastructure, data infrastructure and analytics, business platforms, and integrations.


text: The Director, IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Director, IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our IT Security Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the IRT. The IRT works with the IT department and external cybersecurity experts to help us mitigate and remediate cybersecurity incidents. In addition, our IT Security Incident Response Plan includes reporting to the board of directors for certain cybersecurity incidents.


text: The audit committee receives quarterly updates from the IRT concerning our cybersecurity threats and risk and the processes we have implemented to address them. On an annual basis the board of directors receives a report from the IRT highlighting any significant cybersecurity threats.


text: Cybersecurity is an integral part of the Board of Trustees', Audit Committee's and Corporate Governance and Nominating Committee's risk analysis and discussions with management. In February 2023, the Board of Trustees assigned cybersecurity oversight responsibility to the Corporate Governance and Nominating Committee via an amendment to the Committee's Charter. We also have a Cyber Steering Committee which works in conjunction with the Computer Incident Response Team ("CIRT") to develop strategies to mitigate risks and to address any cyber issues that may arise. The Cyber Steering Committee and CIRT are made up of certain executives, management, members of our information technology team and third-party advisors. The committees are led by our SVP, Chief Information Officer.

companyName: Urban Edge Properties

ticker: UE


text: Our policies outline processes for identifying, reporting, investigating, and responding to a cyber incident. In the event of such an incident, the CIRT coordinator will work with the Cyber Steering Committee to conduct a risk analysis. The committee may also engage other members of management to assess the tangible, intangible and financial impact of the incident. Any breach or cyber incident that meets certain criteria will be communicated by the Cyber Steering Committee to the Corporate Governance and Nominating Committee in a timely manner.


text: The SVP, Chief Information Officer researches the latest technologies and trends used by cybercriminals through publications, conferences and discussions with peers. Cyber threats identified are communicated to all members of the Company via email to promote awareness and assist with protecting us from potential risks or breaches. All employees are required to undergo quarterly security awareness trainings and we routinely conduct internal phishing and other exercises to gauge the effectiveness of the trainings and assess the need for continued education and/or areas where improvement may be needed.


text: As we see increased reliance on information technology in the workplace and our business operations, and an ongoing shift to remote and hybrid work schedules, Urban Edge has employed several measures to mitigate cyber risks. The Cyber Steering Committee is responsible for the risk management program which includes, but is not limited to, identifying cyber risks, the risk severity, risk response and tracking risk remediation. The Cyber Steering Committee meets (i) at least quarterly to review emerging threats, controls, and procedures, (ii) at least annually with the Corporate Governance and Nominating Committee to discuss trends in cyber risks and our strategy to defend our information against cybersecurity incidents, and (iii) promptly following the occurrence of a material cyber incident. In addition to a dedicated information technology and cybersecurity team monitoring our daily operations, the Company engages an independent third-party cybersecurity audit firm to periodically review cybersecurity risks and our Incident Response Program. The third-party firm evaluates our preparedness based on several factors including cyber risk assessment, vulnerability management, disaster recovery, and penetration testing. They also simulate attacks on the Company as part of their audit procedures to gauge if our incident response is repeatable and effective and provide recommendations for areas of improvement. We are in process of implementing a thorough vendor selection criteria and employing ongoing monitoring of our third-party service providers to ensure compliance with cybersecurity standards.


text: We utilize a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework, and Microsoft best practices. Our policies and procedures are reviewed and updated annually by the Cyber Steering Committee and incorporate third-party assessments to benchmark ourselves against industry standards. The Company utilizes advanced endpoint protection, firewalls, intrusion detection and prevention, threat intelligence, security event logging and correlation, and backup and redundancy systems.


text: We have formal policies and procedures addressing data retention, incident response, asset and device management and have a Disaster Recovery and Business Continuity Committee that meets biannually to review and update our plan, policies, and procedures to align with changes in risk assessment and emerging technologies. In addition, our Information Technology team conducts disaster recovery tests annually and reports results to the Cyber Steering Committee. A cybersecurity breach may result in disruption of our operations, damage to our reputation and cause us to lose revenue or incur significant expenses to remediate which could have a material adverse effect on our results of operations or consolidated financial position.


text: As of the date of this report, we have not experienced any material cyber breaches and are periodically reviewing our policies and procedures to respond to, and mitigate the impact of, emerging trends and technologies affecting our industry.


text: Additionally, as a public company, we are subject to the Sarbanes-Oxley Act requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting. These audits, which are conducted by our independent public accounting firm, assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of systems and data. Any control deficiencies that represent cybersecurity risks, as well as any recommended changes to our processes, if appropriate, would be reported to senior management and the Board.


text: Cybersecurity is an integral part of the Board of Trustees', Audit Committee's and Corporate Governance and Nominating Committee's risk analysis and discussions with management. The Board of Trustees has assigned cybersecurity oversight responsibility to the Corporate Governance and Nominating Committee as outlined in the Committee's Charter, which is publicly available on the Company's website. We also have a Cyber Steering Committee which works in conjunction with the Computer Incident Response Team ("CIRT") to develop strategies to mitigate risks and to address any cyber issues that may arise. The Cyber Steering Committee and CIRT are made up of certain executives, management, members of our information technology team and third-party advisors. The committees are led by our SVP, Chief Information Officer.


text: The SVP, Chief Information Officer researches the latest technologies and trends used by cybercriminals through publications, conferences and discussions with peers. Cyber threats identified are communicated to all members of the Company via email to promote awareness and assist with protecting us from potential risks or breaches. All employees are required to undergo regular security awareness trainings and we routinely conduct internal phishing and other exercises to gauge the effectiveness of the trainings and assess the need for continued education and/or areas where improvement may be needed.


text: As we see increased reliance on information technology in the workplace and our business operations, and more companies offering hybrid work schedules, Urban Edge has employed several measures to mitigate cyber risks. The Cyber Steering Committee is responsible for the risk management program which includes, but is not limited to, identifying cyber risks, the risk severity, risk response, and tracking risk remediation. The Cyber Steering Committee meets (i) at least quarterly to review emerging threats, controls, and procedures, (ii) at least annually with the Corporate Governance and Nominating Committee to discuss trends in cyber risks and our strategy to defend our information against cybersecurity incidents, and (iii) promptly following the occurrence of a material cyber incident. In addition to a dedicated information technology and cybersecurity team monitoring our daily operations, the Company engages an independent third-party cybersecurity audit firm to periodically review cybersecurity risks and our Incident Response Program. The third-party firm evaluates our preparedness based on several factors including cyber risk assessment, vulnerability management, disaster recovery, and penetration testing. They also simulate attacks on the Company as part of their audit procedures to gauge if our incident response is repeatable and effective and provide recommendations for areas of improvement. Our vendor management program requires that critical and/or significant third-party service providers furnish information about their cyber policies to ensure compliance with cybersecurity standards.