text: Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors. We believe we are appropriately staffed to support a healthy cybersecurity posture.


text: All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management. Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA

secItem: Item 1C


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause water or wastewater system operational problems, disrupt service to our customers, compromise important data or systems or result in an unintended release of customer or other confidential information. See "Item 1A. Risk Factors—Risks Related to Cybersecurity and Technology" for additional discussion of cybersecurity risks impacting our Company.


text: Risk Management and Strategy HMC and its consolidated subsidiaries, including AHFC and HCFI (Honda), have established a management system and standards for information system security in order to minimize the negative impact on its business and business results from the occurrence of cybersecurity incidents. Based on these standards, Honda has implemented security measures in both hardware and software aspects to strengthen the security of its information systems. To address security, including product security, Honda has established a cross-functional system across business and manufacturing systems, software, quality, and other areas.

companyName: AMERICAN HONDA FINANCE CORP


text: Honda develops rules and procedures based on laws and regulations, formulate response flows, verify and implement measures for improvement through cybersecurity exercises, and develop human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.


text: When implementing third-party packaged software and cloud services, Honda makes decisions based on risk assessments following established security standards and conducts annual checks after implementation. In response to cyberattacks on production facilities and suppliers, Honda verifies the status of security measures at both domestic and overseas production facilities and suppliers. Based on the results of these verifications, Honda takes measures to strengthen security, such as supporting the introduction of solutions for managing cybersecurity incident information, and monitoring malicious activities. For such activities to strengthen security, Honda has concluded outsourcing agreements with security consulting companies and external specialists to receive support.


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guides the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.


text: Honda, including AHFC and HCFI, have been targeted by cyberattacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber attack may adversely affect our business, results of operations and financial condition."


text: Based on the resolution of Honda's Board of Directors, the Board of Directors has appointed the Director, Executive Vice President and Representative Executive Officer, as Honda's Risk Management Officer, who monitors and supervises the response status of significant risks, including risks from cybersecurity threats.


text: Honda's Risk Management Committee, chaired by the Risk Management Officer, has been established to deliberate on important matters related to risk management, including risk from cybersecurity threats. Honda has established the Honda Global Risk Management Policy, which stipulates Honda's basic policy for risk management, the collection of risk information, and the response system in the event of risk occurrence.


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consisted of 64 members as of the filing date of this Annual Report with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.


text: The North American Regional Risk Management Officer and Risk Management Officers of local companies in North America receive technical support from the Cyber Security, Risk & Architecture (CSRA) division of AHM when applying the procedures under the Honda Global Risk Management Policy at the regional and local company levels. The CSRA division includes the Office of the Chief Information Security Officer. The North American Cybersecurity Steering Committee (NACSC) has been established by the North American Regional Operating Board and is responsible for the oversight and monitoring of all North American cybersecurity activities including providing immediate direction and decision-making when threats or incidences of high severity occur. Roles supporting the NACSC include the North American Risk Management Officer who is the chair of the committee, the Chief Information Security Officer, and senior leaders representing various key business functions. The NACSC is also supported by the business through an Advisory Group.


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles includes, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.


text: Honda develops rules and procedures based on laws and regulations, formulates response flows, verifies and implements measures for improvement through cybersecurity exercises, and develops human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guide the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.


text: Honda, including AHFC and HCFI, have been targeted by cyber-attacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber-attack may adversely affect our business, results of operations and financial condition."


text: Based on the resolution of Honda's Board of Directors, the Board of Directors has appointed the Senior Managing Executive Officer and Chief Officer for Automobile Operations as Honda's Risk Management Officer, who monitors and supervises the response status of significant risks, including risks from cybersecurity threats.


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consist of members with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer through the Risk Management Committee. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles include, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.


text: The Company takes a multifaceted approach to assessing, identifying, and managing material risks from cybersecurity threats. The cybersecurity risk management processes described below are integrated into the Company's overall risk management system.

companyName: TRIMBLE INC.

ticker: TRMB


text: Each Trimble sector has identified a dedicated expert to assess vulnerabilities, calculate risks and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We maintain an information security risk insurance policy.


text: As part of our product development activities, we have implemented the Trimble Secure Development Life Cycle ("TSDLC"), which uses overlapping security activities and controls to build robust security into the cloud-based products and services we provide, some of which are also deployed across our own IT infrastructure. TSLDC includes vulnerability scanning, intrusion prevention, tracking of security metrics, and code analysis vulnerability tools. Over 100 of our products are certified to ISO/IEC 27001:2013, which addresses secure information, resilience to cyber-attacks, existence of a centrally managed framework, organization-wide protection, responses to evolving security threats, and protection of data.


text: Core information technology systems supporting our business operations are backed up and stored outside of our network infrastructure. Our cloud-based systems, including products we sell, utilize configurations for backup designed to prevent data from being destroyed as a result of a cyber event.


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to: identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage. We perform a vendor security assessment process for purchases over a certain minimum threshold.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company is not aware of a basis to believe that such risks are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. For additional information, see Item 1A. Risk Factors—Our internal and customer-facing systems, and systems of third parties we rely upon, may be subject to cybersecurity breaches, disruptions, or delays.


text: The Board has overall responsibility for the oversight of risk management for the Company, and it exercises this oversight through Board committees and regular engagement with the Company's senior management. The Audit Committee is responsible for oversight of cybersecurity risk exposure and mitigation, and receives regular updates on cybersecurity risk management as well as timely notice of any material cybersecurity developments from the CISO through our escalation processes. The CISO presents quarterly or as needed at the Audit Committee meetings on the Company's cybersecurity risk management activities.


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and has over 20 years of information technology and cybersecurity experience in multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.


text: Each Trimble business has identified a dedicated expert to assess vulnerabilities, calculate risks, and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security, and mobile device usage. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We also conduct regular phishing simulations, with follow-up training as needed, for employees and contractors. We maintain an information security risk insurance policy.


text: We implement controls and procedures designed to measure and mitigate risk with third-party vendors and business partners who have access to sensitive information, including conducting a security risk assessment. Identified security risks are remediated or documented, and in some cases, the business relationship may be ended or not pursued. We also perform a vendor security assessment process for purchases over a certain minimum threshold.


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes, which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage.


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and extensive experience in information technology and cybersecurity across multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.


text: We have implemented a cybersecurity program to assess, identify and manage risk from cybersecurity threats. This program aims to protect the confidentiality, availability and integrity of our information systems from potential threats. Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administer the program with oversight by senior management.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives. Our cyber risk program leverages internationally recognized standards as appropriate. All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.


text: We also engage external experts to evaluate our cybersecurity programs. These evaluations include regular audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices. We routinely conduct incident response exercises with key stakeholders.


text: To manage risks associated with third-party service providers, the information security team categorizes suppliers based on factors such as volume and criticality of data handled, potential impact on business operations and level of access to our information systems. We conduct risk assessments to identify potential threats and vulnerabilities associated with each supplier. We screen suppliers to ensure they meet proper security standards and compliance requirements. We monitor all supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to alert us promptly of material cybersecurity incidents by virtue of the documents governing their relationship with us or applicable law.


text: Our Board of Directors, with assistance from the IT Steering Committee, oversees cybersecurity. Our Board of Directors receives reports as needed, but no less than biannually, from management on various cybersecurity and IT topics, including trends, data security policies and practices, cybersecurity incidents, current and projected threat assessments, regulatory developments and ongoing efforts to protect, detect and respond to critical threats. Our IT Steering Committee, which is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, and our Vice President of Information Technology. The IT Steering Committee periodically reviews and confers with management risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC") Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 19 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.


text: Our Vice President of Information Technology meets with our IT Steering Committee on a routine basis. Regular topics for discussion with the IT Steering Committee include cybersecurity initiatives and strategies, cybersecurity events, emerging threats, regulatory requirements and industry standards.


text: We use a combination of technology controls and human oversight to actively monitor and protect our network and systems. In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework for reporting and documenting such incidents by our cybersecurity incident response team. This same framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents promptly. Cybersecurity incidents are reported to our Vice President of Information Technology, and critical events are reported to our CEO and our Chief Legal Counsel. In the event a cybersecurity incident is determined to be potentially material, the incident is reported in a timely manner to our Board of Directors as part of their cybersecurity oversight.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions under Item 1A. Risk Factors, Risks Related to our Business and Operations, "A failure or outage in our operations systems or cybersecurity attacks on any of our systems, or those of third parties, may adversely affect our financial results."


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives.


text: Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. As part of our enterprise-wide risk management strategy and commitment to continuous improvement, we are actively pursuing ISO/IEC 27001 certification, the internationally recognized standard for information security management systems. We have initiated the formal implementation process, including a comprehensive gap assessment and roadmap development. Progress toward certification is regularly reviewed by the IT Steering Committee and reported to the Board of Directors.


text: All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC"), GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 20 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2013 certified.

companyName: FLEX LTD.

ticker: FLEX


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Audit Committee and the Board. We periodically (at least annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA,, "Risk Factors - "A breach of our IT or physical security systems, or violation of data privacy laws, may cause us to incur significant legal and financial exposure and adversely affect our operations."


text: The Audit Committee of our Board of Directors has primary responsibility for overseeing our cybersecurity risks and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.


text: The Audit Committee receives regular reports (at least quarterly) from our CISO and our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.


text: The full Board also receives briefings from our CISO and CIO on cybersecurity matters twice annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our CIO who, in turn, reports directly to our CEO.


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2022 certified.


text: The Audit Committee receives regular reports (at least quarterly) from our CISO on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.


text: The full Board also receives briefings from our CISO on cybersecurity matters annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our Interim Chief Information Officer who, in turn, reports to our Chief Operating Officer and member of our executive leadership team.


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including having held Certified Information Systems Security Professional (CISSP) certification.


text: The Company is dedicated to upholding strong cybersecurity measures to protect its operations, data, and stakeholders' interests. By keeping a close eye on the cybersecurity landscape, the Company is able to adjust its strategies and governance practices to minimize risks in this rapidly changing area.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: The Company has embraced the NIST-CSF as a blueprint for its cybersecurity program since 2018. This framework's key domains guide the establishment and continuous improvement of processes to identify, assess, and manage cyber risks and threats. The Company's controls are routinely monitored by its Security Operations Center. Its cybersecurity program, security posture, incident response, and security awareness training are tested by an external party to evaluate their effectiveness and maturity rating.


text: The Company maintains a comprehensive cybersecurity risk management program designed to identify, assess, manage, and mitigate cybersecurity risks. This program provides a framework for addressing threats and incidents, including those associated with third-party service providers. To secure its technology environment, the Company leverages the latest software and security capabilities, employing a defense-in-depth and layered strategy. This includes deploying next-gen endpoint detection and response, network anomaly detection, and multi-factor authentication across most of its environment. Additionally, the Company engages with third-party consultants and utilizes threat intelligence services to assist in its oversight and risk identification efforts. Furthermore, all employees and consultants with access to the Company's information systems are required to complete annual data protection and cybersecurity training, as well as ongoing phishing simulation exercises, as part of a broader training. Based on the information known as of the date of this Annual Report on Form 10-K, the Company does not believe that any cybersecurity incident experienced has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors receives regular updates on the key risks to the organization on a quarterly basis. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology and Data Management Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them, to the executive leadership team within the Company, and the Board of Directors.


text: Cybersecurity risks remain a persistent challenge, as the threat landscape continues to evolve alongside technological advancements. While diligent efforts are made, complete risk elimination or incident assurances are not feasible.


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology, Data and Supply Chain Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them to the executive leadership team within the Company and to the Board of Directors.


text: Our cybersecurity program is designed to monitor, detect, prevent and respond to cyber threats. We take a multi-faceted approach to identifying and mitigating information security risks. This includes but is not limited to penetration tests of our external network, the utilization of third-party scanning tools to monitor our network, maintenance of software and implementing applicable updates timely, training employees to recognize security risks and encouraging employees to report suspicious activity. Annual cybersecurity awareness training is provided to onshore and offshore users. The training seeks to demonstrate to users the risks in using technology and how to effectively defend against cyber threats.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: We assess, identify and manage material risks from cybersecurity threats and vulnerabilities according to our Cybersecurity Incident Response Plan (the "IRP"). The IRP uses the six-stage model of the National Institute of Standards and Technology Cybersecurity Framework (Preparation, Detection, Containment, Investigation, Remediation, and Recovery) to outline steps for reporting, responding, and mitigating various aspects of a cybersecurity incident. Execution of the IRP's incident response activities are coordinated by the Cybersecurity Incident Response Team, and communications planning via the Helix Crisis Assistance Team and the Cybersecurity Incident Communication Group. There are also separate processes in place for the effective management of cyber incidents involving our offshore assets and certain regional business units.


text: We engage external parties to aid in processing and managing cybersecurity incidents as needed, including utilization of the services and expertise of local law enforcement and government entities, partnering financial institutions, a third-party security operations center ("SOC"), and managed service providers. In addition, we collaborate with our internal auditors to ensure our processes are documented and followed appropriately.


text: In connection with our external SOC and managed service providers, we have implemented change control measures that allow for the continual oversight and assessment of the services provided and threats identified. Notifications and remediation of cyber threats are tracked, reviewed, and archived. Processes implemented and lessons learned involving these third parties are evaluated after each incident to ensure efficiency and replication.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – General Risks – Cybersecurity breaches or business system disruptions may adversely affect our business."


text: Risks relating to cybersecurity are overseen by the Audit Committee. Certain members of our management, including the Executive Vice President and Chief Financial Officer (the "CFO"), the Chief Accounting Officer and Corporate Controller (the "CAO") and the Vice President of Internal Audit, report to the Audit Committee regarding cybersecurity risks. IT management presents an annual update of cybersecurity related activities to the Audit Committee. Interim updates are provided to the Audit Committee by the CFO on an as needed basis should an incident warrant immediate notification or escalation.


text: Within Helix's IT department, several IT management positions are responsible for assessing and managing cybersecurity risk, including the Chief Information Officer, Director of Information Technology and Manager of Information Technology. Each of the IT department's management personnel has over 20 years of IT experience. The Director of Information Technology and the Manager of Information Technology positions are tasked with the daily and per incident assessment and management of cybersecurity risks, while the Chief Information Officer is tasked with oversight.


text: Helix's IT department keeps management involved and informed throughout the entire process of any cybersecurity incident from initial monitoring and discovery through the remediation and restoration, all in accordance with the processes outlined in our IRP. Initial notification regarding a cybersecurity incident may come through our third-party SOC or managed service providers, or from employees reporting internally to our IT helpdesk. Investigations are then performed to determine the appropriate actions per the IRP guidelines. Incidents that warrant further escalation are promptly shared with the CFO and continually updated, as appropriate, until remediation and restoration is achieved.


text: Helix's IT department holds regular quarterly meetings with the CFO, CAO, and Vice President of Internal Audit to recap cybersecurity risks and incidents and to determine any actions required as a result.


text: Cybersecurity is an integral part of risk management at the Company. Our Board and management appreciate the evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, and mitigation of the effect any such incidents may have on the Company.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight through the audit committee.


text: Our Chief Information Officer and Chief Operating Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Information Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Information Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.


text: Our Chief Information Officer and IT consultants provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.


text: Cybersecurity has become a significant issue for financial institutions around the globe, and the Company is no exception. The Company's management has integrated cybersecurity issues into the Company's overall risk management system by making cybersecurity risk a key focus of its internal Strategic Technology Committee, Enterprise Risk Management Committee, and Board Risk Oversight Committee. These committees are provided regular updates on the Bank's cybersecurity risk management program.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: The Company has implemented a variety of mechanisms that are designed to detect, identify, assess, manage, and respond to material risks from cybersecurity threats. The Company's processes for identifying, assessing, and managing cybersecurity risks include: • a rigorous internal audit process to evaluate the Company's cybersecurity strategies, with the Audit Committee apprised of risks or control failures that are identified during the audit; • participation in multiple peer-sharing networks to obtain industry-wide intelligence regarding specific cybersecurity threats and industry best practices to minimize cybersecurity risks; • participation in simulated cyber-event tabletop exercises designed to test the Company's incident response capabilities and the robustness of its cybersecurity program; • an information security program that is regularly reviewed, tested, and updated, and includes vulnerability and patch management programs, incident response planning, security monitoring, employee training, and security awareness testing; • cybersecurity insurance to mitigate the financial impact of a cybersecurity incident on the Company's business and financial condition; and • periodic regulatory examinations that include an assessment of the Company's cybersecurity management, processes, and controls. In addition to the internal programs outlined above, the Company engages with external cybersecurity experts to conduct thorough evaluations of the Company's cybersecurity processes and controls. These third-party consultants conduct periodic comprehensive vulnerability and penetration testing, alongside audits of high-risk technology systems designed to evaluate the efficacy of the Company's cybersecurity measures. The Company has also retained a third-party cybersecurity firm to assist with the Company's response to any future cybersecurity breaches.


text: In order to identify material risks from cybersecurity threats associated with the use of third-party service providers, such as bank operations technology, payroll and benefits administrators, and professional service providers, the Company has established a dedicated department within its Enterprise Risk Management division. This department manages risks of third-parties and evaluates cybersecurity risks associated with the Company's third-party service providers with the Bank's Information Technology Department.


text: The Board's Risk Oversight Committee is responsible for oversight and monitoring of the Company's cyber risk management profile and related programs. In an effort to ensure transparency and provide appropriate oversight and monitoring, the Chief Risk Officer and Chief Information Security Officer present detailed reports to the Risk Oversight Committee on a quarterly basis. These reports address the current landscape of cybersecurity threats, any notable recent incidents, and a summary of emerging cybersecurity trends. The Board is also regularly furnished with key risk indicators and defined risk parameters with respect to the Company's cybersecurity program. The Board reviews and approves the Company's cybersecurity policies at least annually.


text: Management's role in assessing and managing material risks from cybersecurity threats is an important and multifaceted component of the Company's cybersecurity. Appropriate members of the Company's senior management, including the Chief Information Security Officer ("CISO"), Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), are responsible for assessing and managing cybersecurity risks, which involves an ongoing process of identifying, analyzing, evaluating, and addressing the Company's cybersecurity threats.


text: The Company employs management and staff members who hold top cybersecurity certifications and have acquired the expertise needed to manage the Company's cybersecurity program, including a range of technical skills such as intrusion detection, network security control, security incident management, and risk assessment. These management and staff members also participate in structured ongoing training to keep current with industry trends and cybersecurity threats.


text: The CISO has a degree in Business Administration, Finance, and Risk Management from Washington State University. The CISO has over 23 years of experience in cybersecurity and information security. The CISO has maintained a Certified Information Systems Security Professional (CISSP) certification for over 18 years.


text: The CRO has a degree in Business Administration and Finance from the University of Montana. The CRO has over 20 years of combined experience with financial institution risk management, including prior experience as a bank regulator and a credit risk management consultant.


text: The CIO has dual degrees in Accounting and Computer Science from the University of Montana. The CIO has over 30 years of experience managing information technology at the Company.


text: The processes by which the relevant members of management are informed about and manage the prevention, detection, mitigation, and remediation of cybersecurity incidents include conducting cybersecurity risk assessments, establishing network access controls, creating a vulnerability management program, and continuous monitoring for threats.


text: The Company is not aware of any current cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for additional information regarding the risks we face from cybersecurity threats.


text: The CISO has a degree in Business Administration, Finance, and Risk Management from Washington State University. The CISO has over 24 years of experience in cybersecurity and information security. The CISO has maintained a Certified Information Systems Security Professional (CISSP) certification for over 19 years.


text: The CRO has a degree in Business Administration and Finance from the University of Montana. The CRO has over 24 years of combined experience with financial institution risk management, including prior experience as a bank regulator and a credit risk management consultant.


text: The CIO has dual degrees in Accounting and Computer Science from the University of Montana. The CIO has over 31 years of experience managing information technology at the Company.


text: We depend on a variety of information systems and technologies (including cloud technologies) (collectively, "IT Systems") to manage our business. We rely on these IT Systems to provide information for substantially all of our business operations, including supply chain, order processing, e-commerce, human resources, legal, compliance, marketing, finance, and accounting. Our core IT Systems consist mostly of purchased and licensed software programs that integrate together and with our internally developed solutions. As part of our overall enterprise risk management program, we monitor and assess the risks posed by cybersecurity threats to those internal and external systems and solutions and maintain an information security program designed to mitigate such risks.

companyName: Dorman Products, Inc.

ticker: DORM


text: Our information security program includes development, implementation, and improvement of policies and procedures to safeguard information to help ensure availability of critical data and systems. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our program further includes review and assessment by external, independent third parties, who assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. With the assistance of one such reputable third party, the Company conducts biannual maturity assessments of its IT Systems against the National Institute of Standards of Technology (NIST) Cybersecurity Framework. We also carry insurance that provides protection against the risks from cybersecurity threats. To our knowledge, during fiscal 2023, there were no material cybersecurity incidents or threats that materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Pursuant to its charter, the Audit Committee of the Board of Directors (the "Board") has oversight of the Company's information security program, including, but not limited to, risks regarding cybersecurity threats. In particular, the Audit Committee reviews with management the Company's key IT Systems and evaluates the adequacy of the Company's information security program, compliance, and controls.


text: The Company's Senior Vice President and Chief Information Officer ("CIO"), who reports to the Company's Chief Executive Officer, is responsible for the operation of the Company's information security program. Our CIO is an IT veteran with over 25 years of experience in building and maturing cyber programs for large public companies. The CIO is supported by an internal team of certified security analysts that work in conjunction with leading security operations managed service providers to manage detection and response.


text: On at least an annual basis, a cyber risk report that highlights program governance, risks, and opportunities is provided to the Audit Committee and the full Board.


text: The Company maintains a Security Committee, which is led by the CIO and is comprised of individuals from the Company's IT department – including dedicated security team members with various security certifications. The Security Committee regularly reviews information security program governance and key performance indicators. These reviews typically include the number of events, number of investigations, mean response time, and cyber trends. The Security Committee oversees the Company's security roadmap and ensures monitoring of information security policies and procedures covering areas such as back-up and retention, acceptable use, disaster recovery, incident management, and passwords.


text: The success of the Company's information security program relies not only on ownership by the CIO's organization but also an active and collaborative relationship within the business. The Company requires all employees to complete cyber training annually. For fiscal 2023, the Company maintained a security learning management system with phishing simulations distributed regularly to enhance cyber resiliency. Additionally, the Company leverages communications, contests, policies, videos, and visuals to continuously raise awareness among employees.


text: We depend on a variety of information systems and technologies (including cloud technologies) (collectively, "IT Systems") to manage our business. We rely on these IT Systems to provide information for substantially all of our business operations, including supply chain, order processing, e-commerce, human resources, legal, compliance, marketing, finance, and accounting. Our core IT Systems consist mostly of purchased and licensed software programs that integrate together and with our internally developed solutions. As part of our risk management program, we monitor and assess the risks posed by cybersecurity threats to those internal and external systems and solutions and maintain an information security program designed to mitigate such risks.


text: Our information security program includes development, implementation, and improvement of policies and procedures to safeguard information to help ensure availability of critical data and systems. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our program further includes review and assessment by external, independent third parties, who assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. With the assistance of one such reputable third party, the Company conducts biannual maturity assessments of its IT Systems against the National Institute of Standards of Technology (NIST) Cybersecurity Framework. We also carry insurance that provides protection against the risks from cybersecurity threats. To our knowledge, during 2024, there were no material cybersecurity incidents or threats that materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: The Company's Senior Vice President and Chief Information Officer ("CIO"), who reports to the Company's Chief Executive Officer, is responsible for the operation of the Company's information security program. Our CIO is an IT veteran with over 25 years of experience in building and maturing cyber programs for large public companies. The CIO is supported by an internal team of certified security analysts who work in conjunction with leading security operations managed service providers to manage detection and response.


text: The Company maintains a Security Committee, which is led by the CIO and is comprised of individuals from the Company's IT department – including dedicated security team members with various security certifications. The Security Committee regularly reviews information security program governance and key performance indicators. These reviews typically include the number of events, number of investigations, mean response time, and cyber trends. The Security Committee oversees the Company's security roadmap and ensures the monitoring of information security policies and procedures covering areas such as back-up and retention, acceptable use, disaster recovery, incident management, and passwords.


text: The success of the Company's information security program relies not only on ownership by the CIO's organization but also on an active and collaborative relationship within the business. The Company requires all employees to complete cyber training annually. For 2024, the Company maintained a security learning management system with phishing simulations distributed regularly to enhance cyber resiliency. Additionally, the Company leverages communications, contests, policies, videos, and visuals to continuously raise awareness among employees.


text: We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security and information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: AECOM

ticker: ACM


text: We utilize a combination of technology controls, service providers, and processes to actively monitor and protect our network and systems. All employees are required to participate in a number of information security training and awareness programs on an annual basis, which include training on how to identify and report cyber risks and events.


text: We engage industry cybersecurity experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.


text: To manage risks associated with third-party service providers, we typically perform a cybersecurity assessment on new vendors before they are onboarded as a supplier. We conduct periodic reviews of these vendors to evaluate continued compliance with our policies and standards. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of significant cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.


text: Our Board of Directors ("Board") receives regular updates from management and external consultants which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, and ongoing efforts to further strengthen our security posture. Our Board reviews key metrics related to cybersecurity on a quarterly basis, and is notified of applicable cybersecurity incidents if and when they occur.


text: The Chief Information Security Officer ("CISO") heads the cybersecurity program which includes personnel based in several of our global locations. Our CISO brings over 25 years of experience, which includes both consulting and practitioner roles, and maintains the following certifications: Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CISO reports to our Chief Information Officer, up to the Chief Technology Officer, who meets with our Board at least annually to discuss cybersecurity risk and related topics.


text: Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: In the event of a cybersecurity incident, we have a plan which sets forth a framework to report such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. As part of this incident response plan, we have retainers in place with professional service firms to assist with cybersecurity incidents if needed.


text: Cybersecurity Risks, Threats and Material Incidents While we are not aware of any cybersecurity incidents that have materially affected us through the date of this report, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks that we may face can be found in Item 1A – Risk Factors – of this Form 10-K.


text: We have implemented and maintain various information security processes designed to detect, respond to, recover, and protect our technology ecosystem from cybersecurity threats. These processes are designed to identify, assess, and manage material risks that may result from cybersecurity threats and apply to our critical technologies inclusive of networks, third party hosted services, communications systems, hardware, software, and critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Our Information Technology department, led by our Senior Vice President, Information Technology, helps to detect, respond to, and manage cybersecurity threats and risks by monitoring and evaluating our threat environment using various manual and automated tools in certain environments and systems and other methods including, for example: analyzing reports of certain threats and actors; conducting scans of the threat environment; evaluating our and our industry's risk profile; evaluating certain threats reported to us; conducting internal and external audits; conducting threat assessments for certain internal and external threats; and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment and system, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of the Company's enterprise risk management program. In addition, we have developed a process whereby our senior management will evaluate material risks from cybersecurity threats against our overall business objectives and will report certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on information technology systems, infrastructure and data, which exposes us to data security risks."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who is an information technology professional with healthcare and digital certifications and has over 25 years of relevant experience, and other employees in our Information Technology department who are certified security professionals and have relevant experience.


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. As part of such process, the Audit Committee of the Board of Directors receives regular reports from our Senior Vice President, Information Technology concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.


text: Our Information Technology department, led by our Senior Vice President, Information Technology, helps to detect, respond to, and manage cybersecurity threats and risks by monitoring and evaluating our threat environment using various manual and automated tools in certain environments and systems and other methods including, for example: analyzing reports of certain threats and actors; conducting scans of the threat environment; evaluating our and our industry's risk profile; evaluating certain threats reported to us; conducting internal and external audits; conducting threat assessments for certain internal and external threats; and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, system and data, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies and data, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of our enterprise risk management program. In addition, we have developed a process whereby our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators. The Company maintains a risk-based approach and process designed to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could materially impact our business if there is a cybersecurity incident affecting those third-party systems.


text: For an additional description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 1A, Risk Factors, in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on data as well as information technology systems and infrastructure, which exposes us to data protection risks."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Audit Committee also oversees our internal audit department and management's internal controls over financial reporting, including with respect to cybersecurity.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who holds an undergraduate degree in Computer Engineering and has served in information technology and security roles dedicated to the pharmaceutical and biotechnology sector for approximately 18 years, including serving as the Chief Information Officer of two public biopharmaceutical companies.


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. The Audit Committee of the Board of Directors receives reports from our Senior Vice President, Information Technology concerning our significant cybersecurity threats and risks (including certain cybersecurity threats) and the processes we have implemented that are designed to address them.


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: We have implemented a cybersecurity program to safeguard our information systems, which includes policies, procedures and controls designed to protect against cybersecurity threats. Throughout the reporting period, we have made significant changes and enhancements to our cybersecurity program and the adoption of industry best practices.


text: We are aware of the various risks and threats that the Company faces in relation to cybersecurity. These risks include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, we recognize the potential for internal risks, such as employee negligence or malicious activities, which can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, and we believe this demonstrates our commitment to cybersecurity awareness.


text: In the event of a cybersecurity incident, the Company has a well-defined incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Throughout the reporting period, we have successfully implemented our incident response plan.


text: Within our organization, we have established a dedicated cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.


text: In its risk oversight role, our Board of Directors focuses on understanding the nature of our enterprise risks, including our operations and strategic direction, as well as the adequacy of our risk management process and overall risk management system. The Board of Directors evaluates risks over the short-term and over the long-term. Risk evaluation over the short-term includes the assessment of multiple inputs, including (i) receiving management updates on our business operations, financial results and strategy and discussing risks related to the business at each regular board meeting, (ii) receiving regular reports on all significant committee activities at each regular board meeting and (iii) evaluating the risks inherent in significant transactions, as applicable. In connection with risk evaluation over the long-term, the Board of Directors also seeks out the input of subject matter experts and consultants. Accordingly, a formal, enterprise risk assessment, which includes numerous members of Company management, is performed annually as part our strategic plan process.


text: We are subject to various legal and regulatory requirements related to cybersecurity. Compliance with these requirements is of utmost importance to management, is a top priority for the Company and is a shared responsibility among all stakeholders. Throughout the reporting period, we have diligently worked to ensure our compliance efforts align with these obligations, and we are committed to ongoing efforts to enhance our cybersecurity measures and stay vigilant against evolving threats.


text: Looking ahead, we remain committed to continuously improving our cybersecurity strategy and initiatives. We recognize the ever-evolving nature of cybersecurity threats and the need to adapt our measures accordingly. In the future, we plan to focus on enhancing employee training and awareness programs to foster a culture of cybersecurity awareness within the Company.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our systems and data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.


text: We have a cybersecurity program to safeguard our information systems and data, which includes policies, processes and controls designed to protect against cybersecurity threats.


text: The risks and threats that the Company faces in relation to cybersecurity include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, internal risks, such as employee negligence or malicious activities, can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, which we believe demonstrates our commitment to cybersecurity awareness.


text: In the event of a cybersecurity incident, the Company has an incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Our security operations include monitoring conducted by a third-party provider in collaboration with internal teams. The Company has also invested in modern cybersecurity tools to protect and detect the systems and data from attacks and compromises.


text: Within our organization, we have established a cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for cybersecurity risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.