text: To our knowledge, we have not had a cybersecurity incident that has materially affected Quaint Oak Bancorp, its business strategy, financial condition, or results of operation.


text: Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity and availability of customer and bank sensitive information. Any loss of confidentiality, integrity or availability introduces operational, compliance, strategic, transactional, reputational, legal and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Magnolia Bancorp and Mutual Savings and Loan Association. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative and physical controls.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO

secItem: Item 1C


text: Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Mutual Savings and Loan Association's compliance with the Gramm-Leach-Bliley Act, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: Senior management takes the guidance provided by the Board of Directors and transforms this guidance into operational priorities which are implemented and maintained by the staff members and third-party service providers. In addition, the senior management team ensures that budgeted resources are allocated in a timely manner to support the various security initiatives.


text: The Director of Compliance and Internal Audit and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques and their responsibilities to keep our information confidential, accurate and available.


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review. Finally, Mutual Savings and Loan Association complies with its regulatory requirements by having federal safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations that Magnolia Bancorp and Mutual Savings and Loan Association have to their respective customers, shareholders, staff members and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Magnolia Bancorp, its business strategy, financial condition or results of operation.


text: Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quaint Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use of technical, administrative, and physical controls.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Enterprise Risk Management Committee has the responsibility of assessing risks associated with technology and information security, including cybersecurity. The Enterprise Risk Management Committee reports directly to our Board of Directors. The Board of Directors reviews and approves Information Security Risk Assessments and performance reviews which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, Third Party Risk Management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: Operational Information Technology and Information Security staff members, and third -party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported quarterly to the IT Steering Committee, Enterprise Risk Management Committee, and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. Incident Response team members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.


text: Finally, Quaint Oak Bank complies with its regulatory requirements by having Federal and State safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations Quaint Oak Bancorp and Quaint Oak Bank have to their respective customers, shareholders, staff members, and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.


text: As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and information technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.


text: These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.


text: Our policies and procedures define an overall, enterprise-wide approach for managing information security and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed. Capital One Financial Corporation (COF)


text: 2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk's potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.


text: 3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.


text: 4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see "Governance" below.


text: Our policies and procedures collectively help execute a risk management approach that accounts for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. The procedures, capabilities and processes established under our policies are subject to regular review by the Chief Information Security Officer ("CISO") and Chief Technology Risk Officer ("CTRO"). See "Governance" below for more information.


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. In addition, a range of cyber educational initiatives are employed to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities.


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") for handling potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for escalation and other actions, and helps to plan follow-on actions designed to reduce the likelihood of similar events' recurrence in the future.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see "Item 1A. Risk Factors" under the headings "We face risks related to our operational, technological and organizational infrastructure," and "A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions."


text: The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors ("Risk Committee") assists the full Board of Directors in discharging these responsibilities.


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the CIO; reviews our information security program with the CISO and the CTRO; and approves our information security policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model.


text: For information security and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide information security program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.


text: Our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our information security and technology risk programs and challenge of first line risk management and risk-taking activities pertaining to information security and technology risk. • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.


text: Our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our information security and technology risk management processes are designed and working as intended.


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications.


text: As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks. For further discussion of cybersecurity and technology risk, and related risks for our business, see "Item 1A. Risk Factors. "


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity and technology risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.


text: These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.


text: Our policies and procedures define an overall, enterprise-wide approach for managing cybersecurity and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential cybersecurity and technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed.


text: 2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk's potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.


text: 3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.


text: 4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see "Governance" below.


text: Our policies and procedures collectively help execute a risk management approach designed to account for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, our third-party risk management policy is designed to help enable timely and effective identification, measurement, and management of third-party risks throughout the lifecycle of such relationships, which includes planning, due diligence and third-party selection, contracting, risk-based monitoring, and termination. We also assess, identify, and manage cybersecurity and technology risks associated with our merger and acquisition activities. See "Governance" below for more information.


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques designed to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. When appropriate, we leverage partnerships with relevant government entities, law enforcement agencies, and industry information sharing forums, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to further inform our understanding of the threat environment and how to effectively defend the Company against such threats. These defenses include, among other things, a range of cyber educational initiatives that we design and deliver to employees across the enterprise to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities. Employees are required to annually certify their completion of training on both cybersecurity and data privacy, and our cyber education program implements targeted testing and training focused on high-risk populations and responding to an evolving threat landscape.


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") designed to handle potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for taking actions and escalations to our executive management and the Board of Directors, as appropriate, and helps to plan follow-on actions that seek to reduce the likelihood of similar events' recurrence in the future. The ECRP is reviewed and refined periodically and refinement is informed in part by a series of table-top exercises that we conduct over the course of the year.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see "Item 1A. Risk Factors" under the headings "We face risks related to our operational, technological and organizational infrastructure," and "A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions."


text: The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors ("Risk Committee") assists the full Board of Directors in discharging these responsibilities.


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments, which, in the aggregate, are intended to present an overall view on the status of our cybersecurity program and the Company's compliance with applicable legal and regulatory requirements. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the Chief Information Officer ("CIO"); reviews our cybersecurity program with the Chief Information Security Officer ("CISO") and the Chief Technology Risk Officer ("CTRO"); and approves our cybersecurity policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model. For cybersecurity and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide cybersecurity program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.


text: our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our cybersecurity programs and challenges of first line risk management and risk-taking activities pertaining to cybersecurity and technology risk. Capital One Financial Corporation (COF)


text: • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.


text: our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications. In particular, our CISO has more than 30 years of cybersecurity and information technology experience, including for nearly five years as CISO at a major global technology company before joining the Company, and holds a CISO Certificate from Carnegie Mellon's Heinze College. Our CTRO has been in cybersecurity for approximately 25 years and spent over three years as the global CISO of a G-SIB. Prior to that, he served as a senior executive in cybersecurity in the U.S. government. Our CIO has been with the Company for approximately 20 years, during which he has overseen multiple technology transformation initiatives, including the Company's transition to the public cloud. He holds degrees in physics and business administration from Harvard University.


text: Risk Management and Security As a diversified healthcare services leader that is dedicated to advancing health outcomes for patients everywhere, cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and oversight from our Board of Directors ("Board"), performs an annual enterprise-wide risk assessment ("ERA") to identify key existing and emerging risks. One of the principal risks identified and assessed through this process is cybersecurity, which remains a key focus for the Company, management, and our Board.

companyName: MCKESSON CORP

ticker: MCK


text: Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely reviewed and updated as appropriate under the leadership of our Chief Information Security Officer (CISO).


text: Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, assessment or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to identify opportunities for improvements to our cybersecurity program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.


text: McKESSON CORPORATION We develop and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents. In the face of sophisticated and rapidly evolving attempts to overcome our security measures, we must continually monitor and update these systems and programs. Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Our joint Chief Information Officer and Chief Technology Officer (CIO/CTO) leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 28 years of experience managing technology and risks and advising on cybersecurity issues and our CISO has more than 20 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. External consultants also periodically update the Board on cybersecurity trends and developments. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: Our Cybersecurity Risk Management Program ("RM Program") is aligned with the National Institute of Standards and Technology Cybersecurity Framework and other industry best practices. The RM Program is designed to identify, assess and mitigate material cybersecurity risks.


text: McKESSON CORPORATION We have implemented cybersecurity controls designed to protect our systems, data and operations from cybersecurity risks. Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns. Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely tested, reviewed and updated as appropriate under the leadership of our Chief Information Officer and Chief Technology Officer ("CIO/CTO") with the assistance of the Company's Chief Information Security Officer ("CISO").


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to assess our RM Program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.


text: Although we believe that we maintain reasonable cybersecurity measures, we recognize that cyber threats continue to evolve, and no system is immune to risk.


text: Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. For a discussion of whether and how any risks from cybersecurity threats have affected or, if realized, are reasonably likely to materially affect the Company, see "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Our CIO/CTO leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 29 years of experience managing technology and risks, and advising on cybersecurity issues and our CISO has more than 21 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: The Board of Directors recognizes the critical importance of maintaining the trust and confidence of our suppliers, customers, other business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating any cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: Callon Petroleum Co


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "Our business could be negatively affected by security threats. A cyberattack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation or financial loss," the sophistication of cyberattacks continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. Accordingly, no matter how well the Company's controls are designed or implemented, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. In light of these risks, the Company has also developed cybersecurity detection and response protocols as described below to attempt to mitigate the impact in the event of a breach.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance – The Board of Directors has responsibility for oversight of cybersecurity risk management and regularly interacts with the Company's ERM function, the Company's Chief Information Officer ("CIO"), and other members of management. • Collaborative Approach – The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company also collaborates with others in the industry and actively participates in a specific oil and gas threat intelligence group with weekly meetings and up-to-date threat notices. • Technical Safeguards – The Company deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware software and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company performs an annual penetration test for identification of any vulnerabilities; in 2023, this test was performed by a third-party audit firm. • Incident Response and Recovery Planning – The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis, with the participation of executive officers and employees in our IT, legal and operations departments. • Third-Party Risk Management – The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. In 2023, the Company completed a comprehensive review of certain third-party providers that have access to the Company's data, such as banks, and SaaS vendors, and implemented a third-party risk management service which (i) allows for comprehensive vendor assessments with risk scoring, (ii) informs risk decisions with increased visibility and cybersecurity ratings, (iii) continuously monitors for vendor breaches and other significant events via various data feeds, and (iv) allows for collaboration with vendors to assess and remediate risk. • Education and Awareness – The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. In addition to our annual required training, the Company promotes awareness through regular phishing simulations and educational opportunities, including an FBI-led training in 2023.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability management, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity and risk assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board of Directors oversees the Company's ERM program, including the management of risks arising from cybersecurity threats. On an annual basis, the Board of Directors discusses the Company's approach to cybersecurity risk management with the CIO. The Board of Directors also receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The CIO, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board of Directors when appropriate. The CIO is supported by, among others, a Cybersecurity Architect who is a Certified Information Systems Security Professional (CISSP) and an Application Director who is Certified in Risk and Information Systems Control.


text: Angelina C. Day has served as the Company's Vice President and CIO since July 2022. In this role, she is responsible for all aspects of information technology, including cybersecurity. Prior to joining the Company, Ms. Day was IT Director at EP Energy Corporation, an independent E&P company, from May 2012 until March 2022, where she oversaw the information technology and security functions. Prior to EP Energy, Ms. Day held various roles with increasing responsibility in technology and leadership at El Paso Corporation. Ms. Day has over 20 years of energy, technology and risk management experience. She is also a member of the Houston CIO Community (Evanta) Governing Body, an organization that fosters collaboration and knowledge sharing across the Houston CIO community. Ms. Day holds a B.B.A. in Computer Information Systems from the University of Houston Downtown.


text: Supporting our CIO in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams and reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the board is responsible for evaluating certain risks and overseeing the management of those risks, the entire board is regularly informed through committee reports.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT will review the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2023, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is led by the Company's Director of Information Technology (the "Director of IT"), who reports to the Company's Chief Financial Officer. The Director of IT has a formal education in Computer Information Systems and is a Microsoft Certified Information Systems Professional with 28 years of experience. The Director of IT has comprehensive experience in cybersecurity controls, including intrusion detection, network security, operating systems, incident response and a track record of identifying cyber risks and implementing countermeasures to mitigate cyber attacks.


text: The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of mandatory training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams. The CIRT reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the Board is responsible for evaluating certain risks and overseeing the management of those risks, the entire Board is regularly informed through committee reports.


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. In addition, the Company reviews controls implemented by its third-party service providers to ensure that the providers' controls have been designed to effectively mitigate cybersecurity risks that could affect the Company's systems. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT reviews the findings of these evaluations and will determine the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2024, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Information security and protection of our data is important to Wesco, our customers and suppliers. We take a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: The implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against today's cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, Wesco has a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the close out of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape evolves and the relation between the organization changes. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third parties and in 2022, we achieved ISO 27001 certification for our ISMS. We conduct mandatory information security awareness training for our employees at least annually and enhanced training for specialized personnel. We have instituted regular attack or malicious activity simulations for employees to enhance awareness and responsiveness to such possible threats, and we also employ third parties to perform penetration and vulnerability tests.


text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage. While we did not experience any material data breaches in 2023 and no risks from cybersecurity threats have materially impacted or are reasonably likely to materially impact the Company's business strategy, operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. The CISO, with over 30 years of technology experience, has been in this role with Wesco since 2020, has a total of eight years of experience serving in the role of Chief Information Security Officer, and has twelve years of experience dedicated to cybersecurity. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets at least quarterly with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.


text: Information security and protection of our data is important to Wesco, our customers and suppliers. As a global company, we face various cybersecurity threats, ranging from phishing, ransomware and denial-of-service attacks to more recent threats incorporating the use of artificial intelligence. Our suppliers, third-party vendors, service providers, customers, and other business partners are also vulnerable to similar cybersecurity risks. In response to this evolving cybersecurity threat landscape, we have implemented a cybersecurity risk management program that follows a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss, guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time. Our implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against continually evolving cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, we identify, assess and manage risks associated with our use of third-party service providers and other business partners and we maintain a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the conclusion of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape and the relationship evolve.


text: We engage third-party experts, including auditors, consultants and advisors, to evaluate and enhance our cybersecurity program through security certifications, assessments and testing. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third-party auditors. We have received ISO 27001 certification for our ISMS and we undergo annual audits by an independent accreditation body to maintain this certification. We also engage third-party consultants to perform penetration and vulnerability tests at least once per quarter, as well as annual "red team" engagements that simulate cyber threats. The results of these tests and assessments are used to establish priorities, allocate resources, and improve controls. We conduct mandatory information security awareness training for all new hires and employees at least annually as well as specialized training for certain functions, such as developers, platform administrators and finance personnel. We have instituted regular phishing, social engineering and other malicious attack simulations, generally at least once per quarter, to enhance our employees' awareness and responsiveness to such possible threats. We run several awareness campaigns each year covering a variety of topical cybersecurity subjects and we maintain an internal website that is accessible to all employees that has security policies, additional trainings, and current news events. Our security policies and trainings are regularly evaluated and updated to adapt to changing regulations and emerging cybersecurity risks. Our training program also includes expert guest speakers and additional training during cybersecurity awareness month each October.


text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. We review the overall incident response plan at least annually or as needed to determine what updates (if any) are necessary. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage.


text: Through our enterprise risk management ("ERM") program, we identify, assess and manage a broad range of risks across the organization. Through the ERM process, cybersecurity has been identified as an important risk facing our business. Accordingly, our cybersecurity risk management program is integrated into our overall ERM program and information about cybersecurity risks and our cybersecurity risk management program is reviewed as part of our ERM program.


text: As of the date of this report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted us, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience such an event moving forward and if realized, that we, or our business strategy, results of operations, or financial condition, would not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. Our CISO has over 30 years of technology experience, including over twelve years of experience dedicated to cybersecurity. He has been in this role with Wesco since 2020 and has a total of approximately nine years of experience serving in the role of Chief Information Security Officer. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets periodically with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, third-party risk assessment outcomes, cybersecurity risk metrics, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and employee and other personal data ("Information Systems and Data").

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The Company's information security team, led by our Chief Information Security Officer ("CISO"), helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, employee training, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the CISO works with management, including the Chief Information Officer ("CIO"), to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, threat intelligence service providers, penetration testing providers, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures of the Company's or the third parties' on which we rely information systems, data and networks may disrupt our businesses, damage our reputation, expose us to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on our results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and CISO. Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing certain security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CISO and CIO. Our CISO, CIO and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: The Audit & Risk Committee receives regular reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company's information security team helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team lead by our Executive Vice President, Technology works with management and the legal department, to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Vice President, Technology and our General Counsel. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Executive Vice President, Technology and our General Counsel and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our cybersecurity incident response team has over 32 years combined information technology and cybersecurity experience, and includes individuals with Certified Information Systems Security Professional (CISSP), Cyber Threat Intelligence Certification, Global Information Assurance Certifications, and other key information technology and cybersecurity certifications. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: Our cybersecurity risk assessment and management processes provide for regular updates to the Audit & Risk Committee. The Audit & Risk Committee receives reports from our Executive Vice President, Technology and our General Counsel concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Although we have not been the subject of any cybersecurity threats that have materially affected, or are reasonably likely to materially affect us to date, we have been and continue to be subject to cybersecurity risks in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company's broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents.

companyName: REDWOOD TRUST INC

ticker: RWT


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, operations, and our Company's overall IT environment; • A team of IT professionals principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) together with our legal/compliance team, our response to cybersecurity incidents; • Use of third-party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, without limitation, periodic penetration testing, network vulnerability and web application scanning, and system monitoring via System Information and Event Management ("SIEM") or other monitoring tools; • Employee and contractor trainings on information security awareness, data privacy awareness, and phishing/social engineering mitigation, as well as periodic tabletop exercises involving IT professionals and executive management to review roles and responsibilities and walk through practical aspects of responding to cybersecurity incidents; • A cybersecurity incident response plan that sets forth guidelines, policies and procedures for identification, escalation, containment, investigation, remediation, recovery, notification, legal compliance and related processes and actions in response to a cybersecurity incident; and • A risk management process for third-party service providers, suppliers, and vendors, which includes criteria for risk-based categorization of these third parties and policies and procedures relating to assessing their cybersecurity practices prior to engagement and periodic monitoring during the course of engagement.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") – i.e., we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but our use of the NIST CSF as a guide does not mean that we meet the particular technical standards, specifications, or requirements of all of the NIST CSF.


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results."


text: As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management's administration of our cybersecurity risk management program. For example, officers within our IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, our cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to our Board members from time to time as part of the Board's and Audit Committee's continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.


text: Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals ("CISSP") and Certified Information Systems Auditors ("CISA"). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.


text: Members of our senior management team supervise our IT function and its efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents. In addition to day-to-day management, our senior management team's supervision of these efforts includes receiving and responding to briefings from IT personnel, updates on cyberthreat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and notification of significant alerts and reports produced by third parties and security tools deployed in our IT environment.


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results " in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the Bitcoin Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.


text: VanEck has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually. Using the NIST framework as a guide, VanEck's cybersecurity program is organized around the following program domains: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect


text: Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program incidents regardless of source or causality through planning, improvements and communications (external and internal)


text: Conduct after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.


text: VanEck maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact VanEck's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within VanEck's NIST framework, and risk identification and mitigation are supported by VanEck's cybersecurity program. VanEck also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees. Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response.


text: In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Other Risks—Due to the increased use of technologies, intentional and unintentional cyber-attacks pose operational and information security risks."


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these systems through a cyber-attack or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption. Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.


text: Our commitment to the overall security of our information technology systems starts at the highest levels of our Company, the Board of Directors and management. Management and the Board of Directors provide oversight surrounding cybersecurity. Management oversees internal controls and the company-wide risk assessment process. The Audit Committee is provided with regular updates by management regarding the control framework and whether any significant deficiencies or material weaknesses exist in the IT control environment. The Audit Committee is also tasked with determining the appropriate response to any submissions through the corporate whistleblower policy. The whistleblower policy includes the opportunity for employees of the Company to notify the Audit Committee confidentially and anonymously of any concerns regarding cybersecurity, in addition to any accounting, internal accounting controls or auditing matters. The audit committee will report any significant matters to the Board of Directors.


text: As of January 31, 2024, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: The Company has processes in place to identify, assess, and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented Lord Abbett's information security policy that applies to the Company and its operations.

companyName: Lord Abbett Private Credit Fund


text: With respect to cybersecurity, the Company and the Adviser rely on the systems of Lord Abbett, its third-party service providers, and the Company's service providers.


text: Lord Abbett's cybersecurity risk management processes are integrated into its overall enterprise risk management processes. Lord Abbett has established an Enterprise Risk Management Function, overseen by its Chief Legal Officer. The Chief Legal Officer relies on Lord Abbett's Chief Information Security Officer (" CISO "), who is responsible for implementing the Information/Cybersecurity Program. The CISO is assisted by a team of Information Security professionals, the Information Technology department, and digital leads with the support of Lord Abbett's Information Security Council and its Standards and Practices Committee.


text: Employees receive information security training annually on policies and procedures, recent cyber-attacks, the firm's defense-in-depth controls strategy, incident response reporting, and cybersecurity at home. Lord Abbett conducts e-mail phishing campaigns using a variety of templates geared around topical or seasonal themes to simulate phishing messages and reinforce training.


text: Lord Abbett has instituted an Information/Cybersecurity Program, based on the National Institute of Standards & Technology (NIST) Cybersecurity Framework of controls that is designed to identify, assess, and manage cyber risks applicable to the Company. The Information/Cybersecurity Program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. Lord Abbett actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser and Lord Abbett to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and enterprise risk management processes, including those applicable to the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of enterprise risk management, legal, information technology, and compliance personnel of the Adviser and Lord Abbett, including the CISO, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: The Board provides oversight for the Information/Cybersecurity Program and related matters, including risks associated with cybersecurity threats. The Board receives periodic updates from Lord Abbett's CISO regarding the overall state of the Adviser's security program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.