text: The ISMS is applicable to all individuals and third parties providing services to the Company and is informed by multiple industry-recognized standards and frameworks, including the International Organization for Standardization ("ISO") standards for information security management systems, the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the Payment Card Industry ("PCI") Data Security Standard ("PCI-DSS"). It leverages the guidance of ISO 27001 in its design and operation, with policies intended to align to the requirements of ISO 27001 and follow the technical guidance of the appropriate NIST SP 800-53 Security and Privacy Controls standards where applicable. We review our security policies and procedures at least once annually, as well as in connection with significant enterprise-wide changes, such as technical or structural changes in our business or regulatory changes, and our policy content is continuously updated to account for a shifting threat landscape and to incorporate emerging best practices. We are a PCI-DSS Level 1 Merchant and are independently assessed against the PCI-DSS standard annually by an external PCI Qualified Security Assessor. Pursuant to the ISMS, we continuously monitor cybersecurity threats and strive to preemptively identify vulnerabilities. Our vulnerability management program operates on multiple layers of vulnerability discovery, such as third-party software component analysis, static and dynamic security testing, continuous infrastructure vulnerability scanning, cloud infrastructure scanning, independent third-party penetration testing, and a public bug bounty scheme. Our threat detection capabilities include automated 24/7 detection and alerting with automated response protocols designed to support rapid analysis and enrichment for security analysts who are guided by a formally documented Incident Response Plan in the event of a breach, as more fully described below.


text: The ISMS also provides for ongoing processes, tools and methods to bolster our cybersecurity defenses. We provide training to all of our employees, which includes annual information security awareness education, delivery of monthly cybersecurity updates, and simulated phishing exercises. We also host a live, third-party tabletop exercise annually for information security incident response for key individuals, including senior management and other senior leaders of the Company. Additional security features that we have in place that are intended to protect our systems and data from cyber-attacks include: physical and digital access controls, multifactor authentication for domain sign-on, corporate mobile device management, and tools to detect malicious emails and other suspicious activity.

companyName: Bumble Inc.

ticker: BMBL

secItem: Item 1C


text: Finally, the ISMS incorporates an Incident Response Plan, which outlines the procedures that we use to investigate and respond to cybersecurity events and alerts, an Incident Response Policy, which sets out high-level principles and requirements that apply to cybersecurity incident response, and a Business Continuity Plan, which sets out high-level steps in protecting the services, assets and employees of the Company during an event that disrupts business continuity. The Incident Response Plan includes clearly defined roles and responsibilities, including guidance for reporting up the chain to senior management and, where appropriate, to the Audit Committee and the Board. It comprises four high-level phases: identification and investigation of a cybersecurity incident (including suspected personal data breaches); containment to lessen any ongoing harm; eradication of the root cause; and, post-recovery, supplementation of the cybersecurity incident record with lessons learned in order to improve our incident response capabilities. The Business Continuity Plan defines the procedures to be followed if there is a critical failure that results in operations at one of our corporate offices being suspended, as well as the procedures to be followed if there is a critical failure of our services or underlying hosting infrastructure that results in significant degradation of a service provided, with an aim to operate at existing service levels throughout the duration of the incident.


text: When engaging third-party critical service providers, we conduct security assessments before engagement and require them to implement comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. As part of such security assessment, we ask the third-party service provider to complete a privacy and security questionnaire, through which we can assess the service provider's security capabilities and maturity, and to provide us with evidence of penetration testing and reports.


text: To date, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under Part I, "Item 1A—Risk Factors—Risks Related to Information Technology Systems," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner.


text: We have integrated the process of cybersecurity risk management, including oversight of the ISMS, into our broader risk management framework. The Board has broad oversight of risk management related to us and our business while delegating certain specific risk oversight responsibilities to its committees. The Board oversees our risk management activities through a combination of processes, including direct engagement with management. The Board has determined that the Audit and Risk Committee shall review our compliance with legal and regulatory requirements as well as the effectiveness of our risk management processes. As part of this oversight, the Audit and Risk Committee reviews the guidelines, policies, and practices that govern how senior management handles our exposure to cyber- and privacy-related risks.


text: Our Chief Information Security Officer ("CISO") provides quarterly updates to the Audit and Risk Committee, as well as an annual report to the Board, regarding a range of cybersecurity activities while maintaining the confidentiality, integrity, and availability of information, including user information under our custody. There are also scheduled monthly meetings where, among others, our CISO, Head of Privacy and a representative of the Sponsor attend, in order to discuss our cybersecurity program, including evaluating the implementation of additional controls, processes, policies, and procedures, as appropriate, as well as any notable security incidents, if any. Our CISO joined the Company in the role of Chief Information Security Officer almost four years ago, and has over 20 years of experience in the field of cybersecurity. He is supported by and leads our Information Security team, which includes the first responders to cybersecurity incidents.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: SKECHERS USA INC


text: We have developed and implemented a Cybersecurity Risk Management Program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") to inform how we identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Senior Director of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the Senior Director of Information Security.


text: The Senior Director of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, Senior Director of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.


text: Cybersecurity risk management is led by our SVP of Information Technology, who reports to our Chief Operating Officer, and generally is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The SVP of Information Technology manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A Risk Factors.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our patients, collaborators, health care providers, and prospective and future customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Consistent with overall policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company conducts global clinical trials. As a consequence, we have global cybersecurity threat operations function 24/7, with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, and other key business functions, third party vendors, as well as the members of the Board through the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, the Company's Vice President, Information Technology, other members of management and relevant management committees and councils.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and to the Board through the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Vice President, Information Technology.


text: The Company's Vice President, Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Vice President, Information Technology has served in various roles in information technology and information security for over 33 years, including serving as Vice President, Information Technology of two large public companies. The Vice President, Information Technology holds an undergraduate degree in computer science, a Master of Business Administration in information systems, and the professional certification of Certified Chief Information Security Officer.


text: The Company's Vice President, Information Technology works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Vice President, Information Technology and the IT Security Operations Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Risks from the cybersecurity threats we have faced to date have not materially affected, and we believe are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, we may not be able to protect all information systems, and integrating information systems as we acquire new businesses or expand our business may expose us to unexpected liabilities or increase our vulnerability. See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: incidents. All Company employees are required to participate in scheduled training and are obligated to certify the completion of each training session. Additionally, all third parties retained by the Company, including vendors, that are granted access to the Company's IA are required to certify compliance with all relevant Company policies relating to such access and re-certify compliance as deemed necessary. This certification includes the completion of questionnaires that are reviewed by the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO").

companyName: MBIA INC

ticker: MBI


text: Despite the Company's implementation and maintenance of the cybersecurity program and its components as identified above and elsewhere herein that includes a variety of best practice security measures, our information technology systems, networks, and data are subject to cyber-attacks or physical break-ins, unauthorized tampering or other security breaches. Notwithstanding these protections, attacks may result in a failure to maintain the security, confidentiality or privacy of sensitive information. To date, the Company has not had any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, its business strategy, results of operations, or its financial condition. There can be no assurance that a future cybersecurity incident would not result in a loss and/or have a material adverse effect on our reputation, business, results of operations, or financial condition.


text: The Company created an Enterprise Security Council ("ESC") that is comprised of senior IT management (including the CISO and CIO), Internal Audit and Compliance leaders which meet regularly to evaluate potential security risks to the Company and its IA.


text: The CISO is responsible for performing a thorough examination of any identified or suspected cybersecurity incidents or violations. The CISO will collaborate with the Company's General Counsel and other relevant personnel during this formal review. Documentation detailing the event and an action plan, if required, will be generated by the CISO. Additionally, communication will be promptly established with the Cyber Incident Response Team ("CIRT"), and if deemed necessary, the Audit Committee.


text: The Audit Committee receives quarterly or more frequent as appropriate, briefings from the Company's senior management and CISO. The briefings concern, among other topics, the cyber threat landscape and associated risks to the Company, updates to the Company's cybersecurity program and associated policies, its ongoing strategy to prevent, identify and react to security incidents, internal and external vulnerability assessments, penetration testing results, and Internal Audit's periodic reviews of MBIA's security controls, policies, and procedures. The CIRT is comprised of senior leaders from across the company, which include Legal, Compliance, Investor/Media Relations, and Information Technology.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annual or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: The Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 18 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board at least annually or more regularly at the discretion of the ORC.


text: The Company's audit committee is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Company's audit committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data of our customers and employees ("Information Systems and Data").

companyName: Definitive Healthcare Corp.

ticker: DH


text: Our Information Security function is overseen by our Chief Technology Officer ("CTO"), our information security team, security management, engineering operations, legal, risk management, and various third-party service providers, including our virtual Chief Information Security Officer ("vCISO"). In doing so, they identify, assess and manage the Company's cybersecurity threats and risks, using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal and/or external audits and threat assessments for internal and external threats, utilizing third-party threat assessments, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and incident response policy, incident detection and response capabilities, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications for certain platforms, encryption of certain data, network security controls and data segregation for certain environments, access controls for certain systems, physical security, asset management, tracking and disposal, systems monitoring, incident response table-top exercises, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cyber risk is addressed as a critical component of the company's enterprise risk management program and is based upon entity-level controls found in our SOC2 compliance program, addressing all five trust service criteria: security, availability, confidentiality, privacy, and processing integrity. The Company recently received an unqualified opinion from an industry-recognized audit firm attesting to our SOC2 Type II compliance as of the date of such report.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, dark web monitoring services, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, risk assessments for each vendor, reviewing certain vendors' security assessments and written information security programs, the imposition of information contractual obligations, and, in certain instances, security assessment calls with select vendors' security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including providing third-party attestations of compliance with certain cybersecurity frameworks, such as SOC2 or ISO 27001.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our "Risks Related to Data Privacy and Cybersecurity" under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Our audit committee of the board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Principal Security and Infrastructure Architect with over 20 years managing large scale enterprise security systems and programs.


text: The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CTO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, Chief Legal Officer and Chief Executive Officer in their role as executive leadership for the Incident Response Team. The executive leadership team will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policy include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives quarterly reports from the CTO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: In the ordinary course of business, we provide proprietary content and we collect, store and use confidential information (including, but not limited to, personal customer information and data) in connection with providing our products and engaging our employees and contractors. We have developed systems and processes designed to protect such content and information and we maintain cybersecurity insurance coverage. Our Board of Directors (the "Board") and management recognize the critical importance of protecting the confidentiality and integrity of such information and data and maintaining the trust and confidence of our members, business partners, employees, contractors and shareholders, as well as complying with applicable regulatory requirements and contractual obligations.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Board and its committees actively oversee the Company's risk management program. Cybersecurity threats and related risks are an important component of the Company's overall approach to enterprise risk management ("ERM"). We annually examine our cybersecurity program with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines. Cybersecurity risk management is a Company-wide initiative. In general, the Company seeks to address cybersecurity risks through a comprehensive, multi-disciplinary approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the elements of the Company's overall ERM program, the Company's cybersecurity program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which is regularly updated on cybersecurity matters by the Company's Chief Information Security Officer ("CISO"), other members of management, and relevant representatives from management's committees and the Company's Internal Audit function. • Collaborative Approach: The Company has implemented a comprehensive, multi-disciplinary approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments by internal and third-party experts, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans pursuant to the NIST framework that fully address the Company's response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management: The Company has implemented a risk-based evaluation process to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training and education for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the regular evaluations of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including tabletop exercises and vulnerability testing, focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on certain of our cybersecurity measures, including audits and penetration testing. For example, we annually engage qualified third-party auditors to independently assess and attest to and/or provide certifications of compliance with the HIPAA Security and Privacy Rule, SOC2 Type 2, the Payment Card Industry Data Security Standard (PCI-DSS), and UK CyberEssentials. The results of such assessments, audits and reviews are presented to the Audit Committee and members of the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on such assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process. The Audit Committee oversees our cybersecurity program, as well as the steps management has taken to monitor and control cybersecurity threats and related risks. This oversight includes receiving reports on the regular assessments of the Company's disclosure controls and procedures to ensure that current practices account for material cybersecurity risks facing the Company. The Audit Committee receives presentations on the cybersecurity program and related risks on at least a quarterly basis. These presentations address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee, and the full Board as necessary, also receive prompt and timely information regarding any cybersecurity incident that meets recognized established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee routinely meets with our Chief Technology Officer ("CTO") and CISO as well as outside experts as appropriate to assess cybersecurity risks and to evaluate the status of the Company's cybersecurity efforts, which include a broad range of tools and training initiatives that work together to protect the data and systems used in our businesses.


text: Our cybersecurity management team includes our CISO and Director of Security Operations, Data Privacy Officer, CTO, Chief Financial Officer, General Counsel, and Head of Internal Audit. The CISO, in coordination with the team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The cybersecurity management team meets regularly to review cybersecurity and data privacy strategy, receive updates, and consider the Company's current risk posture. The team meetings also build leadership consensus on cybersecurity risk management and tolerance. In the event they become aware of a cybersecurity threat or incident, employees are expected to follow established lines of communication to notify the relevant members of the cybersecurity management team and allow the relevant team members to coordinate the evaluation and response to such threats and incidents as necessary. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the rest of the cybersecurity management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to other members of senior management and the Audit Committee when appropriate. Such plans also dictate notification responses to Company management based on the severity of the incident.


text: The CISO and Director of Security Operations has worked in the information security field for over 15 years and holds an undergraduate degree in computer systems management and master's degrees in both cybersecurity and technology management. He has also attained multiple cybersecurity-related professional certifications and licenses, including Certified Information Systems Security Professional, and is an adjunct professor of cybersecurity at New York University and Fordham University. The CTO holds a master's degree in microengineering and has served in various leadership roles in computer engineering for more than 20 years.


text: While we have experienced cybersecurity incidents in the past, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, financial condition, cash flows or reputation. However, cybersecurity threats and/or incidents could have a material effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the cybersecurity risks we face, see "Item 1A. Risk Factors— Risks Related to Technology, Security and Intellectual Property" of this Annual Report on Form 10-K.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management, and governance.

companyName: PJT Partners Inc.

ticker: PJT


text: Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth, and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.


text: Information Security Policies and Procedures As part of the Program, the Company has adopted Information Security Policies and Procedures ("ISP") that utilize concepts set forth in the NIST Special Publications and Internal/Interagency Reports and other industry-accepted guidance.


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity, and maintaining physical security. Other components of the Program related to assessing, identifying, and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems, and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident, or advising on legal and regulatory requirements.


text: The Company has processes to identify risks from cybersecurity threats associated with its use of third-party service providers. Each third-party service provider is evaluated at onboarding for compliance with our cybersecurity standards. Risks identified through this assessment are logged and remediation plans are discussed with appropriate stakeholders.


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO") and Chief Operating Officer as well as other senior management.


text: Cybersecurity Risks We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully in "Part I. Item 1A. Risk Factors—Risks Relating to Our Business—Our business is subject to various cybersecurity and other operational risks" of this filing, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents may be insufficient. Accordingly, our controls and procedures may not be able to address or limit all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our full Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team and CTO report, at least twice annually, to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.


text: Management Oversight In January 2024, the Company established a Cybersecurity and Technology Risk Committee (the "Cybersecurity Risk Committee"), comprised of our CTO and senior managers from across the Company. The Cybersecurity Risk Committee has responsibilities that include managing, monitoring and coordinating the Company's cybersecurity and technology risk management and any required remedial or corrective actions; reviewing the effectiveness of the ISP and serving as the primary escalation point for cybersecurity matters under the ISP.


text: The Cybersecurity Risk Committee reports to the Operational Risk Committee which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them.


text: Our CTO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CTO works closely with the Company's Executive Committee and other senior managers, including through his participation in the Cybersecurity Risk Committee, Operational Risk Committee, and CIRT. In addition to the processes described above, our CTO leads a team of information security specialists to assist him meeting his responsibilities. He leads dedicated cybersecurity meetings with this information security team and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CTO brings over 30 years of technological expertise to the Company, with a background deeply rooted in data management and protection, data analytics, and artificial intelligence and brings extensive experience in information security strategy and risk management from his previous roles at a global investment bank.


text: Our cybersecurity risk management strategy is a key component and has been integrated into our overall enterprise risk management program and has been designed based on established industry frameworks and standards, including those developed by the National Institute of Standards and Technology and the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program. Although this does not mean that we currently meet all of any particular technical standards, specifications, or requirements, we use these frameworks, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: Rocket Lab Corp

ticker: RKLB


text: To fortify our information assets, we employ industry-standard measures such as multifactor authentication and endpoint protection defenses. Moreover, we collaborate with internal stakeholders across the organization to embed fundamental cybersecurity principles into our operations. This entails implementing multiple layers of cybersecurity defenses, restricting access based on business necessity, and ensuring the integrity of our business information. Throughout the year, our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. We maintain a cybersecurity incident response plan that includes a cross-functional response team and procedures for responding to cybersecurity incidents.


text: We engage third-party assessors to conduct penetration testing and evaluate our adherence to industry-standard frameworks. Additionally, we maintain ongoing relationships with incident response experts and other external professionals. We also seek to collaborate with industry peers and cybersecurity practitioners in order to facilitate the exchange of insights and knowledge regarding potential threats, best practices, and emerging trends. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during onboarding as well as risk-based monitoring on an ongoing basis.


text: Our global information technology security team collaborates periodically with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity posture and preparedness. This collaborative effort extends to partnerships with the National Defense Cyber Alliance, National Security Agency, and the FBI to monitor and comprehend active risks within the Aerospace industry, Defense Industrial Base, and Critical Infrastructure.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company's business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business."


text: Governance of Cybersecurity Risk Management Our Board of Directors holds collective oversight responsibility for our strategic and operational risks. Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management. The Audit Committee provides periodic reports on these reviews to the full Board of Directors.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. Our Chief Information Officer (CIO) assumes primary oversight of material risks stemming from cybersecurity threats. With over 20 years of experience across various information technology roles, our CIO also serves as the Vice President accountable for the Information Technology organization and information protection.


text: Reporting directly to our CIO, our Cybersecurity Manager brings over 15 years of experience in aerospace IT organizations, coupled with more than 10 years of expertise in cybersecurity.


text: Our CIO and Cybersecurity Manager evaluate our cybersecurity readiness through a combination of internal assessment tools and third-party control tests, vulnerability assessments, audits, and alignment with industry standards. We maintain governance and compliance structures tailored to promptly escalate cybersecurity-related matters to our cybersecurity team, addressing potential threats or vulnerabilities. Incidents undergo evaluation based on their impact and potential materiality, followed by reporting to designated internal and external personnel in accordance with defined procedures. Moreover, we implement diverse defensive measures and continuous monitoring techniques, leveraging established industry frameworks and cybersecurity standards, including collaboration with third-party security operations centers.


text: Our CIO conducts periodic meetings with the Audit Committee to review our information technology systems and address significant cybersecurity risks.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Managing Material Risks & Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and includes technical, administrative, and physical controls, including encryption, firewalls, anti-virus systems, and well-documented processes and policies. We continue to promote a company-wide culture of cybersecurity risk management. Cybersecurity considerations are integrated in our decision-making processes. We have an experienced Information Technology ("IT") team led by our Vice President of Information Systems who reports directly to the Chief Executive Officer and works closely with our management team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our VP of Information Systems provides regular updates on cybersecurity to the Audit Committee of the Board of Directors.


text: Engagement of Third Parties on Risk Management We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversight of Third-Party Risk We have established processes to oversee and manage risks relating to third-party service providers. For example, our Security Operations Center, employs a Security Information and Event Management (SIEM) and other systems to monitor risks while also conducting thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, and data processed by us or third-party vendors."


text: The Company's risk management program is designed to identify, assess, and mitigate risks across various areas and functions, including financial, operational, technological, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. The Company's Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Strategic Technology Committee of the Bank's board of directors.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The structure of the Company's information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, the Company leverages certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Chief Information Security Officer and Chief Information Officer, who reports directly to the Director of Corporate Strategy, along with key members of their teams, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls. It also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. It engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also maintains a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and its supply chain. The Company also actively monitors its email gateways for malicious phishing email campaigns and monitors remote connections as a portion of its workforce has the option to work remotely. The Company leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its risk management program.


text: The Company maintains an Information Security Incident Response Policy ("Incident Response Policy") and related procedures that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team and to the appropriate regulatory and governmental authorities. As needed, the notification may include the CEO and/or the Company's and Bank's Board of Directors. The Incident Response Policy and procedures are coordinated through the Chief Risk Officer and key members of management are embedded into the procedures by their design. The Incident Response Policy facilitates coordination across multiple parts of the organization and is evaluated at least annually.


text: Notwithstanding the Company's defensive measures and processes, the threat posed by cyber-attacks is severe. The Company's internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while it has experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "An interruption in or breach in security of the Company's information systems may result in a loss of customer business and have an adverse effect on the Company's results of operations, financial condition and cash flows" in Item 1A. Risk Factors.


text: The Chief Information Security Officer is accountable for managing the enterprise information security department and delivering the information security program. The responsibilities of this department include cybersecurity risk assessment, a portion of defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance and third-party risk management. The Company's information technology department works together with information security in defense operations and is responsible for business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and the Company's second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. The Company's Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: The Bank's board of directors has approved the management level Operations Committee, which focuses on business impact, and the Enterprise Risk Management Committee ("ERM Committee"), which also focuses on business impact and provides oversight and governance of the information security program, and the board level Strategic Technology Oversight Committee ("STOC"), which focuses on technology impact and provides oversight and governance of the technology program. The Operations Committee is chaired by the Chief Operating Officer and includes the Chief Information Security Officer and Chief Information Officer and other key departmental managers from throughout the Company. This committee generally meets bi-weekly to discuss various operational strategy and issues, including information technology and information security policies, practices, controls, and mitigation and prevention efforts.


text: The ERM Committee meets quarterly and oversees the information security program. It approves the broad objectives, strategies and major policies governing the Company's protection of data assets and provides agreement on the definition and scope of the information security framework. Along with reviewing, approving, and prioritizing information security efforts, it reviews and challenges the results and adequacy of information security practices. From an enterprise perspective, the ERM Committee reviews the cybersecurity risk profile on a quarterly basis and reports on cyber risk to the Risk Committee of the Company's board of directors.


text: STOC is responsible for overseeing the Company's technology program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Company's Chief Information Security Officer and its Chief Information Officer provide quarterly reports to the STOC regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Chief Information Security Officer also reports summaries of key issues, including significant cybersecurity and/or privacy incidents.


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Investment Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, including mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Company). Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. All companies utilizing technology are subject to threats and potential breaches of their cybersecurity programs. Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including customer and bank information. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our board of directors (the "Board"), through our Audit Committee, and our management, are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and procedures, and cyber security safeguards will be sufficient to protect against all possible threats and properly followed in every instance, or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and the Cybersecurity Assessment Tool (CAT2). Our cybersecurity program in particular focuses on the following key areas: Process


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response, Recovery Planning and Disclosure Our Bank is subject to the Interagency Guidelines, as noted above, and our Company is subject to the SEC's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies adopted in July 2023. In accordance with these rules and regulations, we have sought to establish comprehensive incident response and recovery plans, and we continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our planned response to a cybersecurity incident. With respect to the potential disclosure of material cybersecurity incidents, we have designated our management Financial Review and Disclosure Committee as the proper forum to address such issues. Members of Financial Review and Disclosure Committee include the Chief Financial Officer ("CFO"), General Counsel, Chief Operating Officer ("COO"), Chief Risk Officer ("CRO"), and the Chief Information Security Officer ("CISO").


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, in the manner and to the extent required by our bank regulators and applicable regulations. Such third-party providers are subject to security risk assessments at the time of onboarding, and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by such third-party providers and other industry sources. In addition, we require our third-party providers to meet appropriate security requirements, controls and responsibilities and to investigate and report on security incidents that have impacted their operations, as appropriate.


text: Education and Awareness Our policies require each of our employees to participate in our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also conduct regular phishing email exercises and training to test employees of security practices to mitigate this threat.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, through its Audit Committee, oversees the management of our cybersecurity program led by our CISO. The Audit Committee receives regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, including material security risks and information security vulnerabilities. Specifically, the Audit Committee receives regular updates from our CISO on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, and any relevant internal and industry cybersecurity incidents.


text: Management's Responsibility The Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management's Corporate Information Security Committee (the "Security Committee"), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer ("CIO"), the CRO, and the COO. The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies.


text: Our CISO has more than 20 years of Information Technology and Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 24 years of Information Technology (IT) experience and 17 years of experience in the financial services industry. Our CRO has more than 32 years of experience in Banking and over 14 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with experience in loan servicing and documentation, cash management services, payment operations, information technology, vendor management, and treasury services.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks and would be notified between such regular updates regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our IT team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our executive director of IT. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the executive director of IT reports. Combined, members of our security committee and our internal IT team have more than 25 years of risk management experience, including with respect to IT and cybersecurity systems.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners, and employees toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, procedures, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks, and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, threat monitoring and tabletop exercises to inform our risk identification and assessment.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we also perform periodic risk assessments, which includes cybersecurity risks, monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; through our policies, practices, and/or contracts (as applicable), require employees and certain third parties to treat confidential information and data with care; periodically update our relevant policies and procedures; employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools and knowledge necessary to identify or address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices; conduct regular phishing email simulations to enhance awareness and responsiveness to possible threats; conduct annual cybersecurity training for our board of directors and senior management; run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; engage consultants to help us oversee and manage cybersecurity risks, processes, and incident response measures; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan outlines and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan further outlines the roles and responsibilities of various employees, managers, and senior leadership with respect to performing a materiality assessment and responding to cybersecurity events that are deemed material, as well as provides rapid escalation procedures after a cybersecurity incident. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and our board of directors, as appropriate.


text: Our cyber risk management program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The risk management program is focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. Regular assessments, including penetration tests, are performed. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking basis.


text: As part of the above processes, we regularly engage with consultants, and other third parties, review our cybersecurity program to help identify areas for continued focus, improvement, and compliance. We engage them, specifically, to assist us with cybersecurity risk assessments, external threat environment reviews, internal cybersecurity policy compliance and near-term incident response. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our key suppliers, which have access to consumer, patient, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We periodically perform diligence on certain third parties that have access to our systems, data, or facilities that house such systems or data; and we monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under the heading "Actual or attempted security incidents or breaches, loss of data, or other disruptions could expose us to material liability and materially and adversely affect our business, financial condition, and our reputation," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, these threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.


text: As of the date of this report, we do not believe that risks from any cybersecurity threats as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. We cannot guarantee that controls we will implement to mitigate this risk will eliminate it. See Item 1A of this Annual Report for discussion of this risk.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, any results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and/or other materials discussing current and emerging material cybersecurity threat risks and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments, and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Security Officer and/or General Counsel and Chief Privacy Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Our Chief Information Security Officer advises our Board on the specific vulnerabilities we identified and the controls we put in place to mitigate our risk.


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary. Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.