text: Board and Management Governance The Company's Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, employees, and shareholders, including the risks associated with cybersecurity threats. The Board of Directors' responsibilities for cybersecurity risk management and strategy include the following: Engaging management in establishing the Bank's vision, risk appetite, and overall strategic direction; Approving plans to ensure the use of the CAT;


text: Reviewing management's analysis of the CAT results, inclusive of any reviews or opinions on the results issued by independent risk management or internal audit functions regarding those results; Reviewing management's determination of whether the Bank's cybersecurity preparedness is aligned with its risks;

companyName: Bank First Corp

ticker: BFC

secItem: Item 1C


text: Reviewing and approving plans to address any risk management or control weaknesses; and Reviewing the results of management's ongoing monitoring of the Bank's exposure to and preparedness for cyber threats.


text: The Company has also appointed an ISO, who reports directly to the Audit Committee and to the Chief Executive Officer and shares a co-sourced relationship with a third party consultant. The ISO has been with Bank First for over 10 years in various operational and administrative roles. For the past five years, he has served as the Bank's Enterprise Risk Manager, and as ISO for the past three years. In 2022, he earned the Certified Banking Security Manager certification from SBS Cybersecurity. The ISO works closely with the Director of Technology to ensure that the Bank's cybersecurity controls are in line with established internal culture, Board expectations and risk appetite, and all regulatory requirements. The ISO's responsibilities include the following: Developing a plan to conduct and complete the CAT on an annual basis; Working with the VP-Director of Technology to evaluate the results of the CAT; Leading employee efforts during the CAT to facilitate timely responses from across the Bank; Setting the target state of cybersecurity preparedness that best aligns to the Board of Directors' approved risk appetite; Reviewing, approving, and supporting plans to address risk management and control weaknesses; Analyzing and presenting the results of the CAT to the full Board of Directors; Providing periodic cybersecurity updates to the full Board of Directors;


text: Overseeing the performance of ongoing monitoring to remain nimble and agile in addressing evolving areas of cybersecurity risk; and Overseeing the Bank's cybersecurity preparedness.


text: Finally, the Company has established an Information Technology Committee to support the ISO in implementing the CAT, document formal action plans to be presented to the Board of Directors, enforce and implement the controls established by the CAT, and ensure employee compliance with internal controls


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management. The Company recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. We believe we have built a strong and collaborative risk management culture focused on awareness which supports appropriate understanding and management of our key risks. Each employee is accountable for identifying, monitoring and managing risk within their area of responsibility.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: The Company maintains cybersecurity prevention and response plans and procedures (the "Cybersecurity Policies") that set forth the Company's plan to prevent, manage, report and resolve cybersecurity events. The Cybersecurity Policies set forth the Company's policies and procedures for cybersecurity event prevention, including the Company's (i) network and computer systems acceptable use policy, (ii) data backup procedures, (iii) business continuity plan, (iv) data retention policy, (v) disaster recovery plan, (vi) email use and security policy, (vii) network change management procedures, and (viii) password and authentication requirements policy. The Cybersecurity Policies also (i) provide indicators that Company employees should be aware of to recognize a cybersecurity event, (ii) outline the roles and responsibilities for Company employees and other third parties with respect to the Company's cybersecurity incident response team ("CSIR Team"), (iii) set forth the steps to take in response to a cybersecurity incident, including reporting the incident, investigating the incident, preserving non-affected systems and data, informing, as appropriate, Senior Management (as defined below), insurance carriers, law enforcement and other parties that may be affected by the incident and (iv) include the processes for maintaining business continuity.


text: The Company's President and Chief Executive Officer, Chief Financial Officer and Treasurer, Chief Operating Officer and General Counsel and Secretary (" Senior Management ") are responsible for assessing and managing cybersecurity risks with the support of the entire CSIR Team, led by the Director of Operations/Risk Management. The Director of Operations/Risk Management is the primary lead for monitoring the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and ensuring that the Cybersecurity Policies are followed. Senior Management works collaboratively with the Director of Operations/Risk Management and the entire CSIR Team to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Cybersecurity Policies. The CSIR Team also includes a third-party, on-demand IT support team, a Primary IT Support Contact, who is the technical response lead, a Primary Communications Contact responsible for handling external communications during and after an incident, as well as other delineated primary contacts in areas including, but not limited to, HR, Legal, Accounting, Asset Management and Acquisitions. Pursuant to the Cybersecurity Policies, information security incidents must be reported, without delay, to the IT support team or the Director of Operations/Risk Management, who will then advise Senior Management of the incident. Senior Management will then report such threats and incidents to the Audit Committee, when appropriate.


text: The members of Senior Management each hold degrees in their respective fields and combined have approximately 30 years or more of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's management team.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company has established and maintains comprehensive incident response and recovery plans that address the response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on its cybersecurity measures, including information security materiality assessments and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee has duties and responsibilities with respect to the oversight of the Company's cybersecurity risk protocol (which includes oversight of risk assessment, risk management plan and process to control/monitor, business continuity plan, incident response, and disaster recovery).


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. We face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We, our tenants, and our property managers face risks associated with security breaches through cyber-attacks, cyber-intrusions, or otherwise, as well as other significant disruptions of information technology networks and related systems."


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our cybersecurity operations center and third party service providers responsible for monitoring and measuring threats, and (4) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; regular testing of our critical systems to identify and address potential vulnerabilities; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third party risk management process for certain service providers, suppliers, and vendors.


text: We regularly experience cyberattacks and other incidents and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents (including the Cybersecurity Incident), that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives briefings from our information security team ("Information Security") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Information Security is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Information Security reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from Information Security and information technology ("IT") teams. Management receives periodic reporting on the status of projects to strengthen the security of our IT systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.


text: Information Security has significant experience in incident response, forensics, vulnerability management, network security administration, fraud prevention, and other governance, risk, and compliance areas. Information Security maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI-DSS, along with industry certifications commensurate with their roles.


text: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO). The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board. The Audit Committee of the Board monitors our information security programs, including our cybersecurity risk management program, and receives updates quarterly, or more frequently as determined appropriate, from management on our cybersecurity program and systems protection.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor to immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.


text: We model our cybersecurity program to align with the practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;


text: Identification and remediation of information security risks and vulnerabilities in our information technology systems, including regular scanning of both internal and externally facing systems and annual third-party penetration testing; Implementation of security technologies intended to identify and assist in containing and remediating malware risks; Active monitoring of logs and events for our network perimeter and internal systems; Due diligence of information security maintained by third-party vendors that handle our data;


text: Partnering with the Cybersecurity and Infrastructure Security Agency (CISA), DHS, and the Federal Bureau of Investigation, to leverage their provided sensitive or confidential threat intel and with CISA for weekly vulnerability scans of our key public-facing servers;


text: Maintaining a cyber insurance policy that provides coverage for security breach recovery and response; and Engagement of third party consultants to assess the health of our cybersecurity program.


text: We maintain a Cybersecurity Incident Response Plan (CIRP) to assist in promptly responding to, resolving, and recovering from cybersecurity incidents. The CIRP includes guidelines for assessing, identifying, managing, reporting, including disclosure of material breaches with the SEC, and remediating cybersecurity incidents. Following a cybersecurity incident, external subject matter experts, including legal counsel are consulted to reduce the risk of further compromise to our information and to ensure proper reporting and documentation. The Audit Committee would be informed promptly of material cybersecurity incidents in the event that they arise. If a material cybersecurity incident were to occur, it could have a material effect on our business strategy, results of operations and financial condition. For more information see Item 1A. "Risk Factors" for the Risk Factor entitled "Our operations depend on the proper functioning of information systems, and our business or results of operations could be adversely affected if we experience a cyberattack or other systems breach or failure."


text: Privacy and Cybersecurity Merchants Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of their customers. These laws require banks to periodically disclose their privacy policies and practices relating to sharing such information and permitting customers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact a bank's ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, banks are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.

companyName: Merchants Bancorp

ticker: MBIN


text: To combat the ever-present cyber risks, the Company maintains a comprehensive ISP, which includes continuous risk assessments, an Incident Response Plan, and a multilayered control environment meant to protect, detect, respond to, and limit unauthorized or harmful actions across our information environment. The control environment is based off industry leading recommendations, including the Center for Internet Security (CIS) Critical Security Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our Information Security Officer (ISO) is primarily responsible for coordinating the various aspects of the ISP with cross-functional support teams across various teams within the Company.


text: Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, aimed at protecting personal and confidential information, are in effect across all businesses and geographic locations. Board-approved policies are in place to effectively mitigate risks linked to third-party service providers, encompassing factors such as availability, confidentiality, and governance and compliance. As part of this risk mitigation, the Company actively monitors vendors' cybersecurity practices through periodic assessments and contractual security requirements. This ensures that vendors adhere to our security standards and promptly address emerging threats or vulnerabilities.


text: The Company employes a defense in depth posture, designed to safeguard information, prevent unauthorized access, detect, and respond to threats, and maintain the confidentiality, integrity, and availability of data. The ISP establishes controls across many domains including but not limited to: Information Security Governance, Inventory and Control of Enterprise Assets and Software, Data Protection, Secure Configuration of Enterprise Assets and Software, Account and Access Control Management, Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, Application Software Security, Incident Response Management, and Penetration Testing.


text: Recognizing people as a key component of an effective information security program, the Merchants Information Security Program strives to enhance education and awareness at all levels of the Company. One critical component of education and awareness is an internal cybersecurity committee, comprised of employees from all levels and departments, who act as embedded security representatives for their business units.


text: However, it is difficult or impossible to defend against every risk being posed by evolving technologies as well as criminal intent on committing cyber-crime. Increasing sophistication of criminal organizations and advanced persistent threats makes staying ahead of new dangers difficult and could result in a security breach. Controls employed by our information technology department and cloud vendors could prove inadequate. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have an adverse effect on our business, financial condition, and results of operations. The Company has established conditions to quickly respond to a cyber incident, ensuring a resilient, information environment.


text: The Board established an IT Committee to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The IT committee membership includes senior management from business units, as well as information security risk experts such as the Information Security Officer, experts from Enterprise Risk Management, Internal Audit, and Information Technology Leaders. At the IT Committee meetings, security-related policies and standards are reviewed and approved, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, emerging threats reported on, and relevant cyber risks and trends are presented. The IT Committee is responsible for governing the assessment and treatment of cyber risks. The Committee reports its activities, key conclusions, and recommendations to the Board on a quarterly basis.


text: The Chief Administrative Officer is responsible for the appointment of the Information Security Officer. The Information Security Officer serves as the focal point for the information security program and is responsible and accountable for its implementation and monitoring, and management of the Information Security team. The current Information Security Officer has over a decade of experience in the cyber security field, including critical roles in security operations, security governance, risk, and compliance, and cyber threat intelligence. They have multiple industry leading certifications, including nine GIAC and CISSP from the ISC2 and a Master of Engineering in Cybersecurity Policy and Compliance.


text: The Information Security Officer presents an Annual Information Security Review to the board which summarizes the previous year's threat landscape, risk assessment, service provider, and audit testing activities, results of security incidents, information security program changes, and future strategies and recommendations.


text: The Company recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Managing Material Risks and Integrated Overall Risk Management The Company has implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is designed to align with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, third-party conducted penetration tests and network monitoring. We also provide security awareness training for employees and contractors, maintain a cybersecurity insurance policy and invest in new security capabilities designed to address emerging threats.


text: In addition, the Company has a set of enterprise-wide policies, standards, and procedures concerning cybersecurity matters, which include an information security policy and program reviewed and approved by senior management and the Board of Directors. Additionally, technical standards and procedures related to incident response and use of Bank systems and devices are in place, as well as standards for critical security operational functions related to encryption, endpoint protection, vulnerability management, remote access, multifactor authentication, handling confidential information, use of internet, social media, email, and wireless devices. Policies and standards are subject to an internal review process and are approved by senior management.


text: The Company has strategically integrated cybersecurity risk management into our enterprise-wide risk management framework in alignment with the three lines of defense model to promote an enterprise-wide culture of cybersecurity risk management. This integration aims to provide that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our enterprise technology and cybersecurity management teams to evaluate and address cybersecurity risks in alignment with our business objectives, regulatory requirements and operational needs.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity service providers, assessors, advisors and consultants, in evaluating and testing our cybersecurity program. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategies and processes are aligned to industry best practices. Our collaboration with these third parties includes threat assessments and consultation on security improvements, program maturity and regulatory compliance. Additionally, we conduct multiple penetration tests annually and retain an external consultant to periodically evaluate the overall state of our program.


text: Overseeing Third-Party Risk The Company has processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risks from Cybersecurity Threats Like all financial institutions, we, as well as our third-party service providers, are the target of various evolving and adaptive security threats, including malware, ransomware, phishing, credential validation and distributed denial-of-service attacks. Cyber-attacks have also focused on targeting online applications and services, such as online banking, as well as cloud-based and other products and services provided by third parties. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to the Company or our employees and customers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on the Company's operations, reputation and financial results.


text: The Company's Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and the significance of these threats to our operational integrity and stakeholder confidence. Accordingly, the Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Board of Directors, through its Risk Committee, reviews and approves the Company's risk management framework, including reviewing the overall risk appetite, risk management strategy and policies and practices established by management to identify and manage the risks we face. In addition, other Board committees are responsible for overseeing certain risks under their respective charters.


text: The Board's Risk Committee is central to the Board's oversight of cybersecurity risks and bears the primary oversight responsibility for this domain. The Risk Committee is composed of Board members with diverse expertise, including audit and finance and technology experience, equipping them to oversee cybersecurity risks effectively. The Risk Committee actively participates in strategic decisions related to cybersecurity, offering review and guidance on, among other things, program design, the Company's cybersecurity risk profile and the effectiveness of its risk management strategies.


text: The Board Risk Committee reviews and receives regular briefings from the Chief Information Officer, Chief Information Security Officer (the "CISO"), Chief Technology Officer, Chief Operating Officer, Chief Risk Officer, Senior Vice President – Enterprise Information Security, Chief Audit Officer, and Chief Executive Officer on information security and technology risks, including discussions of the Company's information security and cybersecurity risk management programs. The Board also receives regular reports on cybersecurity risks, vulnerabilities, incidents, staff security awareness training and overall progress to improve the Company's cybersecurity risk profile.


text: Senior management is responsible for creating and recommending for approval to the Board of Directors risk appetite metrics related to cybersecurity, reflecting the aggregate levels and types of risk the Company is willing to accept in connection with the operation of our business and pursuit of our business objectives.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 30 years of experience at the Company and held various information technology and information security risk management roles, including serving as a bank information security officer, and has a bachelor's degree and security certification.


text: The CISO is responsible for developing and implementing the Company's cybersecurity and information security program, reporting on cybersecurity matters to the Board and senior management, ensuring compliance with standards, remediating known risks, overseeing incident detection and response and leading the employee cybersecurity awareness training program. The Vice President – Cyber Risk Governance is responsible for third party cybersecurity risk management and cybersecurity risk and controls governance. The Senior Vice President – Enterprise Information Security provides regular updates to senior management and the Board's Risk Committee regarding the effectiveness of security controls and the state of the Company's cybersecurity program and risk level.


text: The Bank maintains a three lines of defense structure with the Cybersecurity Division as the primary security control owner, Enterprise Information Security providing review, assessment and challenge of risk management policies and processes, and an Internal Audit team providing independent review of the first and second lines of defense. The CISO facilitates communication across business lines to support effective and consistent information security risk identification and control infrastructure, maintaining an ongoing dialogue regarding emerging or potential cybersecurity risks, receiving updates on significant developments in the cybersecurity domain and ensuring that the Board's oversight is proactive and responsive.


text: The CISO, Senior Vice President – Enterprise Information Security, and Vice President – Cyber Risk Governance regularly inform the Chief Executive Officer, the Chief Operating Officer, the Chief Risk Officer, the Chief Information Officer, the Chief Technology Officer, the Chief Compliance Officer, and the Chief Audit Officer of all concerns related to cybersecurity risks and incidents, including the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. This aims to ensure that senior management is kept up to date on the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Company's Board of Directors, ensuring that they have comprehensive information and can provide oversight with respect to critical cybersecurity issues.


text: Monitoring Cybersecurity Incidents In addition to the monitoring and reporting described above, the Company maintains an Enterprise Information Security Response Program, which includes regular monitoring of information systems through deployment of security controls designed to detect and identify threats and sets forth immediate actions to mitigate the impact of cybersecurity incidents. The Company maintains a vulnerability management program to identify and remediate critical security vulnerabilities. An after-incident report is done to review critical events so as to inform long-term strategies for remediation and prevention of future incidents.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: an internal cybersecurity team that is responsible for establishing security standards and conducting regular assessments of our information systems, controls, vulnerabilities and potential improvements; continuous monitoring tools to detect and respond to cybersecurity threats in real-time;


text: performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures;


text: third-party cybersecurity consultants, who conduct periodic penetration testing and vulnerability assessments to identify potential weaknesses in our systems and processes; and periodic cybersecurity training for our workforce.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our program and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. The Chief Operating Officer is an experienced Certified Information Systems Security Professional (CISSP) with more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.


text: In addition, our board of directors, as a whole and through its Risk Oversight Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: We assess, identify and manage risks from cybersecurity threats through CNH's Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of CNH's larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors for CNH (the "CNH Audit Committee") and is managed by CNH's Chief Information Officer (the "CNH CIO") and a dedicated CNH Chief Information Security Officer (the "CNH CISO"). The CNH CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CNH CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial Capital LLC


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2024. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to CNH N.V.'s global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.


text: CNH's Board of Directors (the "CNH Board") addresses our cybersecurity risk management as part of its general oversight function. The CNH Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The CNH Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the CNH CIO and the CNH CISO. In addition, on at least an annual basis, the CNH Board receives reports, summaries or presentations from the CNH CIO and the CNH CISO related to cybersecurity threats, risk, mitigation and related processes.


text: The CNH CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third-party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy stipulates that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.


text: Our Director of Information Technology, who has extensive cybersecurity knowledge and skills gained from over twenty years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President — Chief Financial Officer. The Director of Information Technology receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implements by the Company to identify and mitigate data protection and cybersecurity risks. Our Director of Information Technology works with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of certain incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. As part of our overall risk mitigation strategy, the Company maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity incidents or other related breaches. Please refer to Part I, Item 1A "Risk Factors — Risks Related to Our Business" for additional information about our cybersecurity risks.


text: Due to the utilization of technology, Atlanta Braves Holdings is subject to material risks from cybersecurity threats. Accordingly, we have committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place to respond in a timely and appropriate manner. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see " Data loss or other breaches or disruptions of our information systems and information system security could materially harm our business and results of operations." in Part I, Item 1A – "Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program the CESC (as defined below) including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management We have established a cross functional Cybersecurity Executive Steering Committee ("CESC") led by our Senior Vice President ("SVP") and Head of Technology Services, Chief Legal Officer, Chief Financial Officer and other executives from our Legal, Accounting, Cybersecurity and Facilities departments. The CESC meets at least quarterly and has primary management oversight responsibility for assessing and managing information security, data protection and privacy, and cybersecurity risks.


text: Our SVP and Head of Technology Services, together with the Director Cybersecurity and IT Infrastructure, is responsible for day-to-day management and oversight of our cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The SVP and Head of Technology Services provides regular reporting to Braves Holdings executive management, the CESC and the Audit Committee.


text: A Compliance Committee has also been established and is responsible for overseeing and monitoring all corporate compliance initiatives at Braves Holdings, including cybersecurity. The Compliance Committee is composed of members of the CESC as well as the Braves Holdings executive leadership team, including the President and Chief Executive Officers of the Baseball and Development divisions, Chief Financial Officer and Chief Legal Officer. The SVP and Head of Technology Services provides periodic updates to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom, financial services and other industries, with decades of experience in various aspects of technology and cybersecurity. Our SVP and Head of Technology Services has more than 30 years of leadership experience, including delivering technology solutions and designing and building new business strategies in regulated businesses and our Director Cybersecurity and IT Infrastructure has more than 20 years of cybersecurity and information technology experience and is a Certified Information System Security Professional. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Our Cybersecurity Approach and Integration Technology is a fundamental element in our Company's permanent engagement with innovation and continuous improvement in the area of risk management and cybersecurity management strategy. As cybersecurity threats are becoming increasingly sophisticated and rapidly evolving, we have implemented processes for overseeing and identifying material risks from potential cybersecurity threats. Cyber risk management is a core component of our Company's governance structure, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. Our primary focus is information security.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Our Information Technology governance framework is composed of policies, procedures, standards, and methodologies to identify and manage risks among other aspects, which are governed by reference frameworks and best practices.


text: SCC's information security strategy is led by the Technology and Information Security Director ("TISD"), with review and support from the Chief Information Security Officer ("CISO") of Grupo Mexico. The main purpose of SCC's information security strategy is to identify and manage technological risks that could affect the Company's objectives and to strengthen our Company's resilience. As part of management's oversight of cybersecurity, the information security strategy is presented on an annual basis to SCC's Audit Committee of the Board of Directors, which reports to the full Board of Directors, with additional review and oversight by AMC's Risks Committee. In addition, we conduct a quarterly follow-up of our cybersecurity strategy's execution progress and any significant cybersecurity incidents are rigorously monitored.


text: Procedures for Information Security Risk Management and Information Security Risk Management Methodology based on the ISO 27005 Information security, cybersecurity and privacy protection standard and Control Objectives for Information and Related Technology ("COBIT"), which establishes criteria to identify, analyze, evaluate, treat and accept risks to the Company's technology infrastructure, including cybersecurity risks.


text: Our Risk Management Methodology is applied year-round and covers all of the Company's IT departments and processes. The results are used to generate and update risk and control matrices.


text: Cybersecurity risks are documented on the Information Security risks and controls matrices. Key risks and their treatment are tracked via these matrices as part of the Information Security processes, which include Vulnerability Management, Patch Management on Information Technology devices, Hardening, Information Security Incident Response, Information Security Culture Development and Cyber Threat Intelligence.


text: The IT risks and controls matrices are reviewed, authorized, and released annually by the Technology and Information Security Director. The matrices are then submitted to SCC's Internal Audit department to review and evaluate controls, in terms of design, implementation, and operational effectiveness.


text: Information Security Incident Management Procedure based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework We utilize the Cybersecurity Framework of the NIST to outline the activities and authorize personnel to handle information security and cybersecurity incident responses within the Company. This procedure outlines the phases of the incident response process, including detection and analysis; containment and intelligence development; eradication and remediation; recovery; and post-incident activities. Assessments include the qualitative and quantitative factors that are essential for determining materiality on information security and cybersecurity incidents.


text: In instances where a cybersecurity incident is classified and declared as material, our process is designed to meticulously document in a comprehensive report, all critical details such as the date and time of identification of the incident, a concise description of the incident's nature and scope, the impact of the incident on the Company's operations, and its current status (remediated or is undergoing remediation), in order to be clearly informed by the Company.


text: Information security and cybersecurity incidents undergo thorough review and assessment by the Information Security Subdirector, in collaboration with cybersecurity specialists and experts. Those incidents classified as material are reported to the Technology and Information Security Director, relevant Business Directors, and the Board's Audit Committee, with additional review by AMC's Productivity and Risk Committees. Simultaneously, these processes allow cybersecurity incidents classified as "material" to be promptly disclosed to the SEC in a Form 8-K report within 4 business days of the Company's determination that such incident is in fact a "material" incident.


text: Oversight of Third-Party Service Providers Security Assessment Process for IT Service Providers Our Security Assessment Process for IT Service Providers is based on the ISO 27001 Information security, cybersecurity, and privacy protection standard. This standard's guidelines ensure that service providers design and implement procedures and notification mechanisms for incident response management within their technological infrastructure. All contracts with IT service providers must stipulate the service levels required by the Company.


text: Regular meetings are conducted with IT service providers to assess compliance with contracted services, which includes a report on detected information security and cybersecurity incidents, activities for their remediation, and findings and insights from previous reviews and improvements.


text: Engagement with External Experts The Company engages top-tier external cyber security firms as needed and leverage their expertise. This is part of our ongoing effort to evaluate and enhance our cybersecurity program. The information security strategy includes assessments conducted by third parties and the engagement of specialized services for specific tasks, including:


text: Internal and External Penetration Testing of SCC's Technology Infrastructure: This service is contracted at least annually to identify and remediate vulnerabilities that may exist at the infrastructure and critical operation systems levels.


text: Cybersecurity Organizational Maturity Assessment: The objective of this service is to understand the level of risk and maturity of the Company's cybersecurity controls (Cybersecurity Assessment). The results of Cybersecurity Assessments are used to design and implement work plans.


text: Disclosure of Management's Responsibilities Technology and Information Security Director and Information Security Subdirector Our management possesses significant expertise in the assessment and management of cybersecurity risks. TISD, and the Information Security Subdirector ("ISD"), has extensive experience in the areas of information technology, information security risk management, and cybersecurity. Specific to cybersecurity, the TISD and the ISD have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions that should be taken to mitigate such risks.


text: The TISD, under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The current TISD has more than 25 years of IT experience and has spent 15+ years overseeing cybersecurity strategy, implementation, and operation. Additionally, he holds a Master's degree in IT Management and a Master's Degree in Business Administration.


text: The ISD, under the direction of the TISD, is responsible for overseeing the organization's cybersecurity and promoting a security-centric culture throughout our operations. The ISD is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. Additionally, the ISD oversees the cyber risk management function, which identifies cybersecurity threats and assesses cybersecurity risks. Our ISD has more than 12 years of experience in the cybersecurity field and holds a Computer Engineering degree.


text: Risk Committee and Productivity Committee The Company's holding company, AMC, has the following Committees, that convene several times a year: AMC Productivity Committee


text: AMC Risks Committee These committees provide support to the Company's Board of Directors with respect to information security and cybersecurity matters. In particular, the Risk Committee provides oversight of the Company's risk management, cybersecurity, and operational compliance activities, as well as a means of bringing risk issues to the attention of management.


text: Disclosure of the Board's Roles and Responsibilities The Board of Directors is responsible for global oversight of our strategic and operational risks. The Audit Committee assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports its findings to the Board of Directors.


text: The Audit Committee The Audit Committee is responsible for overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, our information security strategy is periodically presented to the Audit Committee, which reports to the full Board of Directors. Regular meetings are held to report to the Audit Committee, which include a risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Risk Committee.


text: The Internal Audit Department The Internal Audit department of SCC operates in accordance to an Annual Plan that has been approved by the SCC Audit Committee. This plan encompasses the design and execution of system audits, including testing of cybersecurity controls and protocols. Recommendations from both Internal and External experts are thoroughly reviewed and evaluated and may be implemented if findings so merit.


text: Cybersecurity Incident Impact While we identified no cybersecurity incidents, we have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. For additional discussions of risks from cybersecurity threats we face, see Item 1A "Risk Factors". There were no material cybersecurity incidents in 2024.


text: We prioritize the management of cybersecurity risk and the protection of information across the Company by embedding data protection and cybersecurity risk management in our operations. The Company follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and other industry standards and applicable laws and regulations to assess and manage cybersecurity risks within our services, infrastructure, and corporate resources. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes through a layered governance structure.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: The Company maintains an enterprise-wide risk management ("ERM") process to identify, assess and monitor risks that are or may become material to our business. Our ERM process includes participation by senior management, other leaders, and employees across the business in surveys and discussions about the risk environment with certain members of senior management and management level leaders meeting quarterly to discuss the Company's top risks as identified through our ERM process.


text: Our cybersecurity policies and controls encompass incident response procedures, information security, and IT vendor risk management. We monitor the cybersecurity laws, regulations, and guidance applicable to us in the maintenance of these policies and procedures, including, but not limited to, regulations issued by the U.S. Department of Homeland Security, as further described in Item 1 (Business) of this Annual Report on Form 10-K, as well as proposed laws, regulations, guidance, and emerging risks.


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by artificial intelligence, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2024. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 38 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for five years and previously served as our director of infrastructure management for 12 years. Our CTO reports directly to the Company's Chief Innovation Officer and indirectly to the Company's President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 33 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.


text: We also have management-level committees who support our processes to assess and manage cybersecurity risk and related incidents as follows:


text: The Information Security Committee, chaired by our Director of Information Security, includes IT, legal, compliance and other business leads. The Information Security Committee provides a forum for these cross-functional members of management to consider existing and emerging cybersecurity risks; review cybersecurity regulations; determine cybersecurity project prioritization; approve, review, and update policies and standards, as appropriate; and promote cross-functional collaboration to manage cybersecurity risks across the enterprise to support the Company's goals and address cybersecurity risks.


text: The Risk Management Committee, comprised of senior IT, operations, risk, legal, and compliance leaders across business segments, monitors enterprise risk management for the Company, including all subsidiaries. Among other processes, this committee reviews the Company's programs and processes related to information security, third-party risks, vendor management, business disruption, business continuity, and disaster recovery, identifying gaps in the current risk management processes and considering potential risks due to changes in laws or the regulatory environment.


text: The Cybersecurity Incident Response Team, which includes representatives from our information security and technical services departments, in addition to company management and executives across the Company, is activated when a suspected incident is reported or discovered and is responsible for dissemination of information and coordination of personnel efforts required to successfully respond to an incident.


text: The Cybersecurity Incident Reporting Committee was formed to assess the materiality of cybersecurity incidents from a Securities and Exchange Commission reporting standpoint. In the event this committee determines a cybersecurity incident is material, committee members, as delegated, will notify the Audit Committee. The CTO provides a quarterly cybersecurity risk update and presents an annual cybersecurity review to our Board of Directors.


text: We also conduct mandatory company-wide security awareness training and periodic phishing tests and generally seek to promote awareness of cybersecurity risks through regular communication and education of our employees.


text: In today's increasingly interconnected world, cybersecurity is not just a concern, it's a fundamental responsibility. At Monarch Casino & Resort, Inc., we understand that the security of our digital assets is essential to safeguarding our critical infrastructure, ensuring the confidentiality and integrity of sensitive information, maintaining business continuity, and fostering trust with our stakeholders.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: We are developing and implementing a robust and comprehensive cybersecurity program that aligns with industry best practices, regulatory requirements, and our Company's specific risks in the evolving threat landscape. This program is designed to not only address current challenges but also proactively position us to mitigate future risks and maintain a resilient digital posture.


text: The foundation of our cybersecurity framework is built on continuous risk management practices. We conduct regular threat assessments, administrative reviews, and vulnerability scans to proactively identify and evaluate cybersecurity risks. Our strategy is developed to be in harmony with our business objectives, incorporating industry best practices, staying abreast of evolving cyber threats, and complying with regulatory standards.


text: Recognizing the critical role of human factors in cybersecurity, we implement comprehensive education and awareness programs for all employees. These programs are designed to promote safe online practices and encourage prompt incident reporting. Additionally, we conduct phishing simulations and other exercises to measure and improve our employees' ability to recognize and respond to cyber threats effectively.


text: Our incident response and recovery planning is a key component of our cybersecurity efforts. We have developed and documented an incident response plan that outlines specific procedures for identifying, containing, and remediating cyber incidents. Regular testing of this plan ensures its effectiveness, with adjustments made as necessary. Furthermore, we maintain backups of essential data and systems to enable swift recovery from any cyber incidents.


text: On the technical front, we deploy a variety of safeguards to protect our systems. These include firewalls, intrusion detection and prevention systems, data encryption, and strict access controls. Regular updates and patches are applied to software and firmware to mitigate known vulnerabilities and strengthen our security posture.


text: Risk assessment is an ongoing process within our organization. We routinely perform assessments to identify, analyze, and prioritize cybersecurity risks. The outcomes of these assessments directly inform our cybersecurity strategy and guide the allocation of resources.


text: In response to the recent SEC cybersecurity disclosure rule, we have updated our cybersecurity program to incorporate the requirements to disclose, as appropriate or required and if deemed to be material, such a material incident via a Form 8-K within four (4) business days of determining the occurrence of such a cybersecurity incident.


text: Our chief information officer and our security architect are responsible for day-to-day assessing and managing the cybersecurity risk and threats through internal assessment tools as well as third-party control tests, for audits and evaluation against industry standards and regulations. Our chief information officer has over twenty-five years leading IT and Cybersecurity teams and continually improve his expertise through cybersecurity classes and collaborate with cybersecurity professionals in hospitality industry.


text: In addition, we have a management Cybersecurity committee, which is comprised of chief executive officer, chief information officer, corporate director of internal audit and executive vice president of finance. The Cybersecurity committee is responsible to set strategy and ensure our cybersecurity program is consistently evaluated and kept up to date with the latest developments in the cybersecurity.


text: Our board of directors plays a crucial role in overseeing our cybersecurity program. The board receives regular updates on cybersecurity program's status and effectiveness by the Cybersecurity committee. The audit committee oversees the cybersecurity program and provides strategic guidance to management, ensuring that our approach to cybersecurity remains robust, proactive, and aligned with our business needs.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. In the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or our partners, collaborators, vendors, or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our business. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. In 2024, Plug continued to fortify its comprehensive cybersecurity and risk controls. We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company and evaluate potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. We mandated an annual cybersecurity awareness training module, enhanced our Information Technology Infrastructure Library (ITIL) based discipline of change and incident management, and overhauled our monthly patching/vulnerability management rigor. Additionally, Plug continued leveraging top-tier third party support for external and perimeter examination: completing exhaustive Penetration Testing and Vulnerability Scans (performed by OrbitalFire), establishing a robust Network Operations Center (NOC), and leveraging industry-leading endpoint monitoring and detection services (CrowdStrike). Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.


text: The Vice President of Information Technology (" VP of IT ") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").


text: Our governance framework includes oversight by the Audit Committee of the Board of Directors. The Audit Committee meets quarterly with the CFO regarding the cybersecurity risk management program, including as relates to critical cybersecurity risks and cybersecurity initiatives and strategies. Additionally, on an annual basis, the VP of IT reports the current state of cybersecurity risk management to the full Board of Directors. The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience, threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".


text: Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In seeking to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrusted to us, a top priority. The board of directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company, including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled "System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Our policies and processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer and supplier disclosure, public disclosure and reporting of such incidents can be made by management and the board of directors in a timely manner.


text: Annually, the Security Committee (defined below) conducts a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes and inform a broader enterprise-level risk assessment that is analyzed by the Security Committee and presented to the board of directors, Audit Committee and members of management.


text: Technical Safeguards The Company's cybersecurity program evaluates new threats to learn new attacker techniques, adopt defenses and implement new safeguards to protect our information systems from cybersecurity threats. These safeguards are evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Independent assessments of the safeguards by external third-party consultants, which also include the detection of threats, are evaluated and improvements to systems are incorporated.


text: In an effort to effectively respond to a security event, we follow a comprehensive cybersecurity incident response plan. We regularly review, test and evaluate the plan for effectiveness.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our Company policies require our employees to assist in the protection of our customers' data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigation strategies and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We conduct regular independent cyber audits to assess our controls and alignment against the NIST Cybersecurity Framework, compromise assessments to baseline and assess if a current or past compromise had occurred within our infrastructure, and maintain industry certifications and attestations that demonstrate our dedication to protecting customer data. The results of significant assessments are reported to management, the board of directors and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: The board of directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee, as part of its risk oversight function, is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments and relevant internal and industry cybersecurity incidents.


text: Our Chief Information Security Officer ("CISO"), Chief Information Officer ("CIO"), Chief Technology Officer ("CTO"), Chief Legal and Compliance Officer ("CLCO") and Director of Information and Cybersecurity ("DC") have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the "Security Committee"), which drives alignment on security decisions across the Company. The CISO has over 20 years of experience in various roles related to information security and related technology, including roles specific to managing security requirements related to organizations operating in the payment card industry. The CIO, CTO and DC also each have over 20 years of experience serving in various roles in information technology fields; the CIO has over 25 years of global technology leadership across fintech, software, and payments industries, leading technology, product, and engineering organizations for multinational companies, with extensive experience in implementing software solutions and managing risk across the entire technology lifecycle. The CTO has been with the Company since 2014 and the DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 20 years of experience managing risks and related disclosure requirements, including risks arising from cybersecurity threats, at publicly traded companies. The Security Committee meets at least quarterly to evaluate security performance metrics, prioritize risks identified through threat intelligence, vulnerability and risk assessments, external audits, and incident response insights, and review the progress of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies.


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall risk management and compliance approach, the Company's cybersecurity program is focused on the following key areas:


text: The board of directors' oversight of cybersecurity risk management is led by the Audit Committee of the board of directors, which regularly interacts with our Chief Compliance Officer, our Chief Financial Officer, and other members of management.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.