text: On the management side, our ERM committee oversees the firm's risk management process, which includes oversight of cybersecurity. Our CTO is a member of this committee, along with other of the most senior professionals at the firm, including our chief operating officer who is also our chief risk officer. Our CTO updates the ERM committee on cybersecurity matters on a quarterly and as-needed basis.


text: Our CTO has over 20 years of technology and cybersecurity-related experience. Prior to joining the Company, he was Vice President of Operations & Security at Linode, where he led systems engineering, information security & compliance, hardware research & development, and project/product management, and previously held senior positions at GE and GE Digital. He received an M.B.A from Penn State University and a B.S. in Information Sciences & Technology from Penn State University.

companyName: Hamilton Lane INC

ticker: HLNE

secItem: Item 1C


text: To support management's role in assessing and managing cybersecurity threats, our cybersecurity team conducts periodic security review meetings designed to identify vulnerabilities and review remediation efforts. In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our ERM committee, and mitigation and remediation actions. We also have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers.


text: We maintain a comprehensive cybersecurity program that includes policies and procedures designed to protect our systems, operations and data from unauthorized access, theft and destruction. We utilize a variety of protective measures as part of our cybersecurity program, including: • reviews of our network access rights and controls; • penetration testing; • patch management; • annual security awareness trainings and assessments for all employees and contingent workers; • security information and event management software to identify anomalies; • periodic security review meetings designed to identify vulnerabilities and review remediation efforts; • a vendor risk management program; and • cybersecurity tabletop exercises.


text: We also maintain a comprehensive Security Response Policy designed to inform proper escalation of non-routine cybersecurity events and to coordinate our actions across departments. The policy sets forth, among other things, the following actions in the event of a suspected security breach: incident verification by our cybersecurity team; notification of our cybersecurity committee, which oversees incident response; assessment of potential impact and materiality; notification of our incident disclosure response team; coordination regarding internal and external communications, including preparation of disclosures on Form 8-K, as necessary; and determination of mitigation and remediation actions with the goal of restoring business continuity. Our Chief Technology Officer ("CTO") serves as security coordinator and leads our cybersecurity and information technology team. As of March 31, 2025, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect our Company, including our business strategy, cash flows, financial condition or results of operations.


text: We engage diligenced third parties as part of our cybersecurity program. On a periodic basis, we engage third-party auditors to assess our cybersecurity controls and procedures. We also engage reputable third-party security firms to conduct annual penetration tests of our physical and digital security. We then work to remediate critical vulnerabilities identified through these assessments.


text: Our cybersecurity processes are integrated into our Company's overall risk management processes. Our CTO is a member of our cybersecurity and ERM committees and cybersecurity issues are raised to these committees. In addition, our CTO reports to the audit committee of our board of directors bi-annually, regarding our cybersecurity program and material risks, and once annually to our full board of directors, regarding overall cybersecurity strategy.


text: We have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers. Our approach is tailored based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. For critical vendors who will have access to our systems or data, we diligence their cybersecurity practices prior to engagement, including requiring responses to standardized information gathering questionnaires. We may conduct additional reviews of certain vendors depending on criticality or risk. In addition, where we consider it to be appropriate, we seek to include in our contractual arrangements with certain of our third party vendors provisions addressing best practices with respect to data and cybersecurity, including the right to audit and test their compliance with these contractual requirements.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Risk Factors—Failure to maintain the security of our information technology networks, or those of our third-party service providers, or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow" in Part I, Item 1A of this Form 10-K.


text: Our board of directors has delegated oversight of the Company's cybersecurity risks to the audit committee. The audit committee reviews the Company's information technology and data protection strategies, oversees and assesses risk with respect to cyberattacks and data privacy matters and receives bi-annual updates from our CTO. The audit committee then provides updates and recommendations to the full board on cybersecurity matters.


text: On the management side, our ERM committee oversees the firm's risk management process, which includes oversight of cybersecurity. In addition, we have a cybersecurity committee that directly oversees the firm's cybersecurity program and is responsible for cybersecurity strategy, risk assessment and management, and incident response management. Our CTO is a member of the cybersecurity committee, along with other of the most senior professionals at the firm, including our chief operating officer (who is also our chief risk officer) and chief compliance officer. Our CTO also updates our ERM committee on cybersecurity matters on a quarterly and as-needed basis.


text: To support management's role in assessing and managing cybersecurity threats, our cybersecurity team conducts periodic security review meetings designed to identify vulnerabilities and review remediation efforts. In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our cybersecurity committee, and mitigation and remediation actions. We also have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers.


text: We maintain a comprehensive technology and cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality, integrity, and availability of our information assets. We regularly perform evaluations and testing of our security program, information technology infrastructure, information security management systems, and third-party service providers we use in our operations.

companyName: JBT MAREL Corp

ticker: JBTM


text: Our cybersecurity program is led by our Chief Information Security Officer (the "CISO"), a Certified Information Systems Security Manager with over 10 years of related experience, including oversight over any third-party service providers used in connection with our cybersecurity program. Our cybersecurity program includes the implementation of controls aligned with best practices in cybersecurity and applicable statutes and regulations to identify threats, detect attacks, and protect our information assets. We use preventative and detective tools and utilities that provide alerts of vulnerabilities and missing patches for our systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have developed an incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a breach. In addition, our employees participate in an ongoing program of mandatory annual training and receive frequent communications regarding the cybersecurity environment to increase awareness throughout the company. We have also implemented an annual training program for specific specialized employee populations, including secure coding training. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: We have established a Cybersecurity Steering Committee comprised of key leaders across the Company whose responsibilities include oversight of technology, security, and reporting functions. The objective of the Cyber Security Steering Committee is to set policies and procedures for the Company in relation to cyber events, including the Company's response protocols and disclosure requirements upon occurrence of any cyber event that is considered material to the Company.


text: The Audit Committee reviews cybersecurity information technology risks in connection with its oversight of our enterprise risk management system, and reports to the Board on enterprise risk management matters on a quarterly basis. If a cybersecurity event is identified by the CISO, management and the Cyber Security Steering Committee report any material security instances to the Audit Committee and the Board as they occur. Additionally, our CISO meets regularly with our senior management team and the Board of Directors or the Audit Committee to brief them on technology and information security matters, including cybersecurity risk related matters.


text: We carry insurance that provides protection that may reduce the potential losses arising from a cybersecurity incident. Past cybersecurity incidents have not materially affected the Company, including our business strategy, results of operations or financial condition.


text: We maintain a comprehensive technology and cybersecurity program to ensure our systems are effective and prepared for information security risks, utilizing regular oversight of our programs through security monitoring and alerting for internal and external threats to ensure the confidentiality, integrity, and availability of our information assets. We regularly perform evaluations and testing of our security program, information technology infrastructure, information security management systems, and third-party service providers we use in our operatio ns.


text: Our cybersecurity program is led by two Chief Information Security Officers (the "CISOs"), both of whom are Certified Information Systems Security Managers with over 15 years of related experience. Their areas of influence are split into two scopes, Business Information Security (CISO - BIS) and Compliance Information Security (CISO - CIS). The mission of the CISO - BIS is second line defense, to define and execute business operations security, cybersecurity operations activities and to identify and mitigate risks. The mission of the CISO - CIS is third line defense, with a focus on governance, risk, and compliance, audits, third-party risk management, and validation of regulatory compliance for the security program. Our cybersecurity program includes the implementation of controls aligned with cybersecurity best practices to identify threats, detect attacks, and protect our information assets. Our cybersecurity program aligns with applicable statutes and regulations to stay abreast of current compliance requirements. We use preventative and detective tools and utilities that provide alerts of vulnerabilities and threats, and alert to patch management requirements. Security monitoring capabilities are designed to alert us to suspicious activity providing the opportunity for quick risk mitigation and remediation. Our incident response program is tested periodically and is designed to provide a clear guide, procedures and communications matrix to adhere to in the event of an incident. The plan facilitates risk mitigation and leads to business recovery and restoration as quickly and as orderly as possible in the event of a critical security incident. In addition, our employees participate in an ongoing program of monthly security awareness training and receive frequent communications regarding the cybersecurity environment to increase awareness throughout the company. We have also implemented an annual training program for specific specialized employee populations, including secure coding training. Notwithstanding the extensive approach we take to cybersecurity, because cyber threats are always evolving, there remains the possibility of a cybersecurity incident which could have a material adverse effect on the organization.


text: We have established a Cybersecurity Steering Committee comprised of key leaders across the Company whose responsibilities include oversight of cybersecurity incident materiality, security, governance, and reporting functions. The objective of the Cybersecurity Steering Committee is to set policies and standards for the Company in relation to information security and cyber events, including the Company's response protocols and disclosure requirements upon occurrence of any cyber event that is considered material to the Company.


text: The Audit Committee reviews cybersecurity information technology risks in connection with its oversight of our enterprise risk management program, and reports to the Board on enterprise risk management matters on a quarterly basis. If a critical cybersecurity event is identified by the CISOs, the Cyber Security Steering Committee, with input from the business, will assess its materiality, and events that are deemed material will be reported to the Audit Committee and the Board of Directors. Additionally, our CISOs meet regularly with our senior management team and the Board of Directors or the Audit Committee to brief them on technology and information security matters, including cybersecurity risk related matters.


text: We carry insurance that provides protection that may reduce the potential losses arising from a cybersecurity incident. Risks from cybersecurity threats, including as a result of past cybersecurity incidents have not materially affected and are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: Related to Cybersecurity Risks Cybersecurity risk oversight is a top priority for management and our board of directors. Management is responsible for the day-to-day management of cybersecurity risks we face, while our board of directors, as a whole and through committees, is responsible for the oversight of risk management.

companyName: LendingTree, Inc.

ticker: TREE


text: Our Chief Information Security Officer ("CISO") is responsible for the assessment and management of cybersecurity risk. The individual currently serving as our CISO has over twenty-five years of experience in cybersecurity, information security, and risk management within the financial services industry. The CISO reports to our Chief Executive Officer ("CEO") and provides updates to him on a regular basis of any cybersecurity matters.


text: Our board of directors oversees the management of our risks from cybersecurity threats. The board of directors has delegated the responsibility for the oversight of our cybersecurity risks program to the Audit Committee. The CISO provides cybersecurity updates to our Audit Committee as needed but at least on a quarterly basis covering cybersecurity matters, including a security scorecard, updates on policies, significant incidents or new developments in our cybersecurity risk profile. Our incident response process contemplates that management will notify the audit committee of a material cybersecurity incident.


text: Cybersecurity is critical to our ongoing business as a provider of online marketplaces where consumers shop for financial services. Securing our business information, intellectual property, consumer, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stakeholders.


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, engaging third party experts and implementing cybersecurity training for our employees. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual cybersecurity risk assessment. Further, we conduct periodic external penetration tests to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program to protect our investors, consumers, customers, employees, vendors, and intellectual property.


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and General Counsel ("GC").


text: We face a number of cybersecurity risks in connection with our business. Although we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Our board of directors oversees the management of our risks from cybersecurity threats. The board of directors has delegated the responsibility for the oversight of our cybersecurity risks program to the Audit Committee. The CISO provides cybersecurity updates to our Audit Committee as needed but at least on a quarterly basis covering cybersecurity matters, including a security scorecard, updates on policies, significant incidents or new developments in our cybersecurity risk profile. Our incident response process contemplates that management will notify the audit committee of a mater ial cybersecurity incident.


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer and General Counsel.


text: We face a number of cybersecurity risks in connection with our business. Although we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Rapidly evolving threats to the cybersecurity landscape necessitate ongoing efforts to manage the risk of unauthorized access to the Company's information systems and devices, including those of the Company and of third-party providers. The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information. The company employs various aspects of risk assessment regularly, and to the extent possible, continuously. Further, the Company uses a defense in depth, or layered, approach to strengthen the security environment and mitigate the impact of any potential threats. Cybersecurity risks are strategically managed under the leadership of the Vice President, IT Operations and Security, who has achieved preeminent certification as a Certified Information Security Manager (CISM) and Certified Cloud Security Professional (CCSP) and has served as the most senior IT resource in many different roles.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which is used along with a risk-based approach to plan and implement changes or improvements to the security environment. The Company has engaged independent experts to assess the security environment for potential vulnerabilities or weaknesses and has plans for future engagements periodically to supplement the expertise and processes established within the Company. Thorough updates are provided to the board of directors quarterly by the Vice President, Information Technology (IT) Operations and Security. The directors may ask questions or engage in further discussion related to the security environment.


text: Employees are one of our most valuable resources and it is essential that education, particularly related to social engineering, is persistent and relevant. The Company requires ongoing cybersecurity awareness training for all employees, including weekly simulated emails to test the knowledge and reaction of employees. The training is, customized based on actual events or anticipated emerging threats, keeping the education applicable and purposeful.


text: The Company utilizes various continuous monitoring methods for identification and notification of attempted unauthorized system access. Tools deployed throughout the Company track these attempts allowing for trend analysis and strategic adaptation. The Company has also established an incident response policy that thoroughly and systematically documents the Company's response and assigns responsibility to facilitate timely, organized and appropriate action during a security event or incident, including assessment of the impact and materiality of the event or incident. Incident management is led by the Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities.


text: In the regular course of our business, the Company manages a range of sensitive security, customer, and business systems information. A security breach of our information systems such as theft or the inappropriate release of certain types of information, including confidential customer, employee, financial or system operating information, could have a material adverse impact on our financial condition, results of operations or cash flows. The Company operates in a highly regulated industry that requires the continued operation of sophisticated information technology systems and network infrastructure. Despite implementation of security measures, the technology systems are vulnerable to disability, failures or unauthorized access. Facilities, information technology systems and other infrastructure facilities and systems and physical assets could be targets of such unauthorized access. Failures or breaches of our systems could impact the reliability of systems and also subject the Company to financial harm. If the technology systems were to fail or be breached and if the Company is unable to recover in a timely way, fulfilling critical business functions and sensitive confidential data could be compromised, which could have a material adverse impact on the Company's financial condition, results of operations or cash flows.


text: The Company has experienced, and expects to continue experiencing, these types of threats and attempted intrusions. The implementation of additional security measures could increase costs and have a material adverse impact on the Company's financial results. Cyber insurance has been obtained to provide coverage for a portion of the losses and damages that may result from a security breach of information technology systems, but such insurance may not cover the total loss or damage caused by a breach. In addition, all costs of responding to and recovering from a cyber incident may not be covered by insurance. These types of events could also require significant management attention and resources, and could adversely affect the Company's reputation with customers and the public.


text: As operators of critical infrastructure, the Company may face a heightened risk of cyberattacks from internal or external sources. Unauthorized access to confidential information located or stored on these systems could negatively and materially impact customers, employees, suppliers and other third parties. Further, third parties, including vendors, suppliers and contractors, who perform certain services or administer and maintain our sensitive information, could also be targets of cyberattacks and unauthorized access. While the Company has instituted safeguards to protect the information technology systems, those safeguards may not always be effective due to the evolving nature of cyberattacks and cyber vulnerabilities. The Company cannot guarantee that such protections will be completely successful in the event of a cyberattack.


text: If the information technology systems, or that of third parties on which the Company relies, are affected by a significant cyber breach, this could result in, among other things, a significant disruption to operations; costly investigations and remediation; misappropriation of confidential information of the Company or that of customers, employees, business partners or others; litigation and potential liability; enforcement actions and investigations by regulatory authorities; loss of customers and contracts; harm to reputation; and a loss of management time, attention and resources from regular business operations, any of which could have a negative impact on business, results of operations, and cash flows. As previously discussed, the Company is subject to laws and rules issued by multiple government and private agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information. The increasing promulgation of rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards.


text: Rapidly evolving threats to the cybersecurity landscape necessitate ongoing efforts to manage the risk of unauthorized access to the Company's information systems and devices, including those of the Company and of third-party providers. The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of its security, customer and business information. The Company employs various aspects of risk assessment regularly, and to the extent possible, continuously. Further, the Company uses a defense in depth, or layered, approach to strengthen the security environment and mitigate the impact of any potential threats. Cybersecurity risks are strategically managed under the leadership of the Vice President, IT Operations and Security, who has achieved preeminent certification as a Certified Information Security Manager (CISM) and Certified Cloud Security Professional (CCSP) and has served as the most senior IT resource in many different roles.


text: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which are used along with a risk-based approach to plan and implement changes or improvements to the security environment. The Company has engaged independent experts to assess the security environment for potential vulnerabilities or weaknesses and has plans for future engagements periodically to supplement the expertise and processes established within the Company. Thorough updates are provided to the board of directors quarterly by the Vice President, IT Operations and Security. The directors may ask questions or engage in further discussion related to the security environment.


text: Employees are one of our most valuable resources, and it is essential that education, particularly related to social engineering, is persistent and relevant. The Company requires ongoing cybersecurity awareness training for all employees, including weekly simulated emails to test the knowledge and reaction of employees. The training is customized based on actual events or anticipated emerging threats, keeping the education applicable and purposeful.


text: The Company utilizes various continuous monitoring methods for identification and notification of attempted unauthorized system access. Tools deployed throughout the Company track these attempts, allowing for trend analysis and strategic adaptation. The Company has also established an incident response policy that thoroughly and systematically documents the Company's response and assigns responsibility to facilitate timely, organized and appropriate action during a security event or incident, including assessment of the impact and materiality of the event or incident. Incident management is led by the Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks we face, see "Risk Factors—Technology Factors—Our information technology systems may be vulnerable to unauthorized external or internal threats due to hacking, ransomware, viruses or other cybersecurity breaches," included in Part I, Item 1A of this report.


text: We prioritize the protection of our data assets, the private data of our employees, customers, and vendors, and personal information. To assess, identify, and manage the risks of cybersecurity threats to our information systems and the associated costs, we maintain a robust cybersecurity program that is integrated into the Company's overall Enterprise Risk Management strategy. We understand that threats from hackers and other cyber criminals continues to adapt and become more sophisticated, and so must our response to these threats.

companyName: Mistras Group, Inc.

ticker: MG


text: Our Board of Directors ("the Board") is responsible for oversight of our information security program. The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy risk, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: The Divisional Vice President of IT has a biannual meeting with the Audit Committee and other senior executives to provide an update of our current cyber security posture, IT Risk assessment, and compliance with multiple applicable regulations, frameworks, and other privacy initiatives. The Divisional Vice President of IT, along with the Information Technology Leadership Team, also meet with other senior executives every other week throughout the year to discuss on-going cyber security and governance initiatives and risk mitigations. The Divisional Vice President of IT has fifteen years of cybersecurity experience, including ten years with Mistras Group, and the Information Technology Leadership Team has a combined fifteen years of cybersecurity experience, including a combined ten years with Mistras Group. The Divisional Vice President of IT and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles.


text: The Divisional Vice President of IT manages both an Information Security team and an IT Risk team within the Department of Information Technology. The IT Risk team is responsible for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and CUI, and internal policies and procedures. The Cyber Security team is responsible for identifying and implementing technologies to mitigate IT risk, enhance data security, and identify and defend against attacks. Both teams work closely together to establish the cybersecurity policies for the Company, evaluate the current risk profile, and to prevent, investigate, mitigate, and remediate any cyber-attacks on the Company.


text: The IT Risk team uses an asset-based risk approach for evaluating cybersecurity risks and appropriate risk mitigation. All IT assets are reviewed against a broad range of risks twice a year and are evaluated for likelihood of occurrence and impact should they occur. These risks are then mapped to our global inventory of systems and the type of data as well as the number of systems to which a risk applies are evaluated. These factors are used to determine a risk score for each of the reviewed risks, and mitigations are subsequently applied to reduce those risk scores to determine the areas of focus for increasing mitigations. This exercise is logged biannually to monitor improvement.


text: We have several physical, automated, and administrative controls in place to mitigate the success and extent of any cyber breaches. Our controls are designed to require review of tasks which may occur in the normal course of business but are also common vectors of attack. Automated controls are implemented in all cases where one is feasible, and in other cases standard procedures or documented instructions are in place to ensure that actions are proper and approved before they occur.


text: Policies related to cybersecurity risks are documented, reviewed annually, and published internally, which define the correct processes for identifying, containing, remediating, and responding to cybersecurity incidents. Our data protection policies define the establishment of the classification of types of data. Based upon this data classification, we determine an incident's materiality and establish the appropriate response, the incident management team, and the communications required to be distributed to third parties. Incident management policies are in place to establish the proper communication channels and responsible parties for different levels of materiality of an incident. We practice these policies and procedures in a tabletop or simulated fashion multiple times annually.


text: Each employee plays a role in safeguarding our data assets, and the protection of our data is ingrained in every employee's day to day activities. Employees must participate in annual Cyber Security training. Simulated testing occurs multiple times throughout the year, including drop testing and SPAM / PHISHING campaigns, and the results are tracked for compliance and we address any weaknesses identified in such trainings and testings as necessary.


text: The Information Security team performs internal threat hunting, vulnerability scanning, log aggregation, and identity monitoring on an on-going basis. Web site, code, and configuration vulnerability scans are performed as necessary to ensure that changes do not introduce vulnerabilities into our systems. Information Security and IT Risk personnel receive regular training to ensure up-to-date expert knowledge.


text: To supplement our cybersecurity risk assessment, identification, management, and mitigation efforts, we engage third party cyber security experts. Cyber security assessments are performed at least annually, results are documented and reviewed, and mitigation plans are put in place to reduce any threats identified. The classification of data processed by any system is considered when implementing mitigations.


text: We recognize the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party vendors. We perform a thorough review of the cyber security measures in place, including any documented third-party audits, for any partners who process our data. Sign-off is required by the Information Security team before agreements can be put in place.


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, as of the date of this Annual Report, management has determined that none of the cybersecurity attacks that we have experienced has resulted in a material impact on our financial condition, results of operations or business strategy. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We face risks regarding our information technology and security".


text: Our Board is responsible for oversight of our cybersecurity program. The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy ris k, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations. Our cybersecurity risk management and internal controls program are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.


text: As part of our cybersecurity program management activities and our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures, we actively engage internal and prominent external experts, as well as industry participants. Our cybersecurity program is managed by the Chief Information Officer who has biannual meetings with the Audit Committee and provides periodic reports and updates concerning our cybersecurity program to our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on our cyber risk and threats, the status of projects to strengthen our information network and data security, assessments of our information security program, and the emerging threat landscape. We have established governance committees to provide us with cybersecurity oversight with supportive roles to advance the effectiveness of our cybersecurity program. The Chief Information Officer has over 20 years of IT leadership and cybersecurity experience, and the Information Technology Leadership Team overall has a combined fifteen years of cybersecurity experience. The Chief Information Officer and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles and stay informed on the latest trends and technologies.


text: The Chief Information Officer manages both an Information Security team and an IT Risk team within the Department of Information Technology. The IT Risk team works closely with our Data Privacy Officer for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and controlled unclassified information, and internal policies and procedures. The Cyber Security team is responsible for identifying and implementing technologies to mitigate IT risk, enhance data security, and identify and defend against attacks. Both teams work closely together to establish the cybersecurity policies for the Company, evaluate the current risk profile, and to prevent, investigate, mitigate, and remediate any cyber-attacks on the Company.


text: Each employee plays a role in safeguarding our data assets, and the protection of our data is ingrained in every employee's day to day activities. Employees must participate in annual cyber security training. Simulated testing occurs multiple times throughout the year, including drop testing and SPAM / PHISHING campaigns, and the results are tracked for compliance and we address any weaknesses identified in such trainings and testings as necessary.


text: The Information Security team performs internal threat hunting, vulnerability scanning, log aggregation, and identity monitoring on an on-going basis. Web site, code, and configuration vulnerability scans are performed as necessary to ensure that changes do not introduce vulnerabilities into our systems. Information Security and IT Risk personnel receive regular training to ensure these individuals have up-to-date expert knowledge.


text: The Company recognizes that the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Enterprise Risk Committee ("ERC"), the Technology Steering Committee ("TSC") and the Cyber Risk Oversight Committee ("CROC"), provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the overall approach to enterprise-wide risk management. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Security is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the TSC and the CROC. The Chairman of the CROC is an independent member of the Board of Directors and is considered an expert in technology and cybersecurity and provides regular updates on cybersecurity risk management to the Board of Directors.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Director of Information Security and Director of Information Technology, who reports directly to our Director of Technology Management, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed periodically by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks associated with our use of third-party service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a sizable portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, including the CROC. The Incident Response Plan is coordinated through the Director of Information Security and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Our Operational and Information Technology Systems" in Item 1A. Risk Factors.


text: Our Director of Information Security is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Director of Information Security, provides guidance, oversight, monitoring and challenging the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and reports directly to the Chief Risk Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are subject to professional education and certification requirements. Our Director of Information Security has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management. Certifications include Certified Information Security Manager ("CISM") and Certified Information Systems Security Professional ("CISSP"), which includes continuing education requirements.


text: Our Board of Directors has approved management committees including the TSC, which focuses on technology impact, and the CROC, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. The TSC is chaired by management within the Company and includes the Chief Risk Officer, Director of Information Security and Director of Technology Management as well as other key departmental managers throughout the entire company. These committees meet at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The Director of Information Security reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the CROC on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The CROC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Director of Information Security and our Director of Technology Management provide quarterly reports to the CROC regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. Our Board of Directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the CROC reviews our cyber security risk profile on an annual basis. The chairman of our CROC provides a report of its activities to the full Board of Directors at least quarterly.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Manager and its affiliates. To mitigate risk from cyber threats, our Manager has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: Our Manager's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Manager's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is our Manager's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Our Board of Directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO regarding cybersecurity, which updates include a review of our Manager's global security program and cybersecurity, including risks and protections for us and our Manager. The Global Operational Risk Management Committee, one of our Manager's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO serves as a member of and provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our Board of Directors, and members of our management team are included in our Manager's incident response process in the event a cyber security incident occurs that could materially impact us.


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Manager and its affiliates. To mitigate risk from cyber threats, our Manager has a designated Global Chief Security Officer ("GCSO") who leads its global security department that is responsible for identifying, assessing, and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy. This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights and enabling a secure and resilient business.


text: Our Manager's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Manager's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for existing third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Board and Management's Role and Expertise and Oversight of Risk Management and Strategy Our information technology ("IT") department, which maintains our cybersecurity function, is led by our SVP, Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer, and has over 25 years of broad IT and digital transformation experience leading large technology organizations and product teams with expertise in IT organizational leadership, network and cloud infrastructure, and enterprise engineering and technology. Our VP, Chief Information Security Officer ("CISO") reports directly to the CIO, and is responsible for managing our risks from cybersecurity threats, protecting and defending our networks and systems, and overseeing our Information Security Office. Our CISO has over 20 years of experience leading cybersecurity and information security departments and manages a team of professionals who have broad industry experience and expertise, including disaster recovery, IT risk management, detection and mitigation technologies, incident response, threat management, and regulatory compliance, and who hold industry recognized certifications, such as the Certified Information Systems Security Professional and Certified Risk and Information Systems Control.


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders throughout the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board as needed. For instance, during the December 2022 cybersecurity incident, our Board and Audit Committee were regularly updated, and our Audit Committee provided oversight and feedback with respect to management's investigation of, and response thereto, including internal and third-party investigations, public or governmental disclosures and our remediation efforts.


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, and which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and internal audit as well as our CISO, provides additional support for enterprise risk management assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment and monitoring, vulnerability scans, end-point detection and response and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service, our overall cybersecurity risk management program leverages the ISO 27001 framework. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.


text: Employees are required to complete a cybersecurity training at least once a year specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by the Written Information Security Program (WISP) framework, other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the U.S. and U.K. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 framework.


text: Third parties also play a role in our cybersecurity risk management and strategy. We contract with a third-party cybersecurity incident response team to assist in the management of cybersecurity threats. We also engage and rely on third-party cyber and information security providers for cybersecurity applications and infrastructure to protect our network, systems and data.


text: Incident Response and Reporting In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, and notifications process, internally and externally. Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee Chair and the full Board.


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide a SOC 1 or SOC 2 report and, for vendors unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: Impact of Cyber Risk on our Business We face a number of cybersecurity risks in connection with our business. We continue to invest in the security and strength of our networks and to enhance our internal controls and processes, which are designed to help protect our systems, infrastructure, and data. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the December 2022 cybersecurity incident, have not materially affected our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, "Risk Factors."


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats and information security.


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders across the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, and Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, the results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board periodically.


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and Internal Audit as well as our CISO, provides additional support for ERM assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment, monitoring through logging and correlation, vulnerability scans, cyber threat intelligence, end-point detection and response (EDR), and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service line, our overall cybersecurity management program is based on the ISO 27001 standard. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.


text: Employees are required to complete a cybersecurity training annually specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by our Written Information Security Program (WISP), other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the United States and United Kingdom. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 standard.


text: Incident Response and Reporting In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, escalation and notifications process, both internally and externally. Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee and the full Board.


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity and disaster recovery preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide an independent information security audit report and, for vendors unable to provide such audit reports, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third -party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third -party service provider or that otherwise impacts third -party technology and systems we use.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Internal Cybersecurity Team The Company's internal information security organization (Internal Cybersecurity Team), led by our Executive Vice President and Chief Information Officer (CIO) as well as the Assistant Vice President and Chief Information Security Officer (CISO), is responsible for coordinating all aspects of the Company's electronic information security systems, including prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as implementing, monitoring, and maintaining our enterprise-wide security strategy, standards, architecture, policies, and processes. Our CIO reports directly to our Chief Executive Officer, our CISO reports to our CIO, and reporting to our CISO are our Deputy Chief Information Security Officer (Deputy CISO) and other experienced information security personnel responsible for various parts of our business. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. When the Company learns of a cybersecurity incident at a third -party service provider, the Company's respective department contacts maintain communication with the third -party service provider and communicate any cybersecurity incidents to the CISO.


text: Security Policy and Requirements As part of the Company's Crisis Management Plan, the Company's cybersecurity Incident Response Plan (the IRP) provides a framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The IRP applies to the Company's extended computing environment, including electronic information resources that are owned or used by the Company and are routinely relied on to support our operations.


text: The Internal Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment, prioritization, and remediation program. The Internal Cybersecurity Team also performs regular system penetration testing to validate our security controls and assess our infrastructure and applications. All management employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, in 2023, our Board of Directors and certain management employees participated in a tabletop exercise to simulate a response to a cybersecurity incident, and our Internal Cybersecurity Team incorporated the findings from this exercise into our processes.


text: Our information security program is designed to align our defenses and resources to identify, assess, and address more likely and more damaging cyber events, to provide support for our organizational mission and operational objectives, and to position us to deter, detect, mitigate, and respond to a wide variety of potential attacks in a timely fashion. Our information security program employs quantitative and qualitative approaches to evaluate the effectiveness of controls and assess the resiliency of critical computing resources. This data is combined with knowledge of common attack techniques to assess the likelihood of components being compromised and assess potential financial implications under different scenarios. The results are used to help identify potentially material risks and provide insights which are taken into account when prioritizing our security initiatives.


text: Material Cybersecurity Risks, Threats, and Incidents Due to the evolving nature of cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of having experienced any material effects or reasonably likely material effects on our Company, its business strategy, results of operations, or financial condition resulting from cybersecurity threats or incidents to date, as a critical infrastructure provider, we may be a target of well-funded and sophisticated adverse actors. There can be no guarantee that we will not be the subject of future risks or incidents that have such an effect, or that we are not currently the subject of an undetected risk or incident that may have such an effect.


text: We also rely on information technology and third -party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all of the information systems we use. Incidents may lead to reputational harm, revenue and client loss, legal actions, or statutory penalties, among other consequences. For a more detailed discussion of these risks, see our discussion in the Risk Factors in Item 1A of this report.


text: The Board of Directors has delegated primary oversight of the Company's cybersecurity risk to the Audit Committee, which receives updates on cybersecurity risks and incidents at each regularly scheduled Audit Committee meeting from the CIO, CISO, and other members of management, as needed. When making decisions regarding director appointments and committee assignments, the Board of Directors takes into consideration the cybersecurity experience of directors and director candidates and strives to maintain cybersecurity expertise on the Board of Directors and Audit Committee. We have protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board of Directors.


text: At the management level, our CIO, CISO, and Deputy CISO, each of whom has extensive cybersecurity knowledge and skills gained from over 27 years, 28 years, and 19 years of relevant work experience, respectively, head the Internal Cybersecurity Team that is responsible for implementing and maintaining cybersecurity and data protection practices across our business, with our CIO reporting directly to our Chief Executive Officer. In 2023, our CIO was appointed to serve as a member of the U.S. Cybersecurity Advisory Committee (CSAC) of the Cybersecurity and Infrastructure Security Agency (CISA), which provides recommendations to CISA on a range of cybersecurity issues, including corporate cyber responsibility, technology product safety, and efforts to raise the baseline of cybersecurity practices for a variety of entities to enhance the United States' cyber defense. Our CISO and Deputy CISO receive reports on cybersecurity threats from a number of experienced information security professionals for various parts of our business on an ongoing basis and, in conjunction with other management personnel, regularly consult on risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: In addition, our Risk and Compliance Committee (RCC) is responsible for oversight and support of the Company's Enterprise Risk Management and Compliance and Ethics programs and is comprised of the Executive Leadership Team and the Senior Vice President and Chief Accounting, Risk, and Compliance Officer (Compliance Officer). The RCC also created a subcommittee, the Enterprise Risk Management Committee (ERMC), who is charged with continually monitoring, evaluating, and managing enterprise risks. The ERMC includes the Compliance Officer, General Auditor, Vice President Law - Finance and Compliance, Vice President and Chief Safety Officer, CISO, and Assistant Vice President - Corporate Strategy. The RCC and ERMC both meet throughout the year and receive periodic updates on cybersecurity from the CISO and Deputy CISO.


text: We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information.

companyName: CORNING INC /NY

ticker: GLW


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan ("CIRP"). Corning's CIRP provides the Company with the capability for responding, reporting and remediating cybersecurity incidents. It has been established to reduce or minimize the impact of cybersecurity incidents on the Company's networks, IT systems, users or business processes. Corning's Cyber Security Incident Response Team, led by the Chief Information Security Officer ("CISO"), handles the response process for all cybersecurity incidents and Corning's Corporate Crisis Response Team ("CCRT") is mobilized and involved in any significant incidents.


text: Our cybersecurity risk management program also includes: a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information and broader enterprise IT environment;


text: the use of reputable cybersecurity consultants and other third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so the Company can maintain a posture of continual enhancement of our cybersecurity management and strategy;


text: cybersecurity awareness training for our employees, incident response personnel and senior management; and a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.


text: Cybersecurity Governance Corning's Board of Directors ("Board") plays a role in overseeing risks associated with cybersecurity threats. In particular, the IT Committee of the Board is responsible for cybersecurity governance and has information security oversight as a key component of its charter. In all meetings, the IT Committee reviews the Company's cybersecurity posture as well as significant cybersecurity events. Corning's Chief Digital and Information Officer ("CDIO"), in combination with Corning's CISO, briefs the IT Committee on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. On an annual basis, the CISO provides a cybersecurity update to the Board and participates in a joint meeting of the IT and Audit Committees to review significant cybersecurity risks and their impact, if any, on internal controls. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures. Should a cybersecurity incident rise to the level of a corporate crisis, consistent with the Company's CCRT escalation protocols, the Board would be engaged.


text: Our CDIO and our CISO lead our management team in assessing and managing our response to cybersecurity threats and incidents. Our CDIO and CISO together have over 50 years of combined experience in information technology, digital and systems transformation, cybersecurity and related risk management and governance. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and works with all divisional, manufacturing and functional teams within Corning on cybersecurity issues. The team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment.


text: While Corning has had to address various cybersecurity threats in the ordinary course of its business, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management process is a component of our overall enterprise risk management process, through which our Chief Executive Officer and other members of senior management assess, identify, and manage material risks from cybersecurity threats we face. Our cybersecurity process seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. The Board of Directors (the "Board"), and the Audit Committee of the Board (the "Audit Committee"), provide oversight of our cybersecurity risk management process. The Audit Committee reviews our cybersecurity program and cybersecurity risk management process quarterly, and our Board reviews our cybersecurity program annually. Our cybersecurity program is directly managed by the Chief Information Officer ("CIO"), who is experienced in information systems and cybersecurity and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic updates to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management. These updates cover the Company's material cybersecurity threats, the status of projects to strengthen our cybersecurity posture, and assessments of the cybersecurity program. Our cybersecurity risk management process is evaluated by internal and external cybersecurity experts, and the material results of those reviews are reported to senior management and the Board and Audit Committee as part of their oversight role. We also engage with third-party service providers deemed to have subject matter expertise in cybersecurity matters, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and processes. We require each third-party service provider to certify that they implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us. We use various tools and methodologies to manage cybersecurity risk and to prevent, detect, and mitigate cybersecurity incidents. Our tools and methodologies are tested regularly, including vulnerability scans, red-teaming exercises and other penetration testing, and review of cybersecurity threat intelligence feeds. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Factors Related to Overall Business & Operations – Our business depends on the use of information technology systems. A failure of these systems, cybersecurity incidents, or cyber-fraud may cause business disruptions, compromise our intellectual property or other sensitive information, or result in losses."

companyName: LATTICE SEMICONDUCTOR CORP

ticker: LSCC


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our intellectual property and data. We maintain policies and procedures designed to allow management to assess, identify, and manage material risks from cybersecurity threats. We integrate our cybersecurity policies and procedures into our overall enterprise risk management program, which is implemented by management and overseen by the Board of Directors through its Audit Committee.

companyName: COHU INC

ticker: COHU


text: We utilize the Center for Internet Security ("CIS") Critical Security Controls as a framework for managing our cybersecurity program. The CIS framework outlines 18 critical control areas relating to organizational security and provides effective methodologies, guidelines, and industry standard best practices to develop and manage a comprehensive cybersecurity program. Additionally, we align our controls to various international security certifications and standards and have adopted best practices from industry leading frameworks. Our cybersecurity program includes policies and procedures relating to encryption, data loss prevention technology, authentication technology, access control, anti-malware software, third-party risk monitoring, insider risk management and identity management. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also regularly obtain system and organization control ("SOC") reports from our service providers ("SOC 2"). Members of our corporate information security organization receive information exchanges from their professional networks and attend training, webinars, and conferences to stay up to date on both trends and system-specific updates. In addition, all Cohu employees are required to complete regular security awareness training including testing, each of which are designed to promote a company-wide culture of cybersecurity risk awareness and management.


text: As part of the Board of Directors' role in overseeing our enterprise risk management program, which includes our cybersecurity risk management, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to have an adverse effect on us. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee conducts reviews of the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and in aligning cybersecurity efforts with the overall risk management framework and promotion of our business objective and operational needs. In addition to our scheduled meetings, the Audit Committee maintains an ongoing dialogue with management, including emerging or potential cybersecurity risks.