text: We utilize third-party service providers to enhance our CSP, including engaging them annually to assess our CSP against the NIST CSF. We use one or more third-party managed security solution providers, who provide us with threat intelligence information and managed threat detection and response capabilities. We have also engaged a third party to assist with associate cybersecurity training. Additionally, we have engaged outside breach response legal counsel to assist the Company with cybersecurity counseling and incident response.


text: Although we have not experienced any material cybersecurity incidents, a future incident could materially affect us. We rely on information technology to process, transmit and store electronic information, and to manage or support a variety of business processes, including financial transactions, PII, and resident and lease data. Our business requires us and some of our vendors to use and store PII and other confidential and sensitive information of our residents and associates. Any failure in or breach of our operational or information security systems or those of our vendors as a result of cyber-attacks or other security incidents could materially adversely impact our operations and financial position, including disruption of our operations caused by an inability to access network systems, disclosure or misuse of confidential or proprietary information (including PII of our residents and/or associates), damage to our reputation, and/or potentially significant legal and/or financial liabilities and penalties.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB

secItem: Item 1C


text: You should carefully review Part I, Item 1A. "Risk Factors" of this Form 10-K for a discussion of the risks to the Company related to cybersecurity.


text: Our cybersecurity team is led by our Senior Director of Cybersecurity, who has over 15 years of experience with IT and cybersecurity. The cybersecurity team reports to our Senior Vice President-Information Technology. The Senior Director of Cybersecurity and the Senior Vice President-Information Technology are part of, and work with, a management Cybersecurity Steering Committee ("CSC"), which meets regularly. The CSC works to ensure strategic alignment of the CSP with our business objectives and priorities. The CSC is chaired by the Senior Director of Cybersecurity and is composed of our Chief Financial Officer, Chief Operating Officer, General Counsel and senior members of our finance, legal, IT, risk management and internal audit teams. The Company has designated an incident response team and defined criteria to guide responses to cybersecurity incidents.


text: The Audit Committee of our Board of Directors provides Board-level oversight of risks from cybersecurity threats. In addition to providing periodic reports, at least annually the Senior Director of Cybersecurity and the Senior Vice President-Information Technology meet with the Audit Committee regarding cybersecurity risks and assessments and related Company policies and initiatives. The Audit Committee and management have adopted a policy that categorizes cybersecurity incidents and sets out incident escalation procedures to the full Board of Directors.


text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is overseen by our Chief Information Security Officer ("CISO"), and it is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our CISO is a Certified Information Systems Security Professional and a Certified Ethical Hacker with more than 25 years of experience as a cybersecurity professional working extensively with critical infrastructure partners to reduce cyber risk within traditional and operation technology networks.

companyName: ALBEMARLE CORP

ticker: ALB


text: Our leadership team receives monthly updates on security operations and governance functions as part of monthly Information Security Council meetings led by our CISO. The Audit and Finance Committee of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our Chief Information Officer and CISO report on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on a periodic and as needed basis to the Audit and Finance Committee. The Audit and Finance Committee offers guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.


text: All information assets are inventoried, classified, prioritized, and protected based on the respective risk, with appropriate cybersecurity controls applied to each. We have also implemented and maintain a documents management program which governs the classification, protection, and use of sensitive company data within the Albemarle environment.


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they become part of our continuous risk monitoring program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.


text: We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and regular phishing tests to raise awareness and response actions.


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity engineers who provide 24/7 network monitoring.


text: As further discussed in Item 1A. Risk Factors, a material cybersecurity incident could significantly increase the cost of doing business or otherwise adversely impact our financial results and condition. To date we have not had a cybersecurity incident that has had, or is reasonably likely to have, a material effect on our financial results or business operations; however, we monitor and work to continuously improve our cybersecurity program as threats become more frequent and sophisticated.


text: All our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We also conduct frequent drills and exercises of formal cyber response procedures and business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.


text: Albemarle Corporation and Subsidiaries In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.


text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is managed by our Cybersecurity Director and is overseen by our Chief Information Officer ("CIO"), who assumes responsibility for the Chief Information Security Officer ("CISO") role. The cybersecurity program is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our Cybersecurity Director brings extensive experience in cybersecurity, including service in U.S. Army Cyber Operations, and has led initiatives in threat management, risk mitigation, and security architecture to strengthen enterprise resilience. His expertise in incident response and security strategy ensures our cybersecurity program remains aligned with industry best practices and evolving cyber threats.


text: The Audit and Finance Committee ("AFC") of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our CIO reports on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on an as needed basis, but at least annually, to the AFC and executive leadership. The AFC and executive leadership offer guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they are continuously monitored as part of our supply chain risk management program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.


text: Albemarle Corporation and Subsidiaries We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and periodic phishing tests to raise awareness and response actions.


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity analysts who provide 24/7 network monitoring.


text: Our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We conduct an annual incident response tabletop exercise as well as periodic exercises of formalized site business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.


text: In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.


text: Cybersecurity is among the most critical risks to the Company. For many activities important to its business, the Company depends on the confidentiality, integrity, and availability of information systems and data, some of which are provided or managed by third parties.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: Internal and third-party risks are reviewed, monitored, and managed by the Company's Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. The Company regularly engages third-party experts to assess the effectiveness of its cybersecurity programs. Biennially, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the NIST Cybersecurity Framework. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles. Periodic testing to ensure the security training is effective.


text: An external managed security services provider and industry-leading security tools continuously monitor the Company's systems and network for cybersecurity threats. The Company's cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. This is accomplished through mandatory annual security training for team members with access to Company email as well as tailored training for team members in more sensitive roles. Periodic testing ensures the training is effective. In addition, all team members have access to a variety of training materials on security topics through the Company's training management system.


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover.


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles (and periodic testing to ensure the security training is effective).


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Vice President, Information Security and Privacy, briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: The Company's Information Security and Privacy program and teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.


text: We, like many organizations operating in the current climate, face significant cybersecurity threats. To date, no risks from cybersecurity threats or incidents have materially affected us, including our results of operations or financial condition. Notwithstanding our security awareness program, we may not be successful in identifying a cybersecurity threat or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could materially affect us. Additional information on the cybersecurity risks we face can be found in Item 1A. "Risk Factors—Technology, Data Security, Cybersecurity, Business Continuity and Disaster Recovery Risks" of this Annual Report on Form 10-K.


text: The Company takes an active, multi-faceted approach to cybersecurity, including adversarial engagement, under an "assume breach" philosophy premised on the continuous and ever-evolving nature of cyber threats and threat actors. The Company utilizes a cross-functional working group comprised of a Cybersecurity Department, which is responsible for overseeing cybersecurity for the Company's information systems; and plant operational technology (OT) personnel who are responsible for the security of plant OT. This group works in a cross-functional context due to the interconnectivity of these systems, as well as to collaborate about cybersecurity matters. The Company's Cybersecurity Department is headed by the Director of Global Cybersecurity, who reports to the Company's Chief Information Officer, and includes personnel located around the world who have cybersecurity training and skills in engineering, architecture, surveillance, analytics and administration. The Cybersecurity Department is responsible for setting the Company's cybersecurity policies, standards and benchmarks for its information systems, penetration testing and overseeing repairs of technical elements that fail testing. The Cybersecurity Department also conducts threat hunting within the Company's information systems and responds to threats. The Cybersecurity Department also engages certain third-party specialists to periodically review the Company's information systems and cybersecurity defenses, as well as to provide education about current and emerging threats, techniques and countermeasures. The Cybersecurity Department has also conducted cyber-attack simulation exercises with Company executive management and other leadership personnel for cyber-attack readiness. The Company's Director of Global Cybersecurity and Chief Information Officer also collaborate with our joint venture partner concerning cybersecurity matters for the DGD Joint Venture.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: The Cybersecurity Department uses a system based on the critical security controls set forth by the Center for Internet Security, Inc. (CIS) as a benchmark and framework for its cybersecurity defenses, and has implemented cybersecurity policies and controls designed using the CIS controls framework. The Cybersecurity Department regularly implements updates and changes to its cybersecurity program to remain current and adapt to emerging cybersecurity risks; audits the cybersecurity program typically every three years; conducts targeted vulnerability testing; and assigns pertinent Company personnel as owners for governance and compliance. The Cybersecurity Department also provides cybersecurity training to Company employees.


text: The Company's Chief Financial Officer oversees a corporate risk analysis that organizes the Company's enterprise risks, including cybersecurity, into categories to assess the potential likelihood and impact of each, and to periodically review and update with the board of directors.


text: The Company also has an internal Cybersecurity Committee comprised of leadership across multiple internal functions that meets regularly to review, with the Director of Global Cybersecurity and the Chief Information Officer, active and thwarted cybersecurity incidents, systemic threats, attack trends and techniques, counter and preventative measures and defenses being implemented to enhance security. The meetings are also conducted for: ongoing awareness among Company leadership about cybersecurity threats and incidents; discussion of strategies for continuous improvement and associated capital needs; and review of oversight, governance and reporting of cybersecurity matters.


text: The Cybersecurity Department outsources several cybersecurity defense measures to utilize the know-how and tools, including artificial intelligence, of industry leading companies. The Cybersecurity Department also proactively consults with specialists in a variety of cybersecurity disciplines to review the Company's information systems for cyber risks and to provide advice for remediating areas of concern, as well as for implementing preventative measures to improve the Company's defenses.


text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third-parties for cybersecurity threats and attacks, the Company also has certain critical third-parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us has not occurred or will not occur in the future. For additional information on risks from cybersecurity threats, please see Item 1A Risk Factors.


text: The Director of Global Cybersecurity and the Chief Information Officer, in coordination with the Cybersecurity Department and other appropriate personnel, are responsible for assessing and managing the Company's material risks from cybersecurity threats. Our Director of Global Cybersecurity has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and has been trained and accredited in multiple cybersecurity subjects including training with governmental agencies. Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and holds a Master of Business Administration degree with a concentration in information systems management.


text: The Company regularly confronts cyber risks, threats and incidents, any one of which could have a material impact on the Company, including its business strategy, results of operations or its financial condition. If the Company experiences a cybersecurity incident requiring a response, it has a Computer Incident Response Plan, which defines response protocols, resource allocations and personnel engagement depending on severity level. Executive leadership, including the CEO, would be engaged in the event of an incident at certain severity levels and the CEO would engage members of the Company's board of directors as appropriate. The Cybersecurity Department would also utilize third-party experts and consultants it has on retainer, depending on the nature of the incident.


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity have also had discussions about various cybersecurity topics with a board member in response to requests.


text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third parties for cybersecurity threats and attacks, the Company also has certain critical third parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity are also available to board members to discuss questions concerning cybersecurity matters.


text: The Company relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade information security management program designed to identify, protect, detect and respond to and manage reasonably foreseeable material cybersecurity threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: HELEN OF TROY LTD

ticker: HELE


text: As part of the Company's cybersecurity risk management program, we follow the NIST Cybersecurity Framework ("CSF") to assess, identify and manage risks that arise from cybersecurity threats. The CSF is closely tied to the Company's enterprise risk management processes to identify and document cybersecurity threats and prioritize responses. Included in the CSF process is the identification and assessment of cybersecurity risks to systems, assets, data and resources. The Company also has a vulnerability management process in place. This vulnerability management process helps us to detect and identify threats and vulnerabilities and once identified, to remediate, respond and recover. In addition, our cybersecurity team subscribes to expert and industry standard security feeds and reports, which we use to identify new risks and new vulnerabilities in different systems and infrastructures. Our cybersecurity risk management program also includes cybersecurity awareness training for our associates and an incident response team ("IRT").


text: The Company engages third-party service providers to be able to perform 24/7 proactive monitoring, correlation and triage of logs and activity throughout our systems, networks and infrastructures. These processes are performed by cybersecurity service providers as well as automated detection. These processes include detection and response, as well as vulnerability management and remediation. The Company also has a vendor risk management process to assess risks related to technology third-party service providers where we initially assess their cybersecurity posture upon engaging their services. We annually review these vendors to update our risk assessment and to monitor for any changes that could present additional risks.


text: We also maintain a cyber incident response plan ("IRP") with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect any of our electronic information systems and networks, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents and (3) managing internal and external communications and reporting. Under the IRP, a dedicated information security coordinator is responsible for implementing the IRP, as well as: • identifying the IRT and any appropriate sub-teams to address specific cybersecurity incidents, or categories of cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, communicate, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote associate and stakeholder preparedness and awareness of the IRP; and • reviewing the IRP at least annually, or whenever there is a material change in our business practices that may reasonably affect our cyber incident response procedures.


text: If a cybersecurity incident occurs, under the IRP, the information security coordinator or a designee is required to notify, as necessary and applicable, the IRT and senior executives and organizational leadership, including our Chief Legal Officer, our business partners or service providers and other authorities. Our Chief Legal Officer, working with senior executives, is required under the IRP, as appropriate, to notify the Audit Committee of any cybersecurity incident. As discussed below, the Audit Committee of our Board of Directors oversees risk management relating to cybersecurity.


text: We and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. We do not believe we have experienced any material system security breach that to date has had a material impact on our operations or financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business, operating results and financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors."


text: Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Chief Information Officer ("CIO"). Our current interim CIO has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current interim CIO and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The CIO works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our CIO provides regular updates on cybersecurity matters to our senior management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the CIO and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.


text: Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Senior Vice President of Information Technology ("SVP-IT"). Our current SVP-IT has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current SVP-IT and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The SVP-IT works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our SVP-IT provides regular updates on cybersecurity matters to our senior management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the SVP-IT and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess potential material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: RAMBUS INC

ticker: RMBS


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, if material risks and/or gaps are identified, we will re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Information Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT. Personnel at all levels and departments are made aware of cybersecurity issues through trainings.


text: We engage third party assessors/consultants in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We conduct vendor risk assessments before onboarding identified third-party service providers to review each such service provider's cybersecurity practices and to assess factors such as access controls, incident response capabilities, overall cyber maturity and applicable certifications.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cyber Risk Committee.


text: Our Chief Information Officer, Chief Information Security Officer and our Security Team, which includes Security Engineers, our Senior Manager of Cybersecurity and our Chief Information Security Officer, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Security Team has deep expertise in cybersecurity practices, including security threat evaluation, security operations, incident response, investigations, forensics, threat containment, data security vulnerability management, security policies and procedures, vulnerability scans, penetration testing, infrastructure security, network security, cloud security, identity and access management, role-based access, server and endpoint security, e-mail security, security awareness, logging, security governance and risk mitigations. Our Chief Information Security Officer has over twenty years of experience in security leadership over all aspects of cybersecurity, including security operations, security incident management and cybersecurity governance, policies and procedures, as well as deep expertise in defense in depth, zero trust security architectures and security controls for perimeter, network, endpoint, application and data security layers.


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.


text: In the event of a cybersecurity incident, our Chief Information Security Officer and our Security Team are equipped with a well-defined incident response plan to guide response actions. This incident response plan includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas, as well as senior leadership and the Cyber Risk and/or Audit Committees of our board of directors, as appropriate.


text: Our Chief Information Security Officer also provides quarterly briefings to the Cyber Risk Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents of interest and related responses, cybersecurity systems testing, applicable activities of third parties, and the like. Our Cyber Risk Committee provides regular updates to the board of directors on such reports.


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent third-party risk and security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: As part of our overall enterprise risk management approach, the Company's cybersecurity program framework is focused on the following key areas:


text: As discussed in more detail under the heading "Governance" below, the Board receives presentations and interacts with management on cybersecurity readiness.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, does vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated on a regular basis. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.


text: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, the Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer and our Information Security Director ("CDO"), provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 24 of this Form 10-K for further discussion of the risks related to cybersecurity threats.


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, financial information, intellectual property, and other sensitive information related to our customers and workforce. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We regularly perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. In 2017, we adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to bolster our cybersecurity management system and reduce cybersecurity risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we have entered into partnerships with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from service providers prior to entering any engagement for services. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.


text: The Board has overall responsibility for the oversight of risk management at the Company, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association (ISACA), the Computing Technology Industry Association (CTIA) and the International Information System Security Certification Consortium (ISC2). In addition, we require all new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. In the event of a potentially material incident, the incident response team regularly reports to both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer to assist in making determinations regarding applicable SEC reporting requirements.


text: In addition, our Board receives regular reports from management on matters relating to strategic and operational initiatives, financial performance, cybersecurity and legal developments. The Company's Enterprise Risk Management program, which has been adopted by the Company to further enhance oversight of risks inherent to our business and allow members of the Board and management to gain a greater understanding of the efforts being undertaken to manage the risks confronting the Company, covers cybersecurity risks.


text: Our management believes that our current systems and practice of implementing regular updates positions us well to support current needs and future growth. We use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.


text: Cybersecurity Risks As of December 31, 2023, we have not had any material cybersecurity incidents. However, we face risks associated with cybersecurity incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts or other scams. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of information, including personal information, financial information, intellectual property, and other sensitive information related to our business, customers and workforce ("sensitive information") on both our information systems and those of third-party service providers. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. We refer to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to help inform our cybersecurity management system and reduce cybersecurity risks, although we do not fully implement all aspects of NIST CSF.


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we collaborate with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from applicable service providers prior to entering any engagement for services focused on information technology or processing sensitive information. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.


text: The Board has responsibility for the oversight of risk management at the Company, which includes our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic (at least semi-annual) reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association ("ISACA"), the Computing Technology Industry Association ("CTIA") and the International Information System Security Certification Consortium ("ISC2"). In addition, we require new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the incident response program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. For incidents that meet certain characteristics under the program, the incident response team will escalate and update both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer.


text: To support current needs and future growth, w e use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects, including those for cybersecurity, are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.


text: Cybersecurity Risks As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we previously have and anticipate we will continue to face risks associated with cybersecurity incidents. Although we make efforts to maintain the security and integrity of our networks and systems, and the sensitive information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident, although the amount of coverage may not be sufficient or provide applicable coverage for a given incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."


text: Cybersecurity Overview We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.

companyName: NN INC

ticker: NNBR


text: The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.


text: Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts for any breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of any potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.


text: A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems and information. Our program is integrated into, and cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our cybersecurity risk management program is led by our Vice President of Information Security ("VP"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination, and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to, and prepare appropriate responses to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of [and improvements to], among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management;


text: Index to Financial Statements • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team assisted by external consultants.


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of the May 2023 ransomware incident or any other previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA, "Risk Factors - "Cybersecurity risk."


text: Our Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our VP and our CIO, are both experienced cybersecurity executives. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Our cybersecurity risk management program is led by our Vice President of Information Security, who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents; cross-functional coordination; and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to prepare appropriate responses and respond to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of and improvements to, among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management; • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team with the assistance of external consultants.


text: Index to Financial Statements We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee of the Board also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP of Information Security leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our CIO and our VP of Information Security are both experienced cybersecurity executives. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Risk Management and Strategy HTLF Bank's Risk Management program is designed to identify, assess, monitor and mitigate risks based on various key risk factors we face including, but not limited to financial, operational, regulatory and legal. Cybersecurity is a critical component of our risk management framework given internal dependencies on technology, the evolving digital environment and the rapid acceleration of cyber-threats. HTLF's cybersecurity risk management program is built on three lines of defense Risk Management framework. HTLF's first line of defense provides frontline business, operational and technical controls and support to securely deliver access to HTLF applications and data to HTLF users. As part of the Risk Management function, HTLF's second line of defense is primarily responsible for infrastructure defense and security controls, performing vulnerability assessments, identity access management, business continuity, third-party information security assessments, employee awareness and training programs, and security incident management. Internal Audit functions as HTLF's third line of defense and independently provides assurance, via multiple audit and testing engagements to validate the effectiveness of HTLF's cybersecurity risk management practices, while measuring against regulatory requirements and HTLF's Policies and Standards.

companyName: HEARTLAND FINANCIAL USA INC


text: HTLF's first line of defense is led by our Chief Operations Officer and our Chief Information Officer. HTLF's second line of defense is led by our Chief Risk Officer ("CRO") and includes the Security function, led by our Chief Information Security Officer ("CISO") who is primarily responsible for the cybersecurity component. The primary responsibilities of the HTLF Security function are to protect HTLF assets including networks, systems, application, data, funds, and staff, and facilitate incident response and resolution. HTLF's third line of defense is led by our Chief Audit Executive.


text: Our primary objectives for managing cybersecurity risk are to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, exploit or misuse our information or systems. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The NIST cybersecurity framework is a nationally recognized industry standard for mitigating organizational cybersecurity risks, which includes identifying risks, protecting assets, detecting threats, responding to incidents, and recovery from incidents. The NIST cybersecurity framework uses standards, procedures and best practices, and is integrated into the HTLF Security team's overall risk management system and processes, including oversight of third-party service providers. Management of the HTLF's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Enterprise Risk Management through its Third Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Security and Business Continuity. A technical requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. Further, HTLF's Security program also provides for annual mandatory training for employees regarding security awareness and understanding of how to properly use and protect the company assets, including computing resources entrusted to them, and to communicate the company's information security policies, standards, processes and practices.


text: To address evolving cybersecurity risks and corresponding regulations, the HTLF Security team uses Federal Financial Institutions Examination Council ("FFIEC") booklets and Cybersecurity and Infrastructure Agency ("CISA") guidance; identifies and defines emerging risks using third-party research and subject matter expert consultants; executes strategic cyber threat assessments; performs new product and initiative reviews; performs data management risk oversight; and conducts cyber risk reviews as part of HTLF's Third Party Risk Management process, which oversees and identifies risks, including cybersecurity threats, associated with our use of third-party service providers. The HTLF Security team conducts periodic tabletop exercises to test HTLF business units' capabilities to respond to various security incidents, including cyber-attacks.


text: Our CISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity governance (policies and procedures), risk assessment, defense operations, incident response, vulnerability monitoring, threat intelligence, identity access governance, information security/cyber related third-party risk management, and business continuity. Moreover, the Security function is responsible for assessing, managing and remediating material risks from cybersecurity threats. The Security management team has the technical, management and project leadership experience in mid-sized or larger banks, maintains appropriate technical certifications, and stay abreast of industry, technical and regulatory best practices and requirements.


text: If a cybersecurity event occurs, the CISO leads the HTLF Incident Response Team as part of our Incident Response Plan designed to help reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled to mitigate material risks. The CISO and CRO work with key cross functional stakeholders, including members of executive leadership and provide updates to the HTLF Risk Committee on the status and impact of the cybersecurity event, as well as review the event with the Risk Committee following its ultimate resolution in order to share root cause and lessons learned from the incident.


text: HTLF has implemented a robust corporate governance framework comprised of the HTLF Board of Directors and its committees; which in turn delegate authority to management for implementation of the risk management program including cybersecurity as an integral component. The corporate governance framework is designed to provide transparency through routine reporting as provided by the CISO to facilitate effective oversight of cybersecurity risk by the Board and executive management. The management committee layer of the corporate governance framework is supported by an Operational Risk Committee which serves as a key forum for the CISO to report quarterly updates on HTLF's cybersecurity risk profile, key metrics and risk indicators used to monitor the operating environment, emerging risks and threats as well as any cybersecurity incidents or events. In addition, the CISO has a routine reporting cadence with the Executive Risk Management Committee and the HTLF Risk Committee on the status of the cyber security management program, including trending of key risk metrics, results of risk assessments, audits and regulatory examinations.


text: HTLF has not been materially affected by any cyber security incidents to date, nor are we aware of any cyber security incident which we believe would have a material impact on us in the future. Nevertheless, like all financial institutions, we are subject to the risk that cybersecurity threats will continue to evolve and may materially impact us in the future. These factors are further detailed in the "Risk Factors" section included under Item 1A of Part I of this Annual Report on Form 10-K, including under the caption "Security breaches, cyber-attacks or other similar incidents with respect to our or our vendors' systems or network security, as well as the resulting theft or compromise of business and customer information, including personal information, could adversely affect our business or reputation, and create significant legal, regulatory or financial exposure."


text: Protecting the information maintained by the Company about its patients, customers, colleagues, and partners against external and internal threats is a priority for the Company. Accordingly, the Company invests in the development and implementation of cybersecurity policies, control standards, and control procedures, including a risk management and assessment program, security and event monitoring capabilities, an incident response plan, and other detection, prevention, and protection capabilities, including practices and tools to monitor and mitigate external and insider threats. The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures. Mitigation of identified threats and vulnerabilities may be delayed.


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan identifies applicable requirements for incident response, outlines processes for any applicable reporting, as well as provides protocols for incident evaluation, processes for notification and internal escalation of information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk.


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and other cybersecurity professionals who assist in the identification, verification, and validation of cybersecurity risks, as well as support associated mitigation or incident response plans when necessary.