text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and or damage to our business relationships, all of which could negatively impact the Fund."

companyName: CIM Opportunity Zone Fund, L.P.

secItem: Item 1C


text: Management Oversight of Cybersecurity Risk Management CIM's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM's Chief Technology Officer (the "CTO"), CIM's Chief Compliance Officer (the "CCO") as well as representatives from CIM's operations, compliance and accounting departments. The Committee is responsible for CIM's cybersecurity policy and overseeing the activities of CIM's cybersecurity practices, including assessing CIM's risks and controls. The Committee is chaired by the CTO and has more than 30 years' experience in the field of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other things, the CCO, the CTO, the chief financial officers of CIM companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM. The Subcommittee is tasked with assisting CIM-managed companies that are subject to the SEC's cybersecurity rule adopted in 2023, including us, in complying with such cybersecurity rule.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws. Pursuant to CIM's cybersecurity policy, management of the Fund will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Fund's response to such matter.


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: NMF SLF I, Inc.


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: As a health care provider, we regularly process and store patient and resident information. We are committed to the protection of the personal information of our and our independent operating subsidiaries' patients, residents, and employees. We have robust security tools, practices, and policies in place to help ensure the confidentiality, integrity, and accessibility of the data with which we are entrusted.

companyName: Pennant Group, Inc.

ticker: PNTG


text: Certain of the numerous tools and processes that we use to assess, identify and manage material risks include, without limitation: • Automated third-party tools to screen and block malicious content • Dedicated IT security staff who review threats in real time and escalate issues as needed • Regular security tests and audits performed by internal and external parties • Ongoing security training for all employees Our Chief Information Officer ("CIO"), Bryant Saxon, oversees our cybersecurity program and dedicated security resources. Mr. Saxon has over 15 years of direct cybersecurity experience in Chief Information Officer and other key leadership roles in the healthcare industry. His experience includes HIPAA compliance, systems design, security audits, and incident response.


text: Our Board of Directors is also committed to data security and is regularly updated by the CIO on cybersecurity and other relevant technology risks facing the Company. Each quarter, the Audit Committee receives an IT risk update from the CIO, and discusses emerging technology and cybersecurity risks. This risk update includes an overview and discussion of our cybersecurity and risk management programs. In addition, technology risk is a key component of our overall enterprise risk assessment, which is conducted annually and presented to the Board of Directors. Through these processes, the Board of Directors is apprised of, and given the opportunity to discuss at length, any meaningful cybersecurity risks we face. Directors Scott E. Lamb, Gregory K. Morris, and John G. Nackel, Ph. D. provide key oversight on cybersecurity matters. Our executive team is also briefed on any significant security risks during monthly leadership meetings.


text: We emphasize that everyone has a role to play in data security. All employees are provided with data security and privacy training upon hire and as part of annual refresher training. All employees are required to complete this training, and we also provide periodic updates and guidance related to cybersecurity. In addition, we regularly conduct phishing simulations or other tests to identify cyber threats.


text: To address and mitigate cybersecurity risks from third-party systems, the Company implements a stringent process that includes SOC 1 and SOC 2 compliance. These standards help ensure that our third-party vendors maintain appropriate security controls and processes. Additionally, we enter into Business Associate Agreements (BAAs) with relevant third-party vendors. These agreements are critical for reinforcing our cybersecurity framework, as they require vendors to maintain the confidentiality, integrity, and availability of protected health information according to our standards and federal regulations. Additionally, through third-party risk assessments, regular audits, and the enforcement of security requirements, we seek to ensure that all vendors adhere to our standards of data security and privacy. This layered security approach, incorporating both technical compliance and legal agreements, helps to create a defense against external cyber threats.


text: We did not experience any material cybersecurity incidents in 2023. Although we incur numerous costs in the ordinary course of business to address the risks and implement the policies described above, risks from cybersecurity threats did not materially affect our strategy, results of operations, or financial condition in 2023. Although we are deeply committed to cybersecurity, we cannot fully mitigate all technology risks. Cybersecurity threats, including data breaches, ransomware, and similar threats, could materially impact our future results in the future. For further discussion of how any risks from cybersecurity threats may materially affect the Company, including our business strategy, results of operations or financial condition, see Part 1, Item 1A. Risk Factors, which is incorporated by reference into this Part 1, Item 1C. Cybersecurity..


text: We leverage information technology to enable our teams to share best practices, stay informed, adapt to challenges and opportunities promptly, improve the quality of care, mitigate risks, and enhance both clinical outcomes and financial performance. Additionally, we have invested in specialized healthcare technology systems to support our nursing and support staff. Our software and technology in each operation allows our clinical staff to monitor and deliver patient care and record patient information more efficiently, but the use of information systems also introduces cybersecurity risks, including system disruption, security breaches, ransomware, theft, espionage, and inadvertent release of information.


text: We assess and identify security risks to the organization by: • Conducting regular risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and related information processes, stored, or transmitted; • Performing annual security assessments and producing security assessment reports for review by Information Technology ("IT") senior leadership, including the service center's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"); • Regularly assessing security controls for effectiveness, proper functioning, and satisfactory results; and • Continuously monitoring and addressing vulnerabilities.


text: We have established a monitoring strategy and program, which includes: • Active, automated threat detection and screening; • Clearly defined security metrics to be monitored; • Regular security control assessments; • Regular communication about security issues with the executive team and board of directors; • Monitoring information systems to detect attacks and indicators of potential attacks or compromises; • Identifying unauthorized use of information system resources; and • Deploying monitoring systems and agents strategically within the information system environment.


text: We have implemented policies and programs to secure sensitive data. These include: • Data security policies for the Company and its subsidiaries; • Frequent security training; • Establishing controls over network devices, actively tracking, monitoring, and evaluating them for new, missing, or updated software needed to strengthen security, patch known vulnerabilities, or stabilize software or operating system issues; • Protecting sensitive data through encryption techniques; and • Utilizing systems with backup and recoverability principles, such as periodic data backups and safeguards in case of a disaster.


text: 1.The service center's CIO and CISO lead the Information Security ("IS") team in developing, documenting, reviewing, and testing security and incident management procedures;


text: 2.The IS team works with the executive team to identify, assess, verify, and classify incidents to determine affected stakeholders and appropriate parties for contact;


text: 3.In the event of a security incident, the service center's CIO and CISO are responsible for launching an Incident Response Team ("IRT") if necessary and notifying the executive team, who will contact the board of directors and the Audit Committee to validate the response;


text: 4. The IRT, in consultation with outside experts if needed, is responsible for initial containment, analysis, incident containment, incident eradication, and recovery. The IS team also coordinates with our legal and compliance teams as needed; and 5.After each significant incident, analyses are conducted to improve prevention and make incident response processes more efficient and effective.


text: We have not experienced a material cybersecurity breach as an organization in the past five years. Moreover, cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures to address and mitigate cybersecurity threats, there can be no assurances that such an incident will not occur despite our efforts, as described in Item 1A. Risk Factors.


text: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the s ervice center's CIO and CISO, each of whom has over 15 years of experience in IT, including various leadership roles at other large corporations. Directors Scott E. Lamb, Gregory K. Morris M.D., and John G. Nackel, Ph. D. provide key oversight on cybersecurity matters. Our executive team is also regularly briefed on any significant security risks during monthly leadership meetings.


text: The IS team, established by the service center's CIO and CISO, has dedicated cybersecurity staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering, and management of cybersecurity policies, standards, and regulatory compliance. The Company implements security standards that include SOC 1 and SOC 2 compliance. We align with a Cyber Security Framework and take a risk-based approach during control assessment and implementation, following the National Institute of Standards and Technology ("NIST") framework. We are committed to protecting our data, systems, and network and continually invest in enhancements to mitigate or reduce the impact of cybersecurity threats. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies to protect data security. External companies or agencies may provide consulting, guidance, assistance, or support in response to a cybersecurity incident. Employees receive regular training, at least annually, on cybersecurity threats and best practices to maintain information security.


text: Risk Management and Strategy Angel Oak Capital, an affiliate of our Manager, has engaged a third-party managed information technology service provider (the "IT Service Provider"), to serve as Angel Oak Capital's dedicated information technology manager. We have no employees and are externally managed by our Manager, an affiliate of Angel Oak Capital, and as such rely on our Manager for the implementation and execution of our risk management program, and, as it pertains to the assessment, identification, and management of material risks from cybersecurity threats, our Manager relies on the IT Servicer Provider. As an affiliate of Angel Oak Capital, our Manager is subject to and participates in the cybersecurity policies and procedures of Angel Oak Capital. The IT Service Provider provides Angel Oak Capital a system and organization controls report on itself consistent with SOC 2 as part of annual reviews of the IT Service Provider.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: As part of its overall enterprise risk management program, Angel Oak Capital has developed an information security framework (the "Cybersecurity Program"). The purpose of the Cybersecurity Program is to mitigate the risks associated with unauthorized attempts to access Angel Oak Capital's (including our) network for unintended purposes. The Cybersecurity Program is used to assess and understand risks involving information systems and to provide controls and procedures for mitigating those risks and promptly responding to cybersecurity threats and incidents.


text: The IT Service Provider has implemented processes and procedures to assess, identify, manage and protect against material risks from cybersecurity threats including 24/7 network monitoring, ongoing vulnerability and penetration assessments, and employee security awareness training.


text: The IT Service Provider provides Angel Oak Capital with regularly scheduled status reports, including summaries of vulnerabilities, any cybersecurity threats or incidents and the status of responses, and meets with Angel Oak Capital's Chief Operating Officer and Angel Oak Capital's Head of Information Technology (the "Head of IT") on a regular basis to review the reports and the IT Service Provider's services.


text: In addition, the IT Service Provider and Angel Oak Capital have established a notification and escalation framework, based on the severity of a cybersecurity threat or incident, to determine when and to whom the IT Service Provider will provide notifications regarding cybersecurity threats or incidents. The framework includes notification to the Head of IT. Depending on their nature, incidents may also be reported to members of our management, the Audit Committee of our Board of Directors and to our full Board of Directors, as appropriate. In addition to its engagement of the IT Service Provider, we and/or Angel Oak Capital may engage other third parties, including auditors and consultants, to perform assessments or audits of our and/or its cybersecurity policies and procedures and/or to assist with the evaluation of a cybersecurity threat or incident, among other matters.


text: As of the date of this filing, we have not experienced any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, future threats or incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Company—"Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information systems, and system failures could significantly disrupt our business, which may, in turn, have a material adverse effect on us." We maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.


text: Our Board of Directors holds oversight responsibility over our risk management process, including material risks related to cybersecurity threats. Our Board of Directors administers this oversight function through its committees, including the Audit Committee and the Affiliated Transactions and Risk Committee. A key part of the Audit Committee's responsibility is overseeing the cybersecurity program.


text: Certain representatives of Angel Oak Capital, including our Manager, periodically report to the Audit Committee as well as to the full Board of Directors, as appropriate, on cybersecurity matters, primarily through presentations by the Head of IT. Such reporting includes updates on the Cybersecurity Program as it impacts us, the reports and services provided by the IT Service Provider, the external threat environment, risk management strategies and any cybersecurity threats or incidents. Presentations to the Audit Committee or the full Board of Directors may also be provided from time to time by the IT Service Provider or another third party firm providing cybersecurity-related services for us or Angel Oak Capital, including our Manager, as deemed necessary or appropriate. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: In addition, the Cybersecurity Program provides for the notification and escalation of identified cybersecurity threats and incidents, with different severity thresholds triggering notification to different recipient groups, including, as appropriate, to members of our management, the Audit Committee and to our full Board of Directors. In the event we or Angel Oak Capital, including our Manager, experiences a cybersecurity incident that materially affects, or is reasonably likely to materially affect, us, members of our management and of our Manager would review the incident with the Audit Committee to consider whether and to what extent disclosure would be required under Item 1.05 of Form 8-K.


text: Risk Management and Strategy Angel Oak Capital, an affiliate of our Manager, has engaged a third-party managed information technology service provider (the "IT Service Provider"), to serve as Angel Oak Capital's dedicated information technology manager. We have no employees and are externally managed by our Manager, an affiliate of Angel Oak Capital, and as such rely on our Manager for the implementation and execution of our risk management program, and, as it pertains to the assessment, identification, and management of material risks from cybersecurity threats, our Manager relies on the IT Servicer Provider. As an affiliate of Angel Oak Capital, our Manager is subject to and participates in the cybersecurity policies and procedures of Angel Oak Capital. The IT Service Provider provides Angel Oak Capital a system and organization controls report on itself consistent with SOC 2 as part of annual reviews of the IT Service Provider. Members of the IT Service Provider have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk.


text: As of the date of this filing, we have not experienced any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, future threats or incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Part I, Item 1A. "Risk Factors—Risks Related to Our Company—Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "— We are highly dependent on information systems, and system failures could significantly disrupt our business, which may, in turn, have a material adverse effect on us." We maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.


text: Our Board of Directors holds oversight responsibility over our risk management process, including material risks related to cybersecurity threats. Our Board of Directors administers this oversight function through its committees, including the Audit Committee and the Affiliated Transactions and Risk Committee. A key part of the Audit Committee's responsibility is overseeing the Cybersecurity Program.


text: Certain representatives of Angel Oak Capital, including our Manager, regularly report (not less frequently than annually) to the Audit Committee as well as to our full Board of Directors, as appropriate, on cybersecurity matters, primarily through presentations by the Head of IT. Such reporting includes updates on the Cybersecurity Program as it impacts us, the reports and services provided by the IT Service Provider, the external threat environment, risk management strategies and any cybersecurity threats or incidents. Presentations to the Audit Committee or our full Board of Directors may also be provided from time to time by the IT Service Provider or another third party firm providing cybersecurity-related services for us or Angel Oak Capital, including our Manager, as deemed necessary or appropriate. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: In addition, the Cybersecurity Program provides for the notification and escalation of identified cybersecurity threats and incidents, with different severity thresholds triggering notification to different recipient groups, including, as appropriate, to members of our management, the Audit Committee and to our full Board of Directors. In the event we or Angel Oak Capital, including our Manager, experiences a cybersecurity incident that materially affects, or is reasonably likely to materially affect us, members of our management and of our Manager would review the incident with the Audit Committee to consider whether and to what extent disclosure would be required under Item 1.05 of Form 8-K. An independent member of our Board of Directors has experience managing the information technology function of a mortgage acquisition, servicing, and securitization platform.


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools that are widely used in the industry, and internal solutions. We have an enterprise-wide Information Security Incident Response Plan ("IRP"), which describes the detailed processes and procedures that should be followed in the event of an information security incident. We conduct assessments based on the National Institute of Standards and Technology cybersecurity framework (the "NIST CSF") to measure our progress under the maturity framework of NIST CSF and continue to identify opportunities for improvement in our information security program.

companyName: Chewy, Inc.

ticker: CHWY


text: We continuously assess technology risks and threats and monitor our information systems for potential vulnerabilities based on industry trends and evolving threats. We use our IRP to identify, evaluate, respond to and resolve information security incidents. We conduct regular reviews of our information security program and also validate our information security program by conducting tabletop exercises, penetration and vulnerability testing, red team campaigns to identify potential vulnerabilities, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our IRP. Our auditors perform independent audits on aspects of our information security program for assurance purposes. We occasionally engage third-party assessors to assess different aspects of our information security program. We conduct regular training for employees on different cybersecurity topics and best practices. We also conduct a risk-based analysis on third-party vendors that we engage to process personal data and confidential information for us and provide them with our information security requirements prior to their engagement.


text: We are occasionally subject to cybersecurity incidents and we use our IRP to respond to such incidents. Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations. We also occasionally experience the misuse or unauthorized disclosure of personal information, other data, confidential information or intellectual property. We occasionally experience account take overs by bad actors using the credentials of customers acquired from the dark web unrelated to any breaches in our systems. These incidents have not had a material impact on us to date, including our business strategy, financial condition, or results of operations. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, financial condition, or results of operations. For more information about the cybersecurity risks we face, see the risk factor titled "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or to otherwise protect our confidential information, could damage our reputation and brand and harm our business, financial condition, and results of operations" under Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: The Vice President of Security and Data Systems (the "CISO") leads our information security organization and is responsible for managing our information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading cybersecurity programs at other public companies. Team members who support our information security program have relevant educational, industry, and professional experience. Our information security team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: Our enterprise risk assessment includes our key cybersecurity risks. The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including technology risks and cybersecurity threats. Our CISO provides quarterly updates to the Audit Committee of the Board, which oversees our cybersecurity risks and regularly reviews and discusses with management various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance; discussion on policies, guidelines, and processes used by management to assess and manage such matters; and the steps management has taken to monitor and control such matters.


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, protect, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools and services that are widely used in the industry, and internal solutions. We have an enterprise-wide Information Security Incident Response Plan ("IRP"), which describes the detailed processes and procedures that should be followed in the event of an information security incident. We conduct assessments based on the National Institute of Standards and Technology cybersecurity framework (the "NIST CSF") to measure our progress under the maturity framework of NIST CSF and continue to identify opportunities for improvement in our information security program.


text: We continuously assess technology risks and threats and monitor our information systems for potential vulnerabilities based on industry trends and evolving threats. We use our IRP to identify, protect, evaluate, respond to and resolve information security incidents. We conduct regular reviews of our information security program and also validate our IRP by conducting tabletop exercises, penetration and vulnerability testing, red team campaigns to identify potential vulnerabilities, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our IRP. Our auditors perform independent audits on aspects of our information security program for assurance purposes. We occasionally engage third-party assessors to assess different aspects of our information security program. We conduct regular training for employees on different cybersecurity topics and best practices. We also conduct a risk-based analysis on third-party vendors that we engage to process personal data and confidential information for us and provide them with our information security requirements prior to their engagement.


text: We are occasionally subject to cybersecurity incidents and we use our IRP to respond to such incidents. Our e-commerce systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations. We also occasionally experience the misuse or unauthorized disclosure of personal information, other data, confidential information or intellectual property. We occasionally experience incidents unrelated to our system where bad actors attempt to take over customer accounts by using the credentials of customers. These incidents have not had a material impact on us to date, including our business strategy, financial condition, or results of operations. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, financial condition, or results of operations. For more information about the cybersecurity risks we face, see the risk factor titled "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or to otherwise protect our confidential information, could damage our reputation and brand and harm our business, financial condition, and results of operations" under Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: The Vice President of Corporate Systems (the "CISO") leads our information security organization and is responsible for managing our information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading cybersecurity programs at other public companies. Team members who support our information security program have relevant educational, industry, and professional experience. Our information security team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: Our enterprise risk assessment includes our key cybersecurity risks. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including technology risks and cybersecurity threats. Our CISO provides quarterly updates to the Audit Committee of the Board, which oversees our cybersecurity risks and regularly reviews and discusses with management various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance; discussion on policies, guidelines, and processes used by management to assess and manage such matters; and the steps management has taken to monitor and control such matters.


text: The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses all aspects of the corporate information technology environment.

companyName: XPEL, Inc.

ticker: XPEL


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the International Organization Standardization ("ISO") 27001 standard. The Company has an annual assessment, performed by a third party, of the Company's cyber risk management program against this standard.


text: The Company employs a third-party organization to conduct 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.


text: External partners are a key part of the Company's cybersecurity infrastructure. XPEL partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise to control and monitor our processes.


text: The Director of Enterprise Systems leads the Company's cybersecurity program. The Director of Enterprise Systems assesses and manages XPEL's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Director of Enterprise manages the third service party service provider engaged to monitor the Company's cybersecurity environment and is regularly updated by the third party service providers on the cybersecurity activities. The Directory of Enterprise Systems has 21 years of experience in information technology and is supported by a team with additional relevant experience and related certifications.


text: The Audit Committee of the Board oversees XPEL's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Director of Enterprise Systems briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis.


text: XPEL faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows.


text: External partners are a key part of the Company's cybersecurity infrastructure. XPEL partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise to control and monitor its processes.


text: The Director of Enterprise Systems leads the Company's cybersecurity program. The Director of Enterprise Systems assesses and manages XPEL's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Director of Enterprise Systems manages the third-party service provider engaged to monitor the Company's cybersecurity environment and is regularly updated by the third-party service provider on the cybersecurity activities. The Director of Enterprise Systems has 22 years of experience in information technology and is supported by a team with additional relevant experience and related certifications.


text: The Company's Information Security Program ("ISP") is a robust framework overseen by the Information Technology Board Committee ("ITBC") and the IT Steering Committee ("ITSC"). These committees play a pivotal role in managing technology and cyber risks, ensuring compliance with regulatory requirements, and fostering a controlled risk environment.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: The ITBC meets quarterly, while the ITSC meets monthly. Meeting minutes from the ITSC are regularly submitted to the Board for review. These two committees jointly oversee the organization's information technology and cyber risk posture, focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, remediation measures are implemented to reduce the risk to an acceptable level. This commitment to ongoing assessment and responsiveness enhances our ability to adapt to emerging threats and maintain a proactive stance in managing risks effectively.


text: The identification of risks is a multifaceted process that involves a range of activities. This includes monitoring of guidance issued by regulatory authorities, participating in professional forums, conducting both internal and external audits, collaborating with third-party services, reviewing policies, and adhering to best practice frameworks including Federal Financial Institutions Examination Council ("FFIEC") guidance and information security requirements established in the Gramm-Leach Bliley Act, along with other relevant state laws and agency regulations. Furthermore, we emphasize the importance of maintaining a collaborative relationship with third-party service providers/vendors. This collaborative approach enhances our risk management capabilities and ensures a shared commitment to maintaining a secure information environment.


text: Moreover, our commitment to robust risk management extends to the maintenance of a comprehensive Security Incident Response Plan ("SIRP"). This SIRP serves as a framework for effectively addressing and mitigating security incidents. Within this plan, we integrate accessible resources to fortify our response capabilities. This includes establishing collaborative partnerships with insurance providers, regulatory agencies, and law enforcement agencies, ensuring a seamless and coordinated approach in the event of a security incident. Recognizing the interdependence of our practices with service providers and vendors, we actively engage with our partners during the notification and investigation processes following a security incident. This collaborative effort is designed to foster complete visibility into the nature and scope of security risks and events, enabling a unified and effective response.


text: Our SIRP is dynamic and adaptable, evolving in tandem with the ever-changing cybersecurity landscape. By regularly updating and refining our response strategies, we remain prepared to confront emerging threats.


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data.


text: Our Board, supported by the ITBC and the ITSC, actively oversees our processes for management of cybersecurity risks and threats. The Board's responsibilities include the ongoing administration of the ISP, conducting an annual review, and granting approval. Regular reviews of reports by both the Board and the ITBC, submitted by the ITSC, ensure timely awareness of emerging concerns and facilitate continuous enhancements to our cybersecurity posture. In addition to governance oversight, the Board designates key roles crucial for effective cybersecurity management. This includes appointing the Information Security Officer ("ISO"), Chief Information Officer ("CIO"), and Chief Compliance Officer ("CCO"). The ISO and CIO roles are filled jointly by one individual, who has been with the organization for 19 years with over 25 years of experience in information technology. Our Chief Compliance Officer has been with the organization for over 36 years, with over 15 years of experience in compliance. These professionals bring diverse qualifications, certifications, and experience, ensuring a comprehensive approach to our information security initiatives. These qualifications and certifications include Certified Information Security Manager (CISM), Certified Banking Security Manager (CBSM), and Certified Information Security Professional (CISSP).


text: Our governance structure ensures a comprehensive approach to managing cybersecurity risks and threats, aligning with the Board-approved ISP. The ITBC, which is comprised of several Board members, the CIO, ISO, Chief Executive Officer and Chief Operating Officer, is responsible for establishing and updating the Company's Risk Appetite Statement. The ITSC, appointed by the Board of Directors and comprised of the CIO, ISO, CCO and various other representatives from each area of the Bank, is responsible for overseeing ISP compliance. This involves delineating lines of responsibility and accountability for information security risk management decisions. The ITSC also reviews and approves significant changes to our control environments, ensuring that outside independent organizations conduct annual vulnerability assessments and penetration tests. Furthermore, they examine reports submitted by the ISO.


text: The ISO is responsible for reporting, at least annually, to the Board of Directors on the status of the ISP, including overall compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: The identification of risks is a multifaceted process that involves a range of activities. This includes monitoring of guidance issued by regulatory authorities, participating in professional forums, conducting both internal and external audits, collaborating with third-party services, reviewing policies, and adhering to best practice frameworks including Federal Financial Institutions Examination Council ("FFIEC") guidance and information security requirements established in the Gramm-Leach Bliley Act, along with other relevant state laws and agency regulations. For instance, as part of our risk management framework, we regularly assess phishing threats targeting employees, conduct simulated attack exercises, and implement enhanced endpoint detection solutions. Furthermore, we emphasize the importance of maintaining a collaborative relationship with third-party service providers/vendors. This collaborative approach enhances our risk management capabilities and ensures a shared commitment to maintaining a secure information environment.


text: Moreover, our commitment to robust risk management extends to the maintenance of a comprehensive Security Incident Response Plan ("SIRP"). This SIRP serves as a framework for effectively addressing and mitigating security incidents. Within this plan, we integrate accessible resources to fortify our response capabilities. This includes establishing collaborative partnerships with insurance providers, regulatory agencies, and law enforcement agencies, ensuring a seamless and coordinated approach in the event of a security incident. Recognizing the interdependence of our practices with service providers and vendors, we actively engage with our partners during the notification and investigation processes following a security incident. This collaborative effort is designed to foster complete visibility into the nature and scope of security risks and events, enabling a unified and effective response. In addition to incident response, the Company implements robust data protection measures, including encryption protocols, multi-factor authentication, and data loss prevention controls, to safeguard sensitive information. To ensure we can keep our operations running smoothly, we maintain and regularly test our business continuity and disaster recovery plans. These measures help minimize disruption and ensure a swift recovery in the event of a cybersecurity incident.


text: Our SIRP is dynamic and adaptable, evolving in tandem with the ever-changing cybersecurity landscape. By regularly updating and refining our response strategies, we remain prepared to confront emerging threats. The Company also maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data. In determining materiality, the Company evaluates factors such as potential financial loss, operational disruptions, regulatory implications, and reputational harm. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.


text: Our Board, supported by the ITBC and the ITSC, actively oversees our processes for management of cybersecurity risks and threats. The Board's responsibilities include the ongoing administration of the ISP, conducting an annual review, and granting approval. Regular reviews of reports by both the Board and the ITBC, submitted by the ITSC, ensure timely awareness of emerging concerns and facilitate continuous enhancements to our cybersecurity posture. In addition to governance oversight, the Board designates key roles crucial for effective cybersecurity management. This includes appointing the Information Security Officer ("ISO"), Chief Information Officer ("CIO"), and Chief Compliance Officer ("CCO"). The ISO and CIO roles are filled jointly by one individual, who has been with the organization for 20 years with over 25 years of experience in information technology. Our Chief Compliance Officer has been with the organization for over 37 years, with over 15 years of experience in compliance. These professionals bring diverse qualifications, certifications, and experience, ensuring a comprehensive approach to our information security initiatives. These qualifications and certifications include Certified Information Security Manager (CISM) and Certified Banking Security Manager (CBSM).


text: The ISO is responsible for reporting, at least annually, to the Board of Directors on the status of the ISP, including overall compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP. The Board also receives quarterly cybersecurity briefings that include updates on emerging threats, results of cybersecurity risk assessments, and the effectiveness of current controls. These discussions inform strategic decision-making and resource allocation for cybersecurity investments.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our providers, patients, customers, clients, business partners, and employees. Our Board of Directors is actively involved in oversight of the Company's risk management program through the Compliance Subcommittee of the Audit Committee of our Board of Directors (the "Compliance Subcommittee"), and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UpHealth, Inc.


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under the heading Governance, our Board of Directors' oversight of cybersecurity risk management is supported by the Compliance Subcommittee, which regularly interacts with our ERM function, our Information Security Director, and other members of management and relevant management committees, including management's Executive Compliance Committee, which reports to our Chief Privacy and Compliance Officer and the Chair of the Compliance Subcommittee. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security controls and operating effectiveness. The results of such assessments, audits and reviews are reported to the Executive Compliance Committee and the Compliance Subcommittee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Compliance Subcommittee oversees our ERM process, including the management of risks arising from cybersecurity threats. The Compliance Subcommittee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Compliance Subcommittee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, our Chief Privacy and Compliance Officer and our Information Security Director discuss the Company's approach to cybersecurity risk management with the Compliance Subcommittee.


text: The Compliance Subcommittee is comprised of two of our independent directors, Dr. Raluca Dinu, who serves as its Chair, and Mark Guinan, who serves as a member of the Compliance Subcommittee and also serves as Chairman of the Audit Committee. Each of Dr. Dinu and Mr. Guinan has served in various board and executive roles with risk oversight at public and private companies, each hold undergraduate and graduate degrees in their respective fields, and collectively they have over 23 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Information Security Director, in coordination with the Executive Compliance Committee, which includes our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Director and the Executive Compliance Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Compliance Subcommittee when appropriate.


text: Our Information Security Director has served in various roles in information technology and information security for over 20 years, including as a security consultant and as the Chief Information Security Officer for private companies, and has attained professional certifications in information technology and information security, healthcare privacy, and compliance. We also have security consultants who regularly work with us. One such consultant, who previously served as our Vice President Information Security until his retirement in January 2024, has over 40 years of experience serving in various roles in information technology and information security, holds undergraduate and graduate degrees in business administration, and has attained the professional certifications of Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Project Management Professional. Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer each hold undergraduate and graduate degrees in their respective fields, and collectively they have over 70 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: We believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See Item 1A, Risk Factors, of Part I of this Annual Report for the discussion of our risks related to cybersecurity.


text: Risk Management Strategy Xerox Holdings maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The underlying controls of the cyber risk management program are based on recognized leading practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001 Information Security Management System Requirements.

companyName: XEROX CORP


text: The risk management program is primarily focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. The structured risk management process is designed to comprehensively identify and assess risks, implement effective mitigation and remediation strategies, enhance overall cybersecurity resilience, and provide transparent reporting. Continuous risk assessments are conducted through internal evaluations and routine engagements with independent third-party security services organizations to systematically identify, prioritize and manage information security risks. Subsequently, risk mitigation strategies are developed and executed to address and remediate identified risks effectively through new cybersecurity initiatives and ongoing enhancements to the cybersecurity program. Regular audits and assessments, including penetration tests and attack simulations, are performed both internally and through independent third-party consultants, and internal auditors evaluate the operational effectiveness of cybersecurity controls and risk management measures. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking, multi-year mitigated basis. A formal process exists, grounded in the enterprise risk management program where material risks, interdependencies, and the associated remediation plans that are tracked to completion at a minimum on a monthly basis are presented and discussed cross-functionally. In addition to the normal discourse on emerging risks, a focused drill down into cybersecurity risk is presented annually at the enterprise risk steering committee meeting. The outcomes of these discussions are submitted quarterly to the Audit Committee of the Board of Directors.


text: All employees and contractors play an important role in protecting the organization from cyber threats. We have implemented a formal cybersecurity training and awareness program that includes mandatory annual information security training and continuous education through various enterprise collaboration platforms. Our Cyber Defense team plays an important role in implementing our protection, detection, and response capabilities. Security incidents are evaluated, ranked by severity and prioritized for response and remediation. Our incident response process outlines actions required to triage, analyze, contain, remediate, and safely recover from cybersecurity incidents. Security incidents are evaluated to determine materiality as well as operational and business impacts, and are reviewed for privacy impacts.


text: Xerox Holdings has established a structured third-party risk management program, with a primary focus on assessing and mitigating potential cyber risks linked to external vendors and partners who have access to the organization's digital assets or play a role in storing and processing data. This also extends to the software supply chain supporting our products and services. A thorough due diligence process is conducted on all prospective third parties to evaluate their overall security posture and alignment with Xerox Holdings' organizational standards. Additionally, ongoing assessments are regularly conducted on selected existing vendors and partners to confirm their continuous compliance with Xerox Holdings' cybersecurity standards and policies. Where applicable, we also include security and data privacy addendums in our third-party contracts. Xerox Holdings also engages with external managed security service providers to support certain day-to-day operational activities in addition to in-house cybersecurity staff as part of the cybersecurity program.


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business. Refer to Item 1A Risk Factors for additional discussion of risks associated with cybersecurity threats to the Company.


text: Xerox Holdings' Cybersecurity organization is a global organization and is dedicated to protecting its infrastructure, information, and digital assets. It is responsible for establishing appropriate security policies, safeguards and controls to prevent, detect and respond to cyber threats, meet regulatory and compliance requirements, securing Xerox Holdings' intellectual property, products and services, and supply chain in collaboration with business, product, and IT partners. The information security organization is led by the Chief Information Security Officer (CISO) who reports to the Chief Transformation and Administrative Officer. In his over 18-year career as a Cybersecurity professional, the CISO has served in various roles with Fortune 500 companies, including as Deputy CISO, Head of Cyber Defense & Security Architecture, Distinguished Technologist Security, and Specialist Master. The CISO holds a bachelor's degree in Electrical and Electronics Engineering, is a Certified Information Systems Security Professional (CISSP), and has extensive experience in multiple security domains, including security operations, security architecture, identity and access management, cloud security, vulnerability management, and application/product security, policy, and compliance.


text: The Audit Committee of the Board of Directors provides governance and oversight of the cybersecurity program and approves the information security program annually. Regular updates are presented to the Audit Committee by the CISO on the current state of the cybersecurity program, providing transparency including progress on initiatives, operational and compliance metrics, risks, cybersecurity and data privacy incidents (if any), and appropriate remediation actions. The Board of Directors also considers cybersecurity topics on an ad hoc basis where appropriate, including for purposes of receiving briefings on developments in cybersecurity or cybersecurity incidents and assessing and managing potentially material risks arising from cybersecurity threats. There are two committees comprised of Company leadership, including the enterprise risk management steering committee, which meets monthly, and the Xerox Holdings management audit committee, which meets at least quarterly, to discuss the current operational and security compliance metrics, cybersecurity incidents, and risks.


text: Legal Sign-off 2.24.25 The risk management program is primarily focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. The structured risk management process is designed to comprehensively identify and assess risks, implement effective mitigation and remediation strategies, enhance overall cybersecurity resilience, and provide transparent reporting. Continuous risk assessments are conducted through internal evaluations and routine engagements with independent third-party security services organizations to systematically identify, prioritize and manage information security risks. Subsequently, risk mitigation strategies are developed and executed to address and remediate identified risks effectively through new cybersecurity initiatives and ongoing enhancements to the cybersecurity program. Regular audits and assessments, including penetration tests and attack simulations, are performed both internally and through independent third-party consultants, and internal auditors evaluate the operational effectiveness of cybersecurity controls and risk management measures. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking, multi-year mitigated basis. A formal process exists grounded in the enterprise risk management program where material risks, interdependencies, and the associated remediation plans that are tracked to completion at a minimum on a monthly basis are presented and discussed cross-functionally. In addition to the normal discourse on emerging risks, a focused drill down into cybersecurity risk is presented annually at the enterprise risk steering committee meeting.


text: All employees and contractors play an important role in protecting the organization from cyber threats. We have implemented a formal cybersecurity training and awareness program that includes mandatory annual information security training and continuous education through various enterprise collaboration platforms. Our Cyber Defense team plays an important role in implementing our protection, detection, and response capabilities. Security incidents are evaluated, ranked by severity and prioritized for response and remediation. Our incident response process outlines actions required to triage, analyze, contain, remediate, and safely recover from cybersecurity incidents. Our incident response program ensures management is informed and involved in monitoring and addressing security and privacy incidents. The program uses a coordinated escalation model to engage relevant management and Board members as needed. It includes regular training and simulations for preparedness, with periodic updates to the Board on the program's status and significant incidents, ensuring robust oversight and governance. Security incidents are evaluated to determine materiality as well as operational and business impacts and are reviewed for privacy impacts.


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business. We maintain insurance coverage designed to mitigate our exposure to network security and privacy matters. Refer to Item 1A Risk Factors for additional discussion of risks associated with cybersecurity threats to the Company.


text: Xerox Holdings' Cybersecurity organization is a global organization and is dedicated to protecting its infrastructure, information, and digital assets. It is responsible for establishing appropriate security policies, safeguards and controls to prevent, detect and respond to cyber threats, meet regulatory and compliance requirements, secure Xerox Holdings' intellectual property, products and services, and supply chain in collaboration with business, product, and IT partners. The information security organization is led by the Chief Information Security Officer (CISO) who reports to the Chief Administrative Officer and Global Head of Operations. With more than twenty years of experience in security, the CISO began his security career serving in the United States Marine Corps (USMC), leading physical security and executive protection for Marine One. He subsequently led cybersecurity programs for U.S. Cyber Command and the Pentagon, advised Fortune 500 clients on cybersecurity and crisis response matters as an Advisory Director at PwC, and has held positions as CISO or Deputy CISO for public and private companies. The CISO is currently pursuing a Master of Business Administration (MBA), and is a Certified Information Systems Xerox 2024 Annual Report 25


text: Legal Sign-off 2.24.25 Security Professional (CISSP) and Certified Information Security Manager (CISM). He has extensive experience in multiple security domains, including security operations, incident detection and response, security architecture, identity and access management, cloud security, vulnerability and threat management, application/product security, policy, and compliance.


text: The Audit Committee of the Board of Directors provides governance and oversight of the cybersecurity program and approves the information security program annually. Regular updates are presented to the Audit Committee by the CISO on the current state of the cybersecurity program, providing transparency including progress on initiatives, operational and compliance metrics, risks, cybersecurity and data privacy incidents (if any), and appropriate remediation actions. The outcomes of these cross-functional risk discussions noted above, are submitted quarterly to the Audit Committee of the Board of Directors.


text: The Board of Directors also considers cybersecurity topics on an ad hoc basis where appropriate, including for purposes of receiving briefings on developments in cybersecurity or cybersecurity incidents and assessing and managing potentially material risks arising from cybersecurity threats. There are two committees comprised of Company leadership, including the enterprise risk management steering committee, which meets monthly, and the Xerox Holdings management audit committee, which meets at least quarterly, to discuss the current operational and security compliance metrics, cybersecurity incidents, and risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: 10x Genomics, Inc.

ticker: TXG


text: We design and assess our program based on the Center For Internet Security ("CIS") Controls. While this does not imply that we meet any particular technical standards, specifications or requirements, we use the CIS Controls framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. In March 2020, we experienced a ransomware attack in which cybercriminals were able to access our information technology systems. While we isolated the source of the attack and restored normal operations with no material day-to-day impact to us or our ability to access our data, we believe confidential information was stolen. We believe it is possible that the ransomware attack could lead to the disclosure of our trade secrets or other intellectual property, or could lead to the exposure of personal information of our employees. The release of any of this information could have, but is not reasonably likely to have, a material adverse effect on our business, operations, business strategy, results of operations or financial condition. The March 2020 ransomware attack has not, but it is possible that it could, result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy regulations, violations of which could, but is not reasonably likely to, result in significant judgements against us, penalties and fines. For more information, see the section titled "Risk Factor—Risks related to our intellectual roperty, information technology and data security—If we or our critical third-party providers experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks, including written reports. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our Chief Legal Officer, Chief Information Officer, President, Chief Financial Officer and Vice President of Data Analytics and Information Security is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cumulative experience includes decades of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies. Our Chief Information Officer has served in various roles in information technology for almost 20 years and has been with us since 2013. He holds undergraduate and postgraduate degrees in computer science from Harvard University. Our Vice President of Data Analytics and Information Security has served in various roles in information technology and information security for more than 10 years. He holds an undergraduate degree in engineering science from Harvard University and postgraduate degrees in computer science from Massachusetts Institute of Technology. Our Chief Legal Officer has over 25 years of experience managing risks, including risks arising from cybersecurity threats, at several large publicly-traded technology companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our cybersecurity risk management program is integrated into our overall risk management program which includes insurance coverage for cybersecurity incidents and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factor—Risks related to our intellectual property, information technology and data security—If we or our critical third-party providers experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Our management team, including our Chief Legal Officer, President, Chief Financial Officer and Vice President of Data Analytics and Information Security is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cumulative experience includes decades of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies. Our Vice President of Data Analytics and Information Security has served in various roles in information technology and information security for more than 10 years. He holds an undergraduate degree in engineering science from Harvard University and postgraduate degrees in computer science from Massachusetts Institute of Technology. Our Chief Legal Officer has over 25 years of experience managing risks, including risks arising from cybersecurity threats, at several large publicly-traded technology companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Assessing, identifying and managing data security, privacy and cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process, which considers all strategic, operational, compliance and financial risks across the organization. Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain Board members. Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies. Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion. Low and medium risks are subject to various levels of internal monitoring. The annual risk assessment is reviewed with the Audit and Risk Committee and the Board of Directors.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks. Our CIO has a Bachelor of Science in Computer Engineering and over 26 years of experience in senior leadership privacy, information technology and cybersecurity oversight roles, including within the grocery retail industry. Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc. and Gap, Inc. Under the direction of our information technology department, we have implemented policies and controls in line with the requirements of the International Organization for Standardization and have assessed our cybersecurity maturity levels against the National Institute of Standards and Technology framework to set appropriate standards and guidelines. We monitor and remediate threats through our managed detection and response, and our vulnerability management programs. We provide regular employee communications and mandatory training, periodically review our incident response and breach notification plan, and leverage third-party expertise for testing, assessments and improvements. We have an onboarding and periodic security review process of all third party vendors who have or will have access to our confidential information. We also have established business continuity disaster recovery plans that are designed to limit downtime and data loss in the event of a security breach.


text: As we have increased our remote workforce in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency. As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions. We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for our company.


text: We have a written incident response plan that is implemented by our cybersecurity incident response team, comprised of members of our information security, legal, human resources, finance and communications teams, and whose function is to respond to any such incident, define and seek to control the extent of the incident, assess and take reasonable actions intended to remediate any damage caused, and implement measures designed to prevent future reoccurrences. The materiality of any cybersecurity incident is evaluated by senior management, including the legal and finance departments, and, in certain circumstances by our third-party advisors. We periodically perform simulations (referred to as tabletop exercises) at a management level with external resources and advisors.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our results of operations or financial condition, in fiscal 2023 and recent years, we have, from time to time, experienced threats to and attempted breaches of our data and systems, including malware and computer virus attacks. In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance. We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us. For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Assessing, identifying and managing data security, privacy and cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process, which considers all strategic, operational, compliance and financial risks across the organization. Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain members of the Board. Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies. Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion. Low and medium risks are subject to various levels of internal monitoring. The annual risk assessment is reviewed with the Audit and Risk Committee of the Board and the Board.


text: Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks. Our Chief Information Officer ("CIO") has a PGDip in Computer Science, an MBA, a Master of Mathematics and over 20 years of experience in senior leadership information technology and cybersecurity oversight roles, including within the retail industry. Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc. and Gap, Inc. Under the direction of our information technology department, we have implemented policies and controls in line with the requirements of the International Organization for Standardization and have assessed our cybersecurity maturity levels against the National Institute of Standards and Technology framework to set appropriate standards and guidelines. We monitor and remediate threats through our managed detection and response, and our vulnerability management programs. We provide regular employee communications and mandatory training, periodically review our incident response and breach notification plan, and leverage third-party expertise for testing, assessments and improvements. We have an onboarding and periodic security review process of all third-party vendors who have or will have access to our confidential information. We also have established business continuity disaster recovery plans that are designed to limit downtime and data loss in the event of a security breach.


text: As we have increased our remote workforce in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency. As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions. We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for us.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our results of operations or financial condition, in fiscal 2024 and recent years, we have, from time to time, experienced threats to and attempted breaches of our data and systems, including malware and computer virus attacks. In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance. We carry cyber risk insurance that we believe provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us. For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A. Risk Factors" of this Form 10-K.


text: Overview and Leadership Our enterprise risk management framework addresses cybersecurity risk along with other risks as part of our overall enterprise risk management process. We maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology to support our information technology systems and detect, identify, prevent, defend against and mitigate information technology and data security risks. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework. This framework encompasses key processes, policies and controls to ensure protection, detection, identification, response and recovery capabilities across our organization.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data as well as the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analyses regularly.