text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview of our cybersecurity threat risk management and strategy processes from our CISO. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, and material short-, medium- and long-term risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. In addition, these sessions include a review of the broader threat landscape and how our business may be affected. Cybersecurity threats are also considered during meetings of our board of directors through discussions of enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management and other relevant matters.


text: Our cybersecurity risk management and strategy processes are led by our CISO and the Cyber Risk Committee. Our CISO has over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and controls, as well as relevant certifications, including Certified Industry Systems Security Professional. Our CISO has worked in highly regulated environments for over 20 years and has built strong relations with cybersecurity authorities including the Federal Bureau of Investigation, the Department of Homeland Security, and the Cybersecurity and Infrastructure Security Agency to aid with investigative and intelligence objectives. The Cyber team has an average of over 10 years of cyber-related experience with several senior team members each having over 20 years of cyber experience. Several were also a Chief Information Security Officer or Head of Cybersecurity for their respective former organizations. Other key members of the Cyber team each have over 20 years of relevant experience in Compliance, Audit, Legal, and Data Privacy.

companyName: Warner Music Group Corp.

ticker: WMG

secItem: Item 1C


text: Cyber team members participate in industry forums to collaborate and keep current on emerging risks and new technologies. We also strive to maintain key relationships with relevant government agencies for the purpose of collaborating on matters of cybersecurity.


text: Through the cybersecurity risk management and strategy processes described above, Cyber Risk Committee members remain informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. Members participate in the management and operation of our Incident Response Plan, have oversight of our internal information technology departments that report to Cyber Risk Committee meetings, and oversee the implementation, review and revision of the policies underlying our cybersecurity program. Cyber-related incidents, including non-material incidents, typically have a post-mortem exercise completed to review lessons learned and adjust any policies and processes as needed.


text: We have developed an information security program that is designed to address material risks from cybersecurity threats. Our information security program is integrated into our overall enterprise risk management process, which the Board ultimately oversees. The Board has delegated its responsibility for cybersecurity risk oversight to the Technology Committee of the Board, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and our policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board on such matters. As described in further detail below, our information security program is led by our Director of IT Security & Compliance ("DITSC"), who is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The program includes policies and procedures that guide our implementation and maintenance of security measures and controls. Risk-based analysis and judgment of the DITSC and our management team, along with feedback from internal and third-party audits and assessments, are used to select security controls to address risks. The following factors, among others, are considered when identifying security controls: likelihood and severity of a risk, impact on the Company and others if a risk materializes, feasibility of controls, and impact of controls on operations and others. Third parties also play a role in our cybersecurity, as we engage security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address and oversee cybersecurity threats related to the use of third-party technology and services, including a vendor risk management program.

companyName: Designer Brands Inc.

ticker: DBI


text: We have a written incident response plan and conduct tabletop exercises to enhance incident response preparedness. We have other response protocols to address operating impacts due to disruptions in services and technology, including scenario run books and mitigation plans for key vendors. Employees undergo security awareness training when hired and annually.


text: The DITSC is the Company's management position with primary responsibility for the development, operation, and maintenance of our information security program. The DITSC has over 20 years of experience in cybersecurity, including over 15 years of experience in the Cyber Defense and Electronic Warfare section of the U.S. Army. The DITSC has obtained multiple subject matter certifications, including the Global Information Assurance Certification. The DITSC briefs the Technology Committee of the Board regularly and oversees regular cybersecurity training and education opportunities for the Board, which covers topics ranging from the current threat landscape to our cybersecurity program metrics, risks, and roadmap. Management receives regular updates on cybersecurity risks from the DITSC. In the event of a security incident, the DITSC will follow the escalation process in our incident response plan to notify the Company's Crisis Committee, which is composed of a cross-functional group of Company leaders. The Crisis Committee will work with the DITSC to respond to and remediate any actual cybersecurity incidents. Depending on the severity of the security incident, the DITSC and the Crisis Committee are to escalate the security incident to the Chief Legal Officer and the Principal Accounting Officer, who will assess materiality in consultation with outside counsel. The Chief Legal Officer will notify the Technology Committee and the Board of any potential material incident.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. We may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. Risk factors for a discussion of cybersecurity risks.


text: We have developed an information security program that is designed to address material risks from cybersecurity threats. Our information security program is integrated into our overall enterprise risk management process, which the Board ultimately oversees. The Board has delegated its responsibility for cybersecurity risk oversight to the Technology Committee of the Board, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, artificial intelligence, and IT risks or exposures, and our policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board on such matters. As described in further detail below, our information security program is led by our Director of IT Security & Compliance ("DITSC"), who is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The program includes policies and procedures that guide our implementation and maintenance of security measures and controls. Risk-based analysis and judgment of the DITSC and our management team, along with feedback from internal and third-party audits and assessments, are used to select security controls to address risks. The following factors, among others, are considered when identifying security controls: likelihood and severity of a risk, impact on the Company and others if a risk materializes, feasibility of controls, and impact of controls on operations and others. Third parties also play a role in our cybersecurity, as we engage security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address and oversee cybersecurity threats related to the use of third-party technology and services, including a vendor risk management program.


text: The DITSC is the Company's management position with primary responsibility for the development, operation, and maintenance of our information security program. The DITSC offers over 20 years in cybersecurity expertise, cultivated through service in the United States Air Force and subsequent roles in both public and private sectors across diverse industries. The DITSC has obtained multiple industry specific certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. The DITSC briefs the Technology Committee of the Board regularly and oversees regular cybersecurity training and education opportunities for the Board, which covers topics ranging from the current threat landscape to our cybersecurity program metrics, risks, and roadmap. Management receives regular updates on cybersecurity risks from the DITSC. In the event of a security incident, the DITSC will follow the escalation process in our incident response plan to notify the Company's Crisis Committee, which is composed of a cross-functional group of Company leaders. The Crisis Committee will work with the DITSC to respond to and remediate any actual cybersecurity incidents. Depending on the severity of the security incident, the DITSC and the Crisis Committee are to escalate the security incident to the Company's General Counsel and the Principal Accounting Officer, who will assess materiality in consultation with outside counsel. The General Counsel will notify the Technology Committee and the Board of any potential material incident.


text: As of the date of this report, the Company has not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or third parties on which it relies, will not experience a cybersecurity threat or incident in the future, and we continue to closely monitor cyber risk. We may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. Risk factors for a discussion of cybersecurity risks.


text: One of our organization's top priorities is protecting Cooper Standard's digital assets, and we increasingly rely on data and digital transactions to operate efficiently and effectively. We take action to prevent potential impacts related to system outages, data breaches, cyber-attacks and other threats to avoid disruption to our daily operations. Cooper Standard prioritizes increasing efficiency and efficacy as we design and refresh prescriptive incident response procedures to minimize impacts of potential cyber-attacks or outages. From time to time, the Company engages in table-top exercises, which involve cross-functional business leaders. Our information technology ("IT") professionals focus on improving existing controls as outlined by ISO/IEC 27001:2022 (an internationally recognized information security framework), which is the foundation of our cybersecurity program. In recent years, we made advancements in this space by conducting a risk assessment carried out by an independent third-party and adding new cyber advisory services as described further below.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: We annually contract with a well-known third-party to conduct a comprehensive, enterprise-wide risk assessment. In addition to other mandates, this assessment evaluates Cooper Standard's cybersecurity program from a risk perspective and assesses our IT controls for alignment with the ISO/IEC 27001:2022 information security framework. Based on the assessment results, we refresh the roadmap for our cybersecurity program, focusing on the highest-risk vulnerabilities first and monitoring for significant changes and emerging risks, continuously adjusting the roadmap as needed.


text: Our cybersecurity program is built on a collection of fundamental security controls, focused on the overall protection of company and stakeholder data. Company leadership has defined the following objectives for information security: • Governance: Establish proper governance for the cybersecurity program. • Security Operations & Data Protection: Create a secure digital operating environment (apps, networks, systems, etc.) designed to protect critical data and to prevent business disruption. • Response and Recovery: Develop and practice incident response, business continuity and disaster recovery processes to minimize the impact of a major incident. • Compliance & Effectiveness: Meet all compliance requirements and develop program metrics to ensure effectiveness.


text: To achieve these objectives, we emphasize fundamental security measures, such as access controls, cyber hygiene (e.g., patching and malware protection) and employee awareness training.


text: Third-party risk management is an important focus of the Cooper Standard cybersecurity program. Cybersecurity is evaluated and considered throughout the lifecycle (onboarding, ongoing operations, offboarding) of third-party relationships as we conduct business with them. We review the security posture of each third-party prior to initiation of the relationship, and periodically throughout the relationship. We evaluate several aspects of information security, utilizing guidance from globally recognized frameworks (e.g., ISO 27000:2022). Critical service providers are also required to submit independently certified assurance of their security controls based on internationally recognized standards (e.g., ISEA 3402, SOC 1, SOC 2, etc.). Finally, upon relationship termination, we ensure each third party is properly offboarded, addressing critical cybersecurity concerns such as eliminating access and obtaining and/or deleting Company data.


text: Cooper Standard continuously works to update and strengthen our Incident Response ("IR") program, which defines response procedures and prescriptive controls designed to streamline response to incidents, when and if they occur. Our designated cross-functional Incident Response Team ("IRT") consists of leaders from human resources, global communications, legal, internal audit and information technology. Cooper Standard's IRT is dedicated to maintaining a culture of continuous improvement, taking into consideration lessons learned from table-top exercises and feedback from the third-party expert with whom we annually contract.


text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact the Company's business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks to the Company, see Part 1, Item 1A, Risk Factors, "A disruption in, or the inability to successfully implement upgrades to, our information technology systems, including disruptions relating to cybersecurity as well as data privacy concerns, could adversely affect our business and financial performance."


text: We align our cybersecurity and IT compliance programs to take advantage of natural synergies and our IT controls environment. Our Senior Vice President, Chief Information Technology Officer, who has more than 25 years of experience in technology and information security risk management in our industry and across a number of organizations, is responsible for overseeing the risks related to cybersecurity. Our cybersecurity team holds several cybersecurity industry certifications such as ISC2 CISSP, ISACA CISM and EC-Council CEH.


text: The Cooper Standard IT leadership team manages the global cybersecurity and IT compliance organization, and the Senior Vice President, Chief Information Technology Officer directly reports updates to the Audit Committee of the Board of Directors at least twice annually and the full Board of Directors at least annually. Further, our cybersecurity team periodically reports to our Global Leadership Team ("GLT"). Data privacy, cybersecurity and digitization is also managed as a material topic as a part of our Enterprise Risk Management ("ERM") Committee which ensures cybersecurity risks are integrated into our overall risk management. From an accountability perspective, our internal audit team independently assesses the cybersecurity program by evaluating the design and effectiveness of our controls. We have an Architecture Review Board ("ARB") which reviews new IT initiatives to ensure they align with our digital strategy. Similarly, our Project Management Office ("PMO") monitors those initiatives throughout implementation to ensure proper communication and seamless transition. The ARB and PMO processes include cybersecurity requirements designed to ensure this topic is considered from the beginning.


text: One of our top priorities is protecting Cooper Standard's digital assets, and we increasingly rely on data and digital transactions to operate efficiently and effectively. We take action to prevent potential impacts related to system outages, data breaches, cyber-attacks and other threats to avoid disruption to our daily operations. Cooper Standard prioritizes increasing efficiency and efficacy as we design and refresh prescriptive incident response procedures to minimize impacts of potential cyber-attacks or outages. From time to time, the Company engages in table-top exercises, which involve cross-functional business leaders. Our information technology ("IT") professionals focus on improving existing controls as outlined by ISO/IEC 27001:2022 (an internationally recognized information security framework), which is the foundation of our cybersecurity program. In recent years, we have made advancements in this space by conducting a risk assessment carried out by an independent third-party and continued engagement with cyber advisory services as described further below.


text: Third-party risk management is an important focus of the Cooper Standard cybersecurity program. Cybersecurity is evaluated and considered throughout the lifecycle (onboarding, ongoing operations, offboarding) of third-party relationships as we conduct business with them. We review the security posture of each third-party prior to initiation of the relationship, and periodically throughout the relationship. We evaluate several aspects of information security, utilizing guidance from globally recognized frameworks (e.g., ISO/IEC 27001:2022). In addition to these point-in-time reviews, we continuously monitor the security posture of critical third parties through a third-party service. Critical service providers are also required to submit independently certified assurance of their security controls based on internationally recognized standards (e.g., ISEA 3402, SOC 1, SOC 2, etc.). Finally, upon relationship termination, we ensure each third party is properly offboarded, addressing critical cybersecurity concerns such as eliminating access and obtaining and/or deleting Company data.


text: Our cybersecurity program and controls are designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader Enterprise Risk Management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Security team. The Company's Security Incident Management Process outlines the procedures the Company believes are necessary to prepare for, identify, contain, eradicate, and recover from a security incident, and is overseen by the Information Security team. We have also adopted a Cybersecurity Incident Response Plan to provide organizational and operational structure, processes, and procedures to Company personnel, so that team members can properly respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct regular information security awareness training for employees and provide related educational materials.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: We also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Our managed security service provider performs security reviews of select third party service providers that include such provider's system and organization controls or third party security assessments. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security posture, and engage reputable external specialists to provide independent assessments of our cybersecurity program and response preparedness. Further, the Company's enterprise level IT general controls are audited annually.


text: Impact of Cybersecurity Risks and Threats We are not aware of having experienced any risks from cybersecurity threats or incidents through the date of this Report that have materially affected the Company, its business strategy, results of operation or financial condition or are reasonably likely to have such an effect over the long term. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item A – Risk Factors, which should be read in conjunction with the foregoing information.


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Audit Committee receives quarterly updates from the Chief Information Officer ("CIO") on significant risks, cyber incidents, key performance indicators measuring the effectiveness of our cybersecurity risk program, and other relevant matters. The Audit Committee regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Audit Committee and the Board. In addition to the regular updates to the Audit Committee, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee.


text: Our CIO is responsible for our information security program and controls, which includes cybersecurity risk management. Our VP, Information Technology leads our cybersecurity program and Information Security team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats and executing our information security controls. The CIO and VP, Information Technology have extensive cybersecurity knowledge and skills gained from each having over 20 years of relevant experience. The CIO and VP, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from the Information Security team and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.


text: Our cybersecurity program and controls are designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risk is incorporated into the Company's broader Enterprise Risk Management program, and is managed in alignment with our business objectives and operational needs.


text: Our information systems are continuously monitored for security threats and anomalies, and our incident response plan and processes are built to enable us to identify, contain, eradicate, and recover from security incidents in a coordinated fashion, helping maintain the function and security of our IT assets, information resources, and business operations. We have formed relationships with various third-party experts and advisors to provide support in the event of a cybersecurity incident. Additionally, we have established various elements of risk management to mitigate costs associated with cybersecurity incidents.


text: We strive to maintain a strong culture of cybersecurity awareness across the organization by conducting regular information security awareness training, and simulation exercises, for employees, and providing access to related educational materials.


text: We oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers, perform third party security assessments of select third party service providers, and employ techniques to protect our organization in the event our third parties experience a cybersecurity incident.


text: We employ controls to continuously monitor and assess the information gathered by our security tools, services to identify gaps, exposures, or weaknesses in our overall security posture, and engage reputable external specialists to provide independent assessments of our cybersecurity program, and response preparedness. Further, the Company's enterprise level IT general controls are audited annually.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A – Risk Factors, which should be read in conjunction with the foregoing information.


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee.


text: Our Audit Committee receives quarterly updates from the Chief Information Officer ("CIO") on significant risks, cyber incidents, key performance indicators measuring the effectiveness of our cybersecurity risk program, and other relevant matters, and regularly reviews the measures implemented by the Company to identify, treat, mitigate, and transfer cybersecurity risk. The Audit Committee regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk through our broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Audit Committee and the Board. In addition to the regular updates to the Audit Committee, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee.


text: Our CIO is responsible for our information security program and controls, which includes cybersecurity risk management. Our Head of Cybersecurity reports to our CIO, and leads our cybersecurity program and team that assesses, manages and monitors cybersecurity risks, associated risks of emerging technologies, and the corresponding controls. The CIO and Head of Cybersecurity have extensive cybersecurity knowledge and expertise, skills gained from each having over 20 years of relevant industry experience.


text: We maintain a security organization that is responsible for overseeing security practices across the Company, including with respect to information, personnel, and facilities. Our information security team maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity and other information security threats, including as may be related to our third party vendors and suppliers.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: Our Chief Information Security Officer leads our information security team and works with Palantir's other departments in areas such as facilities, physical security, operations, data protection, information technology, product development, finance, legal and compliance, where necessary in assessing and reviewing risks and identifying actions to be taken. As part of our overall approach to risk management, we monitor and evaluate the sufficiency of our policies, processes and controls, including with respect to cybersecurity risks and process.


text: Regular assessments and reviews, both internal and independent, are conducted on Palantir information assets and networks, including systems, devices, applications, and related computing resources, to evaluate potential risks and vulnerabilities, identify actions to be taken, and evaluate the effectiveness of our cybersecurity program and controls. Risk management exercises occur regularly, and in response to changes in Company operations, risk landscape, and threat actor activities using threat modeling, risk forecasting, and other techniques to identify where investments in security should be made. Internal assessments occur based on results from risk management exercises, changes in infrastructure, cybersecurity risks, threat actor activity, and in response to other internal or external events. External assessments are conducted by independent assessors, consultants, or auditors, as relevant, and occur regularly in order to maintain our certifications and accreditations with certain compliance regimes (for example, FedRAMP).


text: We also provide employees with policies and training in areas such as ethics, corruption, information security, social engineering, data protection, and compliance, and with regular updates on the cybersecurity program and potential threats.


text: Additionally, Palantir utilizes third-party software, services, and providers in our cybersecurity program in furtherance of our security processes such as endpoint security, threat intelligence, cloud security, and authentication services. The third-party vendors we engage with are generally required to implement industry standard technical, administrative, cybersecurity, and physical measures designed to protect the security and confidentiality of Palantir information (including customer information). Additionally, such providers undergo review, dependent on the software and services they are expected to provide, as part of our vendor onboarding process and may be subject to additional review upon certain critical events, or in connection with contract renewals. Third-party providers must notify Palantir promptly of relevant security incidents.


text: We face a number of cybersecurity risks in connection with our business. To date, our business strategy, results of operations, and financial condition have not been materially affected by cybersecurity incidents. For additional information, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the risk factors under the section entitled "Risks Related to Intellectual Property, Information Technology, Data Privacy, and Security".


text: Risk is inherent with every business, and we face a number of risks, including strategic, financial, business and operational, legal and compliance, and reputational. We have designed and implemented processes to manage risk in our operations. Management is responsible for the day-to-day management of risks we face, while our Board of Directors, as a whole and assisted by its committees, has responsibility for the oversight of risk management. Our Board of Directors administers its cybersecurity risk oversight function directly and may choose to administer this function through its committees as well.


text: Our Chief Information Security Officer oversees our cybersecurity program, policies and processes, including those described in "Risk Management and Strategy" above, and works with the information security team and other stakeholders on the prevention, detection, mitigation, response and remediation of cybersecurity incidents, as applicable. As our information security team monitors the security and effectiveness of our policies and processes, they also work to keep the Chief Information Security Officer and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Our Chief Information Security Officer in turn provides periodic briefings to our Board of Directors regarding our company's cybersecurity risks and activities, which would include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to the cybersecurity program. Our Chief Information Security Officer has over 15 years of direct, technical cybersecurity experience in the commercial and government sectors, and holds an undergraduate degree in infrastructure assurance and a graduate degree in information security engineering, as well as certifications in information security. The information security team includes employees with broad ranging experience in cybersecurity threat assessments and detection, incident response, and mitigation and management of various types of threats, including from insiders and nation-state actors.


text: Our Chief Information Security Officer oversees our cybersecurity program, policies and processes, including those described in "Risk Management and Strategy" above, and works with the information security team and other stakeholders on the prevention, detection, mitigation, response and remediation of cybersecurity incidents, as applicable. As our information security team monitors the security and effectiveness of our policies and processes, they also work to keep the Chief Information Security Officer and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Our Chief Information Security Officer in turn provides periodic briefings to our Board of Directors regarding our company's cybersecurity risks and activities, which would include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to the cybersecurity program. Our current Chief Information Security Officer has over 15 years of systems engineering and technical cybersecurity experience, and holds an undergraduate degree in computer science and a graduate degree in business administration. He has also completed graduate-level courses in computer science, and holds certifications in information security. The information security team includes employees with broad ranging experience in cybersecurity threat assessments and detection, incident response, and mitigation and management of various types of threats, including from insiders and nation-state actors.


text: The Company's cybersecurity program focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and is integrated in the Company's overall risk management strategy and framework. The Company has implemented protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with the Company's overall business and operational goals and strategies. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. In 2023, the Company initiated efforts to streamline existing processes, enhance technological capabilities, and improve user experience and security.

companyName: Penumbra Inc

ticker: PEN


text: The Company employs strategic partnerships with third-party entities to leverage resources and technologies for operational support, optimization, and heightened security. Collaboration with third parties forms a critical part of the Company's risk management strategy, facilitating effective management and mitigation of risks through partnerships, and ensuring adherence to applicable regulatory and industry standards. The Company incorporates supplier qualification processes and conducts thorough security and privacy risk assessments for third parties and lifecycle management.


text: Overall, the Company believes it has established a robust framework for confidentiality, integrity, and availability of information, adhering to relevant security standards, practices, and compliance requirements. In addition, the Company maintains insurance to help protect against risks associated with cybersecurity threats. The Company does not believe that any risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business and operating results." in this Form 10-K.


text: The Company's cybersecurity program is managed by its Chief Information Officer ("CIO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The CIO, who has extensive experience in overseeing and managing information technology and security programs, is kept appraised of potential cybersecurity incidents, including the prevention, detection, mitigation and remediation thereof, through the work of the Company's information technology team, which conducts and oversees ongoing security reviews of critical systems and continuous monitoring of event data. The CIO provides periodic reports to the Company's Board of Directors, as well as its Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate. These reports include updates on cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, ongoing compliance with applicable legal and regulatory frameworks and industry standards, assessments of the Company's information security program, and the emerging threat landscape. The Company's Board of Directors provides oversight of the Company's cybersecurity program and helps guide the Company's strategy for managing cybersecurity risks in the context of the Company's overall risk management system.


text: The Company's cybersecurity program focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and is integrated in the Company's overall risk management strategy and framework. The Company has implemented cyber defense capabilities and protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with the Company's overall business and operational goals and strategies. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.


text: Our Adviser and our Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator before implementation.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations and we may not be able to determine the likelihood of such risks. See "Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly, and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.


text: Our Adviser and Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT") and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists our Adviser and Administrator in monitoring our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT and Chief Compliance Officer ("CCO"), which then are considered by other relevant officers of our Adviser and Administrator before implementation.


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the Director of IT, our Adviser and Administrator and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.


text: We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through robust risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.

companyName: AtriCure, Inc.

ticker: ATRC


text: We have continued to expand investments in information security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting mechanisms, and engaging experts. Information security awareness trainings are a compliance requirement for employees. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts.


text: Our data breach response plan designates an incident response team comprised of senior leaders within information technology, finance, legal and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including, but not limited to: the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework and subscribed to the principles of Zero Trust. Both models represent recognized best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and challenges. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business.


text: We also work with trusted and recognized third parties to help us assess, strengthen and monitor the operations of our information security program. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with information sharing and analysis centers and cybersecurity associations.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which, evaluates and assesses top risks to the enterprise on a periodic basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's risk assessment is presented to the Board of Directors. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with the use of third-party software and service providers. Such providers are subject to security risk assessments at time of onboarding, contract renewal and upon detection of an increase in risk profile. On an annual basis we review System and Organization Controls (SOC) 1 or SOC 2 reports for third-party service providers deemed significant to our environment.


text: Despite the Company's security measures and programs, our information technology and infrastructure are vulnerable to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, financial results, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.


text: Our Board of Directors is responsible for the oversight of cybersecurity risks and threats. The Board has delegated certain information security and data privacy oversight to the Audit Committee and the Compliance, Quality and Risk Committee (CQRC) of the Board. The CQRC oversees compliance with information security and data privacy laws, while the Audit Committee has oversight responsibility for cybersecurity risks related to accounting, audit and financial matters. The CQRC, Audit Committee and management report to the Board on a periodic basis regarding our information security and data privacy functions, including any cybersecurity threats.


text: The CQRC is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the CQRC on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed. Our enterprise risk management team reports address the Company's cybersecurity risk management processes. Our Chief Legal Officer oversees the management of our ERM program and has over a decade of experience in risk management. The Chair of the CQRC is an expert in enterprise risk assessment and mitigation and holds a CERT Certificate in Cybersecurity Oversight.


text: The Audit Committee is responsible for reviewing our disclosures on cybersecurity risk management, strategy and governance in our Annual Report on Form 10-K. The Audit Committee assists in determining materiality for timely reporting of cybersecurity incidents and is notified immediately if the incident response team has assessed that a material event may have occurred that may require filing an SEC Current Report on Form 8-K.


text: The Vice President of Information Technology, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Our Vice President of IT has served in various roles in information technology and information security for over 20 years. Our information security team has an aggregate of more than 60 years of experience in information technology roles across several industries.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which evaluates and assesses top risks to the enterprise on a periodic basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's risk assessment is presented to the Board of Directors. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with the use of third-party software and service providers. Such providers are subject to security risk assessments at time of onboarding, contract renewal and upon detection of an increase in risk profile. On an annual basis we review System and Organization Controls (SOC) 1 or SOC 2 reports for third-party service providers deemed significant to our environment.


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program. The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect us and the achievement of our objectives; to understand, assess, and prioritize those risks; and to facilitate the implementation of risk management strategies and processes across the company that are responsive to the company's risk profile, business strategies, and specific material risk exposures. The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is transmitted to senior executives and, as appropriate, to the Board of Directors (Board) or relevant committees. The Board regularly reviews and discusses with the key members of management responsible for management of risk the guidelines and policies governing the ERM process, the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, and the risk mitigation strategies in each instance.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: The Audit Committee of the Board provides oversight in connection with management's cybersecurity efforts. The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to cybersecurity. The Audit Committee also receives regular reports on the efficacy of our cybersecurity risks and related policies and procedures from our chief information officer and other members of senior management who are tasked with monitoring cybersecurity risks. Our chief information officer oversees a dedicated team of certified cybersecurity professionals, with an average of over 12 years of relevant experience.


text: Our cybersecurity strategy prioritizes protection, detection, analysis, and response to known, anticipated or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents. We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S. government to promote the protection of our infrastructure from cybersecurity risks. We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has five functions: identify, protect, detect, respond and recover. We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks through a zero-trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices: • Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program. We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, adopting a zero-trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities. Our proactive approach involves regular testing of defenses through simulations and penetration tests, both technically and through a comprehensive review of operational policies and procedures. At the managerial level, our cybersecurity team consistently monitors alerts and holds regular meetings to discuss threat levels, trends, and remediation strategies. Additionally, we conduct periodic external penetration tests and maturity testing to assess the effectiveness of our security controls, including processes, procedures, and our readiness to face the evolving threat landscape. • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers under our third-party risk management program. Pursuant to the program, we evaluate security and data privacy controls prior to sharing or authorizing the hosting of sensitive data in computing environments managed by third parties. In addition, our standard terms and conditions with third-party service providers feature contractual provisions mandating specific security protections. • Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems. The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response. • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We cannot, however, eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the disclosure in Item 1A. Risk Factors under "Operational Risks—We are subject to risks relating to our information technology systems, and any technology disruption or cybersecurity incident could negatively affect our operations."


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program. The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect achievement of our business, operations and strategic objectives and to understand, assess, and prioritize those risks. The ERM program also intends to facilitate the implementation of risk management strategies and risk mitigation processes across the Company that are responsive to the Company's risk profile, overall business strategies, and specific material risk exposures. The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the Company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is appropriately communicated to senior executives and the Board of Directors (Board) or relevant committees. The Board regularly reviews and discusses with members of management responsible for risk management the guidelines and policies governing the ERM process. This includes the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, in addition to the risk mitigation strategies in each instance.


text: The Audit Committee of the Board oversees management's cybersecurity risk management efforts. Our chief information officer oversees information technology, cybersecurity risk and efforts to prevent and mitigate such risks. The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, summaries of training activities and certification achievements, assessments of cybersecurity program effectiveness and reports on other cybersecurity priorities and initiatives. This is in addition to management's periodic updates on cybersecurity incidents involving the Company or other industry and global participants. The Audit Committee also receives regular updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks. Our chief information officer has over 10 years of experience overseeing cybersecurity teams at both the Company and two other public companies. Our chief information officer is supported by a dedicated team of certified cybersecurity professionals, with an average of over 13 years of relevant experience.


text: Our cybersecurity strategy prioritizes governance, protection, detection, analysis, and response to known, anticipated, or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents. We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S. government to promote the protection of our infrastructure from cybersecurity risks. We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has six functions: govern, identify, protect, detect, respond and recover. We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks that through a zero trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices: • Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program. We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, adopting a zero trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities. Our proactive approach involves regular testing of defenses through simulations and penetration tests, both technically and through a comprehensive review of operational policies and procedures. At the managerial level, our cybersecurity team consistently monitors alerts and holds regular meetings to discuss threat levels, trends, and remediation strategies. Additionally, we conduct periodic external penetration tests and maturity testing to assess the effectiveness of our security controls, including processes, procedures, and our readiness to face the evolving threat landscape. • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers, including cybersecurity vendors, consultants, and auditors, under our third-party risk management program. Pursuant to the program, we evaluate security and data privacy controls prior to sharing or authorizing the hosting of sensitive data in computing environments managed by third parties. In addition, our standard terms and conditions with third-party service providers feature contractual provisions mandating specific security protections. • Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems. The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response, and as appropriate, escalation to the Audit Committee or the Board. CF INDUSTRIES HOLDINGS, INC.


text: • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We cannot, however, eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the disclosure in Item 1A. Risk Factors under "Operational Risks—Failure, inadequacy, breach of, or unauthorized access to, our information technology systems or those of third-party service providers or customers could negatively affect our business and operations."


text: Information security risk includes the risk that cyber incidents and threats could result in a failure or interruption of our business operations. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. We have implemented processes to identify, assess, and manage material risks from cybersecurity incidents or threats that may directly or indirectly impact our business strategy, results of operations, or financial condition. Please refer to " Item 1A. Risk Factors " for additional information on our operational risk, which includes the risk of failures or interruptions in information systems resulting from cybersecurity threats or incidents.

companyName: Federal Home Loan Bank of Des Moines


text: Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats and to protect the confidentiality, integrity, and availability of our IT assets and data. We utilize a widely adopted industry framework to guide and benchmark the activities of our information security program in alignment with our risk appetite statement. Our cybersecurity program includes specific controls and processes for the monitoring, mitigation, and reporting associated with cybersecurity risks. For example, administrative, physical, and logical controls are in place for identifying, monitoring, and controlling system access, sensitive data, and system changes. In addition, we employ an information security training program that includes security training lessons and phishing exercises for all employees as well as mandatory staff training on cyber risks. We also regularly engage with third-parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, detection and response services, cybersecurity tabletops, and cybersecurity framework assessments. We also maintain cyber insurance coverage in an effort to reduce financial losses stemming from a security incident.


text: To ensure the continuance of our operations in the event of a cybersecurity incident or threat, we have established an Information Security Policy and Security Incident Response Plan, and have adopted a business continuity management program.


text: Our Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations, the Gramm-Leach-Bliley Act and the interagency guidelines issued thereunder, and applicable laws.


text: Our Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to senior management and the Board of Directors. The Security Incident Response Plan requires management to assess materiality of the threat or incident for purposes of public disclosure.


text: Our Security Incident Response Plan includes third-party cybersecurity incidents and threats, as we do rely on third-party information systems and other technologies. As part of our vendor risk management process, we undertake due diligence of third-party systems with whom we interact, including risk profiling and classification, in addition to requiring data protection covenants in our vendor agreements. Our vendor risk management program includes regular reviews and oversight of service providers, including performance and technology reviews, and escalation of any unsatisfactory reviews.


text: Our business continuity management program is designed to ensure that necessary resources are in place to protect us from potential loss during a disruption, which includes the unavailability of IT assets due to unintentional events like fire, power loss, and other technical incidents, such as hardware failures.


text: During the period covered by this report, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, did not have a material impact on our business strategy, results of operations, or financial condition. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We are prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data they or their customers have entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Our Information Security Department is led by the CIO, who reports to the President and CEO. Our CIO establishes our strategic direction and provides executive support for our information security program, and has significant experience in information systems and information security. Refer to " Item 10. Directors, Executive Officers and Corporate Governance " for more information.


text: Our dedicated Information Security Department is comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk, including the processes and procedures to mitigate and implement protective, proactive, and reactive measures to protect us against this risk. Personnel in this department hold a variety of technical certifications relevant to their job functions and engage in continuing education. This department is also responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our IT assets and data under our control.


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific, technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well risk assessment, management, and monitoring updates, as applicable or needed.


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy, as well as other standards, guidelines, and procedures for IT and information security. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and engages in detailed risk assessments.


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular, and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well as risk assessment, management, and monitoring updates, as applicable or needed.


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and reviews detailed risk assessments.


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents, and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.


text: FHLBank is subject to cybersecurity incident and threat risk. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by FHLBank, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. Please refer to Item 1A – "Risk Factors" for a description of cybersecurity incident and threat risk. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition.

companyName: Federal Home Loan Bank of Topeka


text: Our cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the information technology assets and data under our control.


text: Cybersecurity risk management is part of our Enterprise Risk Management (ERM) Program, which includes specific controls and processes for mitigation, monitoring and reporting associated with those risks. Those controls and processes include the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The Risk Oversight committee of the board of directors oversees and annually reviews and recommends for approval and the full board of directors annually reviews and approves our Enterprise Security Policy, Security Incident Response Plan, and Business Resiliency Management Policy.


text: The Enterprise Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of FHLBank physical and information assets in accordance with the GLB Act and the interagency guidelines issued thereunder, and applicable laws.


text: The Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Risk Oversight committee and the full board of directors. The Security Incident Response Plan also requires assessment of materiality of the threat or incident for the purposes of public disclosure.


text: The Business Resiliency Management Policy is designed to ensure our critical business functions remain available during business disruptions and to minimize the impact of such disruptions, including the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The Business Resiliency Management Policy includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for FHLBank to operate.


text: We regularly engage with third parties to assist in the testing, maintenance, and development of our cybersecurity risk management practices and to assess, identify, and manage cybersecurity incident and threat risk.


text: Our cyber incident response plan includes third-party cybersecurity incidents and threats. Through our vendor management program, we undertake due diligence of third-party systems with which we will interact and vendors with whom we will interact, including regular reviews and oversight of these service providers through performance and technological reviews and escalation of any unsatisfactory reviews.


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on our strategy, results of operations, or financial condition. We have experienced cybersecurity incidents in the past, though none have had a material effect on our financial condition or results of operations.


text: Additional cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data their customers have entrusted to us, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.


text: Our board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. Our board of directors oversees the Enterprise Risk Management (ERM) Program, the Enterprise Security Program and Information Security through policies and principles including the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The board of directors oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.


text: Our board of directors has oversight of our ERM Program, the Enterprise Security Program, and Information Security areas which include risks from cybersecurity threats and has approved specific controls for the mitigation, monitoring and reporting associated with those risks. The Risk Oversight Committee and Operations Committee of the board of directors receive regular reporting (at least quarterly) on the risks and are responsible for overseeing the risks, including receiving Enterprise Security Program updates from the information security officer (ISO), Information Technology status updates, and reviewing enterprise risk analysis and status information, and annually reviews the Business Resiliency Management Policy and Program.


text: Our Enterprise Security Program is led by the ISO. The ISO reports to the Chief Risk Officer (CRO). FHLBank's Information Security area is led by the Director of Information Security, who reports to the Chief Information Officer. The Business Resiliency Management Program is led by the Director of Vendor Risk and Business Resiliency, who reports to the Associate CRO.


text: We have a Technology Committee, which reviews and discusses all technology-related methodologies and initiatives related to information/cybersecurity, among other topics. The Technology Committee is a management committee and reports to the Strategic Operations Management Committee (SOMC). We also have an Operations Risk Committee (ORC), which is a management committee, and is the secondary venue for reviewing enterprise security initiatives. The ORC also serves as the primary governance venue for the Business Resiliency Management Program and escalates business resiliency concerns and risk issues, among other matters, to the Strategic Risk Management Committee (SRMC). The ORC, is responsible for annually reviewing and providing recommendations on FHLBank's Security Incident Response Plan and receives monthly updates on the Enterprise Security Program. The ISO is a required member of both the Technology Committee and the ORC.


text: The SOMC and SRMC are comprised of senior leadership and executive-level officers, including FHLBank's CRO and Chief Information Officer. The SOMC is responsible for receiving reports on issues escalated from the Technology Committee. The SRMC is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the ERM Program as approved by the board of directors and receives reports on issues escalated from the ORC.


text: The Executive Team, comprised of chief-level officers, annually reviews and provides recommendations on the Enterprise Security Policy, Security Incident Response Plan, and the Business Resiliency Management Policy. The President and CEO annually approves each policy for submission to the board of directors for its consideration and ultimate approval. In addition to the board of directors and management committees, we have an Information Security Working Group (ISWG). Membership in the ISWG consists of leadership and business partners from a cross section of areas, including operational risk, information security, information technology, legal, operations, and others throughout FHLBank. The breadth and depth of experience of members of the ISWG allows for detailed discussions on information security trends and emerging risks which can be elevated to the Technology Committee for action or further discussion, as necessary and appropriate.


text: We have an Information Security area of the Information Technology department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk. The area handles processes and procedures to mitigate and implement protective, proactive and reactive measures to protect FHLBank against cybersecurity risks and is responsible for the practices designed to prevent unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.


text: Those responsible for assessing and managing FHLBank's material risks from cybersecurity threats have expertise and experience relevant to their roles. FHLBank's CIO has served in technology and leadership roles for over 30 years, including almost 26 years of experience with FHLBank. During the last 12 years, the CIO has provided oversight and strategic direction for the Information Security area of the Information Technology department. The ISO has more than 25 years of information technology experience, including 24 in the financial industry, and 22 years of experience managing information security. The ISO has a Bachelor of Science degree in Computer Science Information Systems. The Director of Information Security is a retired United States Air Force Lt. Colonel whose primary career focus was in intelligence analysis. The Director of Information Security also has 13 years experience building and leading cybersecurity programs, including cyber threat intelligence programs and cyber regulatory compliance; 16 years of cyber intelligence analysis experience, including military and civilian; five years of continuity of operations and business continuity program development; and holds a Master of Arts degree in Strategic Intelligence Studies and is a Certified Information System Security Professional.


text: The Technology Committee and ORC, as appropriate, receive regular and prompt information from the Information Security area as reported by the ISO, which in turn provide periodic, regular and prompt reporting to the SRMC and SOMC on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted FHLBank, as applicable and needed. The SRMC and SOMC may escalate reporting as applicable and needed to the Executive Team or board of directors.


text: The board of directors receives prompt and timely information from the Security Incident Response Team, which includes the CRO, CIO, ISO, and Director of Information Security, among others, as set forth in the Security Incident Response Plan, on any cybersecurity or information security incident that may pose significant risk to FHLBank and continues to receive regular reports on the incident until its conclusion. The board of directors, Risk Oversight Committee and Operations Committee each receive regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the board discusses cybersecurity and information security risks with the ISO and CRO.