text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a certified Information Security Manager from the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC

secItem: Item 1C


text: Entergy's CISO is responsible for enterprise strategic and operational cybersecurity, physical security systems, and regulatory compliance. The CISO oversees investments in tools, resources, and processes that allow for the continuous improvement and maturity of Entergy's cybersecurity posture. The CISO has expertise spanning more than 25 years in the realm of information technology, information security, and cyber/physical security management. The CISO's background includes serving as the Vice President and Chief Information Security Officer for an electric utility with responsibility for enterprise cybersecurity covering corporate, electric, nuclear, and gas operations. Additionally, the CISO served as the Chief Security Officer for the Electric Reliability Council of Texas with overall responsibility for its cybersecurity, physical security, and emergency management programs. Her previous experience includes multiple technical, managerial, and strategic roles within industries ranging from energy, telecommunication, software development, and cybersecurity consulting. The CISO is a Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information Systems Control.


text: Part I Item 1A, 1B, and 1C Entergy Corporation, Utility operating companies, and System Energy In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.


text: Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Information Officer (CIO) is responsible for ensuring that Entergy's information technology infrastructure is secure and reliable. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.


text: Entergy and the Registrant Subsidiaries maintain access-management controls, including a layered multi-factor authentication process for network and system access, and a defense-in-depth security ecosystem that includes advanced threat detection from independent third parties and federal agencies, security logging and monitoring, and independent third-party penetration and vulnerability assessments. Relevant employees and contractors must complete cybersecurity trainings periodically to heighten security and threat awareness, promote best practices, and meet regulatory requirements. Additional multi-layered prevention and detection processes and technologies to mitigate and minimize the effects of cybersecurity risks include email security, continuous monitoring, vulnerability scanning, anti-virus and anti-malware software, backups and recovery strategy, network segregation, third-party security, and information protection.


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident,


text: Part I Item 1A, 1B, and 1C including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from certain third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat-intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.


text: While Entergy and the Registrant Subsidiaries have experienced cybersecurity incidents, except as otherwise summarized above or discussed elsewhere in this report, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected them including their business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors" in Part I, Item 1A for a detailed description of the risks related to cybersecurity.


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the CSO, the CISO, the CIO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.


text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO and CIO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in


text: Part I Item 1A, 1B, and 1C the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a member of the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.


text: Entergy's CIO is responsible for ensuring that the organization's information technology systems, infrastructure, and applications are designed, implemented, and maintained to provide secure and reliable performance in support of Entergy's business objectives. The CIO establishes and enforces IT policies, procedures, and controls to mitigate information technology policies, procedures, and controls to mitigate information technology-related risks and provides guidance and support to the business units in the effective use of information technology resources and the management of information technology-related risks. By fulfilling these responsibilities across the three lines of defense model, the CIO plays a critical role in ensuring that Entergy's information technology-related risks are effectively identified, managed, and mitigated, thereby supporting Entergy's overall risk management and governance framework. The CIO's background includes serving in senior leadership roles, including CIO for multiple global manufacturing companies, serving on the board of directors for a telecommunications company, and consulting leadership positions providing services for numerous large, global organizations.


text: In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.


text: Risk Management and Strategy Managing Material Risks & Integrated Overall Risk Management We assess, identify, and manage our cybersecurity risks by employing several processes, including conducting employee training, monitoring and testing our networks and systems, responding to vulnerability and threat assessments, and maintaining and refreshing backup and protective systems. Cybersecurity risk management is also a component of our overall Enterprise Risk Management ("ERM") program. Both the cybersecurity risk management component of the ERM program and associated risk management plans, including risk mitigation, are reviewed at regular intervals and updated as needed. Related reporting to management occurs on a routine basis, and the Board of Directors is updated through an established cadence via the Board's Audit Committee and the full Board.

companyName: MSA Safety Inc

ticker: MSA


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity tabletop exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.


text: Engage Third-parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.


text: Oversee Third-party Risk We are aware of risks associated with third-party service providers, and the Company employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Company sensitive information, systems, or networks. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Company information assets and reducing the overall risk of cyber threats. The Company's assessments begin during the onboarding of third parties and may continue throughout the relationship, based upon an assessment of third-party risk. Those assessments also include Company audit rights, third-party notification obligations, and security requirements for the retention of Company data. The Company maintains a team consisting of employees, contractors and consultants to oversee this process.


text: Risks from Cybersecurity Threats From time to time, we have experienced attempts by unauthorized parties to access or disrupt our information technology systems. To date, we have not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of our information systems or a cybersecurity breach could materially and adversely affect our business, results of operations and financial condition. See Item 1A, "Risks related to Cybersecurity or Misappropriation of Our Critical Information."


text: The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. On an established cadence, the Audit Committee and the Board of Directors are briefed by the Chief Information Security Officer ("CISO") on the status and progress of the cybersecurity program, as well as on direct or emerging threats to the Company, program maturity and strategy, and third-party risk management. Additionally, the Board of Directors receives ERM program briefings that include cybersecurity risks.


text: Management's Role Managing Risk Company management is directly involved in assessing and managing risks from cybersecurity threats. The Company employs a CISO with substantial program management experience, along with a team of cybersecurity and IT professionals. The CISO reports directly to the Senior Vice President and Chief Product and Technology Officer, who is a member of the Company's Executive Leadership Team. Additionally, the CISO reports regularly on the cybersecurity program, including risks and mitigation, to the Cybersecurity Executive Steering Body. The Cybersecurity Executive Steering Body provides strategic oversight and is responsible for guiding and aligning organizational efforts to manage risks associated with cybersecurity threats. It is intended to ensure comprehensive risk management, effective policy development, and coordinated response measures to safeguard sensitive information and technology assets.


text: The Cybersecurity Executive Steering Body includes members of the Executive Leadership Team, among other senior managers, including cross-functional representation from Cybersecurity, Product and Technology, Law, Finance, and Operations departments. Collectively, the Cybersecurity Executive Steering Body has decades of enterprise risk management experience, including cybersecurity risk management.


text: Monitor Cybersecurity Incidents The Company's cybersecurity incident response plan provides a structured approach to prevent, detect, manage and mitigate a cybersecurity incident. Primary goals are to minimize harm to information technology systems and Company information, reduce recovery time, and ensure the continuity of operations. Internal resources manage and execute the Company's cybersecurity incident response plan with the support of retained external advisors. Plan testing and assessments occur to provide for the ongoing effectiveness against evolving threats. Pursuant to the plan, communication channels and escalation protocols are also maintained to engage and inform internal stakeholders – such as the Cybersecurity Executive Steering Body, corporate crisis management team, and other members of the Executive Leadership Team – of how incidents are prevented, detected, mitigated, and remediated.


text: The Company's measures to prevent and detect cyber security incidents include continuous monitoring of Company networks by a security operations team that includes a third-party managed security operations center. Employees throughout the Company are trained to report cybersecurity threats as they are identified. If an incident or suspected incident is reported, the cybersecurity team evaluates it for various factors, including severity and immediacy, pursuant to the Company's cybersecurity incident response plan.


text: Reporting to Board of Directors The CISO regularly informs the Cybersecurity Executive Steering Body of cybersecurity risks and incidents. Accordingly, the highest levels of management are informed of the cybersecurity position and risks, and significant cybersecurity matters are elevated to the Audit Committee of the Board of Directors.


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.


text: Engage Third Parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.


text: Oversee Third-Party Risk We are aware of risks associated with third-party service providers, and the Company employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Company sensitive information, systems, or networks. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Company information assets and reducing the overall risk of cyber threats. The Company's assessments begin during the onboarding of third parties and may continue throughout the relationship, based upon an assessment of third-party risk. Those assessments also include Company audit rights, third-party notification obligations, and security requirements for the retention of Company data. The Company maintains a team consisting of employees, contractors and consultants to oversee this process.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, ALLETE invests significantly in the cybersecurity elements outlined above. In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002.

companyName: ALLETE INC

ticker: ALE


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.


text: The ALLETE board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.


text: ALLETE's Chief Technology Officer (CTO) has primary responsibility for the development and oversight of ALLETE's cybersecurity team and the development and maintenance of the company's related cybersecurity policies and procedures. The CTO has over 25 years' experience working in the information and operational technology field and is a registered professional engineer in the State of Minnesota. The company's cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of ALLETE to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified ALLETE's critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess ALLETE's cybersecurity program and help the cybersecurity team to strengthen the organization's monitoring, alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third-party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of ALLETE's applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although we believe such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.


text: We are committed to protecting the confidentiality, integrity, and availability of our information assets and managing cybersecurity risks effectively. Our cybersecurity strategy focuses on proactive risk management, continuous improvement, collaboration and partnerships, and investment in security technologies.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: We face various cybersecurity risks, including unauthorized access, information leakage, malware and viruses, technical disruption, and insider threats. Identifying, assessing, and managing these risks is the foundation of our comprehensive cybersecurity framework and is integrated into our overall risk management systems and processes. We have implemented strong access controls, regular security assessments, vulnerability management, user education and awareness, monitoring, threat intelligence (including user behavior analytics), and managed detection and response to mitigate cybersecurity risks.


text: Our implementation of strong access controls includes multi-factor authentication, least privilege access, role-based access control, and network segmentation to ensure information assets are protected from unauthorized access and/or exposure.


text: We conduct regular security assessments to identify vulnerabilities, test compliance, proactively address security risks that would impact the organization, and prioritize those risks based on their likelihood and potential impact. The associated activities include performing risk, vulnerability, penetration, and compliance assessments to assist in identifying potential internal and external threats and weaknesses in our systems, networks, and applications and performing simulations to test and improve our incident response plans while building resiliency. In addition to the controls and assessments noted above, we regularly engage with our internal and external auditors and third-party cybersecurity consultants to assess our cybersecurity program, ensuring adherence to applicable industry standards, practices, and laws.


text: Our cybersecurity program also includes third-party risk management evaluation and monitoring of our suppliers, vendors, and other business partners to help identify and mitigate risks that may impact our company. We evaluate existing risks, threats, and prior cybersecurity incidents of new vendors, suppliers, and business partners using various risk assessments.


text: Cybersecurity governance is a critical component of our organization's overall risk management framework and an area of focus for our Board and management. Our Board has delegated primary responsibility for overseeing risks from cybersecurity threats to the Audit Committee. The Audit Committee oversees information technology and cybersecurity, including strategies, risk identification and mitigation, and data privacy protection ("Information Security").


text: The Company's Chief Information Officer has been serving in this role for the company for 17 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.


text: The Company's Chief Information Officer has been serving in this role for the company for 18 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Risks from Cybersecurity Threats Any risks from previous cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company's business, financial condition, or results of operations. Such risks and incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. The Company also has cyber event related insurance.


text: Employee Cybersecurity Training The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.


text: Oversee Third-party Risk The Company has implemented a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Physical Security The Company safeguards assets through a standard physical security design process, including access controls, surveillance and monitoring, perimeter security controls, data center security, and incident response and reporting controls.


text: Operational Technology The Company has operation technology, consisting of the hardware and software that monitors and controls devices, processes, and infrastructure related to the Company's operational assets. Security protocols for the Company's operational technology follow applicable NERC, FERC and TSA regulations and security directives.


text: Other Risk Factors See also "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk The CIO plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The CIO, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, and SEC financial reporting department employees, and the board of directors are notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with the director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO. The CIO, who reports to the chief executive officer, holds a degree in Business Administration and oversees the information technology and cybersecurity portfolios for the Company with over 25 years of information technology experience and 19 years working directly in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The members of the designated cybersecurity team that report to the director of cybersecurity have a combined 57 years of experience. The other members of information technology director level leadership also responsible for managing cybersecurity risks have a combined 95 years of experience and have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from the Company's business segments.


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, ERM program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company has and may continue to face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.


text: Other Risk Factors Notwithstanding the breadth of the Company's information security program, the Company may be unsuccessful in preventing or mitigating a cybersecurity event that could have a material adverse impact. See "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."


text: The Company's board of directors, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk The Company's CIO plays a large role in informing the audit committee of the board of directors on cybersecurity risks. The audit committee of the board of directors receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee of the board of directors maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with its director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO and the CIO reports directly to the Company's chief executive officer. The Company's CIO who served as the first CIO of the Company since 2016, oversaw the information technology and cybersecurity portfolios until her retirement on January 10, 2025. A new CIO from within the Company was named to succeed the retiring CIO and holds both a bachelor's and master's degree in business administration with over 25 years of information technology experience in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, over 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The other members of information technology director level leadership also responsible for managing cybersecurity risks have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee of the board of directors with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies and oversight of cybersecurity risks. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from across the Company.


text: Our cybersecurity policies and reporting processes are designed so that members of our senior management receive timely and adequate information regarding cybersecurity matters that impact the Company, including threats and incident response. We have implemented an approach to assess, identify and manage cybersecurity risks within our overall enterprise risk management program that shares common methodologies, reporting channels and governance processes and is based on a recognized framework established by the National Institute of Standards and Technology.

companyName: MOOG INC.

ticker: MOG-A


text: Cybersecurity risks, both internal and from third parties, are tracked regularly. We have established plans and procedures to guide us through an active threat or incident in order to return to normal business operations. We have developed a notification process to allow for real-time escalation of material cybersecurity incidents by and among members of our Corporate IT Security Team ("CIST").


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.


text: In addition, our IT infrastructure management program maintains an IT Crisis Response Plan ("ICRP") where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement.


text: We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis.


text: In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.


text: Our Board of Directors ("Board") is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks.


text: The CIST is supported by experienced and knowledgeable leaders, who each have several decades of experience managing risk at Moog or similar companies, including risks arising from cybersecurity threats. The CIST consists of several centers of expertise comprised of persons with many types of skills and ability, including security operations center analysts, cyber engineers, threat hunters, threat modelers, cyber risk and compliance professionals, and threat and vulnerability management analysts. Members of the CIST maintain cybersecurity credentials, such as Certified Information Security Manager, Certified Information Systems Security Specialist, CompTIA Security+ and cybersecurity Analyst+, EC-Council Certified Ethical Hacker, Computer Hacking Forensic Investigator, and several vendor product certifications including from Amazon Web Services, Microsoft and Qualys.


text: We also perform annual internal assessments and audits of internal processes and controls related to cybersecurity and engage third-party experts to support the assessment of cybersecurity related risks, including cybersecurity penetration testing. The results of these assessments, audits and tests are reported to the CIO and CFO.


text: In the event of a cybersecurity incident, we engage our Incident Response Plan, which outlines the steps to be followed regarding preparation, detection, analysis, containment, eradication, recovery, notification, and post-incident remediation. Notification includes informing functional areas (e.g., legal), as well as senior management and the Board, as appropriate. We also have an insider threat detection program to proactively identify internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement to adequately safeguard controlled unclassified information and reporting cybersecurity incidents to the Department of Defense's Cybersecurity Maturity Model Certification program. Moog also shares and receives threat intelligence information with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: The CISO and the CIO present cybersecurity updates regularly and, as necessary, to the CFO. The CFO will engage the Board to participate in assessing cybersecurity risk as part of the Company's overall risk assessment. In addition, the Board is informed when a cybersecurity issue is identified that may pose significant risk to the Company.


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on our owned and leased networks to conduct our operations, (ii) our transmission of large amounts of data over our systems and (iii) our processing and storage of sensitive customer data. Cyber-attacks on our systems may stem from a variety of sources, including fraud, malice or sabotage on the part of foreign nations, third parties, vendors, or employees and attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.

companyName: QWEST CORP

ticker: CTBB


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally. Our privacy and cybersecurity policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our Information Technology, Privacy, Product, and Operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed privacy and cybersecurity laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also share and receive threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: As noted elsewhere in this annual report, we are materially reliant on a variety of third-party service providers to operate our business, which exposes us to the risk of cyber incidents impacting those providers' systems. We have a vendor risk management program that assesses, manages and oversees risks associated with third-party service providers who have access to our data and systems. We maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on our operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of the Board of Directors. These escalation provisions, together with Lumen's Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: The Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has worked in the public and private sectors in information security since 1997 and has been a chief security officer since 2017. His technical and process certifications include CISSP, ITIL Foundation, Six Sigma Certified, CISCO CCNP, and CCNA, and he oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen also has management level committees and response teams who support our processes to assess and manage cybersecurity risk as follows: • The Risk Oversight Committee ("ROC"), whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and General Counsel, is responsible for making risk management decisions to ensure consideration of all relevant factors and alignment with our overall risk mitigation strategy. The ROC also oversees key risk management activity to help ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board and senior management. • The Technology Security and Privacy Council, co-chaired by the CSO, Chief Information Officer, and Chief Privacy Officer, brings together IT, legal and internal audit personnel, and other function leads. The Security and Privacy Council provides a forum for these cross-functional members of management to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.


text: At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen also periodically holds employee trainings on our privacy, cybersecurity and information management policies, conduct phishing tests and generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor, we are required to comply with extensive governmental regulations and standards regarding cyber security.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of its Board of Directors. These escalation provisions, together with Lumen's disclosure controls and procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.


text: The Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to all security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team ("CSWAT"), which is responsible for addressing cybersecurity incidents that raise more significant risks.


text: The CSWAT is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, managing risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Lumen's cybersecurity organization includes a response team and management level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen generally seeks to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include our Chief Financial Officer, Chief Technology and Product Officer, Executive Vice President of Enterprise Operations, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by our Board of Directors and our senior leadership team. Some of the more significant risks discussed by the ROC are also reported to our Risk and Security Committee at least quarterly.


text: We identify and assess areas of risk for our company on an ongoing basis, and we have developed, and regularly refine, comprehensive practices to manage and mitigate existing and potential risks to our business. Our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our chief information security officer ("CISO"), who reports directly to our chief information officer ("CIO"); • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data; and • a cybersecurity incident response plan.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Team and Strategy—Our cybersecurity team, which includes both our employees and those of our managed services provider, is comprised of subgroups focused on distinct functional areas of responsibility. The team maintains a Security Operations Center, staffed 24 hours a day, that delivers day-to-day execution support for our cybersecurity risk management program.


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.


text: We also require all employees to participate in cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.


text: Third-Party Review Processes—Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.


text: As discussed in the Risk Factors section above, our operations could be significantly and negatively impacted by cybersecurity threats and other disruptions affecting our information technology, related information systems and sensitive information. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII and proprietary and confidential business data. We utilize EHRs and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. As described above, our information systems, in turn, interface with and rely on third party systems that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures.


text: In April 2022, we experienced a cybersecurity incident that temporarily disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.


text: Board Oversight—Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.


text: Management Oversight—Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. Our program leverages best practices and is guided by industry frameworks, including the National Institute of Standards and Technology Cyber Security Framework. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.


text: Third-Party Review Processes —Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management in accordance with our plan and as otherwise appropriate based on the nature of the incident.


text: As previously disclosed, in April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our business, financial condition or results of operations. Additional information on cybersecurity related risks is included in Item 1A, Risk Factors, of Part I of this report.


text: Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.


text: Management Oversight— Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents are described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.


text: Cybersecurity risk management is a core component of our enterprise risk-management framework. Cybersecurity incidents and threats pose a risk to the disruption of our business operations, including the confidentiality, integrity and availability of data and information. CFC's cybersecurity program is designed to manage operational risks associated with the ever-evolving nature of cybersecurity threats. Because these risks could have a material adverse impact on our operations and reputation, both management and the CFC Board of Directors are actively engaged in the oversight of the cybersecurity program and our continuous efforts in monitoring, measuring and managing the risks.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: The primary goal of CFC's cybersecurity operations is to prevent, identify, mitigate and respond on a timely basis to cybersecurity threats in order to reduce operational risk and business impact. Our strategy encompasses technology, process and people. The technology components are designed to provide multiple layers of system security, controls and monitors for our infrastructure, data and applications. Our security infrastructure and resources are focused on the monitoring of threats and the defense of our external and internal networks, endpoints, data resources and identity management.


text: We use risk-based processes to prioritize the resources that manage vulnerabilities, threats, incident responses and operational changes. The risk-based approach ensures we are taking action on the threats, events and incidents that have the highest likelihood of impacting our business and members. We maintain cybersecurity incident procedures that identify the activities, responses and escalation procedures to be executed upon detection of a potential cybersecurity incident. These procedures are a critical component of CFC's Crisis Management Plan and business continuity efforts.


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment.


text: The effectiveness of our cybersecurity operations is regularly examined and tested by third-party vendors who specialize in cybersecurity risk management. We regularly employ such vendors to test the effectiveness of our security controls, including penetration testing. External vendors are engaged at least on an annual basis to facilitate incident response exercises and training. We use external risk management services to assess and monitor cybersecurity risk associated with third-party service providers. Finally, we review the maturity of our program's design and control environment's effectiveness through regular internal assessments and examinations.


text: Our Board of Directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the Board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the Board. The reports include information on material cybersecurity incidents, if any, and management actions to protect CFC. Upon the occurrence of a material cybersecurity incident, the Board of Directors will be promptly notified so it may properly evaluate such cybersecurity incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the Board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, our Chief Information Officer ("CIO") and Director, Information Security, provide the Board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the Board of Directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.


text: Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a three lines of defense model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.


text: Our first line of defense includes our CIO and Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our CIO, who reports to our Chief Operating Officer ("COO"), has over two decades of experience managing technology risk. Our Director, Information Security, who dually reports to the COO and CIO, has over a decade of information security management experience and as a Certified Information Systems Security Professional. Collectively, they are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.