text: The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Sponsor engages a selection of third-party security experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.

secItem: Item 1C


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor no r the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Trust Investment—Investing in the Trust may result in the total loss of investment due to passive management strategies, cybersecurity vulnerabilities, and inadequate recovery options for lost assets."


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Our process of assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management ("ERM") process. The audit committee of the board of directors (the "Audit Committee") oversees our ERM framework, including cybersecurity and other information technology risks. This involves collaboration with key personnel, including the Chief Financial Officer ("CFO"), the Chief Information Security Officer ("CISO"), IT operational management and Internal Audit. We also have a cross-functional team led by the CISO, which meets weekly with a fixed agenda to discuss mitigation and action-items related to ERM cyber risk updates, cyber statistics dashboards and threat vectors. Our CISO has a comprehensive background in various enterprise-wide information technology and cybersecurity leadership roles within the global energy and oil and gas sectors and strategy consulting. The Audit Committee receives a report from our Director of Internal Audit on the ERM risk register at least three times a year.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: The CISO and Chief Legal Officer ("CLO") are key members of management responsible for strategic cybersecurity leadership. They lead tactical threat assessment, keep an updated risk register and develop and maintain governance and procedures. The CISO reports to the CFO and presents at least annually to the Audit Committee and the full board of directors on cybersecurity processes. The CLO reports to the CEO, and to the Audit Committee and the full board of directors with regard to significant cybersecurity incidents, as further described below. Our CLO has specific training in cybersecurity awareness and holds a certificate of Cybersecurity Governance for the Board of Directors from the Massachusetts Institute of Technology Sloan School of Management.


text: To help manage cybersecurity risks, we have implemented a cybersecurity program consisting of security risk assessments, testing, continuous surveillance, dynamic incident response services and business continuity planning. Our cybersecurity program utilizes the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to and recover from cybersecurity incidents. In addition, we engage consultants to assess our resilience against applicable practices and standards for our industry.


text: We use threat intelligence, vulnerability scanning and security assessments to identify and classify risks and impact. We engage multiple third-party cybersecurity services and experts who collaborate with our internal team to provide a multilayered approach for real-time threat detection across cloud services, networks and endpoints. Our security measures are under continuous scrutiny, with regular enhancements and updates to our policies and operational protocols integrated with a feedback loop from tabletop exercises. Our business continuity and response plan outlines our plans, procedures and policies governing our general information security program. As part of our business continuity plan and security awareness, we conduct tabletop exercises and regular mandatory training for all employees. We have also implemented a cybersecurity enhancement program, focusing on special initiatives which include automating security incident response, including systems that can provide quicker business recovery from multi-geographical locations, strengthening the governance framework, upgrading the hybrid server environment on our vessels and improving wireless communication system resilience. In addition, we have a process in place to manage cybersecurity risks associated with third-party service providers. We are in the process of imposing the new regulatory security requirements upon our suppliers, which will include: maintaining an effective security management program, abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The status of our cybersecurity is reported to senior management as needed, and formal incident reports are made for incidents with risk of significant impact to the Company. Such incidents are escalated to our Incident Response Team, led by the Business Continuity Coordinator ("BCC"), which follows our business continuity plan and includes executive summary for management, along with compliance reports to regulators within the required timeframes. The BCC is responsible for providing timely information to the CLO, who reports to the Audit Committee and the full board of directors.


text: Although we have not experienced any material cybersecurity events to date, new advanced cybersecurity threats and attack vectors could materially affect our business strategy, results of operation or financial condition, as further discussed in the risk factors "Disruption, failure, data corruption, cyber-based attacks or security breaches of our IT systems could adversely affect our business and results of operations" in Part I, Item 1A of this Annual Report on Form 10-K.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and take a holistic approach to overseeing and managing cybersecurity, which is supported by both management and our Board of Directors. The Company's Board, the Audit Committee of the Board and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our approach to cybersecurity risk management is multi-layered and includes governance and risk, monitoring and incidence response, data security, application security, endpoint security, network security and perimeter security.

companyName: First American Financial Corp

ticker: FAF


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.


text: The Company maintains an extensive and structured enterprise risk management ("ERM") program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective.


text: The ISO Committee meets quarterly and is comprised of the Company's Chief Executive Officer, Chief Financial Officer and Chief Legal Officer, whose relevant expertise and experience can be found in the Company's Proxy Statement on Schedule 14A filed on April 1, 2024.


text: The ISO Committee also includes the Co-Presidents of First American Title Insurance Company, the Vice-Chairman of our data and analytics business and the President of our international division, who bring deep operational experience specific to our businesses; the Chief Intellectual Property and Privacy Officer, who is responsible for protecting and advising on innovation, data privacy and intellectual property; and is chaired by the Company's Chief Risk Officer, who has over 25 years of experience in risk management. The Company's CISO and Chief Technology Officer ("CTO") are participants on the ISO Committee.


text: The Company's CISO is primarily responsible for assessing and managing cybersecurity risks and threats and is responsible for developing and implementing our information security program, working closely with the ISO Committee. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity governance, cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 14 years in various information security leadership roles and has over 20 years of experience in the cybersecurity field. The CISO provides regular reports to the ISO Committee that are shared with the Company's Board of Directors.


text: The Company's CTO is responsible for overseeing the Company's overall technology strategy, including integrating security considerations into all aspects of our technology development. Our CTO has over 20 years of experience in technology management roles.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls ("SOC 2") testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider ("MSSP"), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, 2023, as amended on December 29, 2023 and January 12, 2024 and followed by a Current Report on Form 8-K on May 28, 2024. On June 21, 2024, the Company received a complaint, on a class action basis, relating to the incident in the fourth quarter of 2023. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of System & Organization Controls ("SOC") reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: Through a combination of governance, risk, and compliance (GRC) resources, we • proactively monitor IT controls to ensure compliance with legal and regulatory requirements, • perform third-party risk management assessments, • implement processes designed to ensure essential business functions remain available during business disruptions, • develop and update incident response plans to address potential weaknesses, and • maintain cyber incident management and reporting procedures.


text: These processes are overseen by our Chief Technology Officer, who has over 30 years of experience consulting and leading technology teams at several global multi-unit brands, including Blockbuster, FedEx, and Yum! Brands.


text: Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date, we are not aware of any incident or cybersecurity risks having a material impact on our business, results of operations or financial condition.


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches, and to the Nominating and Corporate Governance Committee regarding governance matters related to cybersecurity and other information technology risks.


text: TEC assesses, identifies, and manages material risks from cybersecurity threats under the governance of its Cyber Security Framework and Information Security Policy, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical facilities and/or cyber assets, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, TEC's Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes. TEC's Corporate Security group is responsible for protecting physical assets including critical facilities, protection of employees, and related physical security risks.

companyName: TAMPA ELECTRIC CO


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third-party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting policies and standards based on the National Institute of Standards and Technology Cybersecurity Frameworks. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.


text: TEC's IT Business Continuity – Emergency Contingency Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to TEC's executive leadership and Board of Directors based on an assessment of the risk and other specified criteria. TEC has established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within Emera's enterprise crisis management framework.


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or inciden t. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.


text: While to date TEC has not detected a significant compromise of its cybersecurity systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that TEC could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "TEC is exposed to potential risks related to cyberattacks and unauthorized access, which could cause system failures, disrupt operations or adversely affect safety" for a further discussion of risks related to cybersecurity.


text: The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as National Institute of Standards and Technology (NIST) and Federal Financial Institutions Examination Council (FFEIC), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: The Program is integrated into the Company's enterprise risk management program. The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations including reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at required new employee orientation and subsequently receive information security tips via email each business day. Employees also receive monthly security awareness video training and are required to complete annual computer-based training. The Company also provides information security awareness training to business customers and individuals in our communities.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts accommodate for the ever-evolving information and cyber security threat landscape. The Chief Information Security Officer ("CISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Program is included in the Company's enterprise risk management program. The CISO is responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our CISO has over 20 years of related experience, and others on our Corporate Information Security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.


text: The Program is overseen by the Company's Risk Committee, First Technology Services Board of Directors, Technology Risk Committee, and Security Advisory Committee. Additionally, the First Financial Trust and Asset Management Board of Directors oversee the Program as it relates to the trust subsidiary. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: The Company's Board of Directors and subsidiary technology and trust companies' Boards of Directors monitor the Program including policies and practices. The Company's Risk Committee and technology company's Board of Directors oversees areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The CISO also provides periodic cybersecurity updates to the Audit Committee and the Audit Committee Chairman is member of the Risk Committee. The management-level Technology Risk Committee and Security Advisory Committee oversee management of the Program and related assessments. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions" and "Our business may be adversely affected by security breaches at third-parties." in Item 1A- Risk Factors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Kimco Realty OP, LLC


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") cybersecurity framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We have in the past experienced adverse events that have not resulted, and are not expected to result, in a material impact on the Company's business operations or financial results. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced cybersecurity attacks and could in the future be subject to significant disruption, data loss or other security incidents or breaches".


text: Our Board of Directors ("Board") considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives quarterly briefings from our Chief Information Security Officer regarding the emerging cybersecurity threat and risk landscape as well as our cybersecurity risk management program and related readiness, resiliency, and response efforts. In addition, management will update the Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: We have a Cyber Risk Committee ("Cyber Committee") which reviews and reports on cybersecurity risks and related issues. The Cyber Committee is comprised of senior management from various business units within the Company and meets at least quarterly to review the status of the Company's overall cybersecurity risk management program, as well as controls and procedures and to stay up to date regarding relevant legislative, regulatory, and technical developments. The Cyber Committee is responsible for assessing and managing our material risks from cybersecurity threats. The Cyber Committee has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and in this capacity, the Committee works closely with the Chief Information Security Officer.


text: The Cyber Committee is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants.


text: We utilize a variety of administrative, technical and physical safeguards that take into account the nature of our IT environment, information assets and cybersecurity risks posed by both internal and external threats. We have incorporated cybersecurity coverage in our insurance policies, and our goal is to keep our data and systems, as well as our employees, safe from cybersecurity threats.


text: The Company conducts employee security awareness training and internal phishing exercises. When security issues arise, the Company conducts a prompt investigation and initiates response protocols and other measures to protect the Company and its valued employees and key stakeholders.


text: We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive, process or transmit, and store in any format. We have a cybersecurity risk management program, which we refer to as our information security risk management program, in place designed to assess, identify, and manage material risks from cybersecurity threats to our information, data, or information technology systems utilizing a defense-in-depth security strategy that integrates our staff, technology, and operations to establish various security barriers across multiple layers of our operations. Our information security risk management program is designed to employ industry standard practices across our operations and business functions, including access controls, monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; resilience through detecting and responding to cybersecurity events, incidents, and data disclosures or breaches, business continuity, and disaster recovery capabilities; and investments in cybersecurity infrastructure and technology needs. Key aspects of our information security risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, continuous threat detection and response monitoring, and full incident response; • Routine cybersecurity training for all employees, including social engineering techniques, simulated phishing campaigns, physical access such as tailgating, privacy or handling of sensitive data, and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response, and disaster recovery procedures, including routine tabletop incident response exercises, disaster recovery tests, unannounced penetration tests, and security control assessments; • Network, infrastructure, and application security such as database activity monitoring, encryption, secure file transfer protocols, and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • Incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments; • Annual security program assessment of the controls, maturity and performance of our information security risk management program and the information security risks associated with our technology and business systems; • External and internal penetration and intrusion testing using industry standard tools and techniques; • Compliance assessments with certain information security standards required under some of our federal contracts; • Established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts in accordance with the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF; and • Review processes and procedures designed to control access to information systems as part of our Sarbanes-Oxley Act, or SOX, testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our information security risk management program. Further, our internal audit team conducts annual assessments of our information security risk management program and controls.


text: To help identify and manage cybersecurity and information security risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: Our information security risk management program is designed to, among other things, assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service to information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our information security risk management program includes technology and processes designed to maintain active awareness of risks to the security of our information or systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our information security risk management program is integrated into our overall risk management program. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our information security risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding information security risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. The ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's information security risk management program controls, including management's assessment of recent information security incidents meeting certain criteria.


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's information security risk management program controls meeting certain criteria.


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.


text: As mentioned above, our SIEM tool monitors threat detection and response continuously. Identified threats create alerts which are monitored and addressed by our information technology team in accordance with internal policies, industry standard practices, and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed frequently and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Sr. Director, Information Security and Privacy Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of information and cybersecurity incidents. They perform an impact assessment with respect to information or cybersecurity incidents meeting certain criteria and elevate the review of any such information or cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.


text: At a management level, our information security risk management program is led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These security professionals have an average information security/cybersecurity tenure of 6 years and over 30 active certifications from ISC2, ISACA, CompTIA and other industry certification leaders including certifications such as CISSP, CISM, Security+, and CEH, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications, and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: We and our customers and suppliers have an increasing reliance on our technology systems and infrastructure. We aim to safeguard the digital infrastructure of Expeditors, enabling the highest levels of customer service while managing and minimizing risk and maintaining global compliance. The cybersecurity and risk management program within Expeditors is defined through strategy, execution, management, and oversight, with continual assessments to verify the program's overall effectiveness.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Identifying and assessing cybersecurity risks and threats is integrated into our overall enterprise risk management program. Our Enterprise Cybersecurity Committee defines the strategy, prioritizes, and sets the expectations for execution of the cybersecurity program, leveraging an industry-standard cybersecurity framework, the National Institute of Standards and Technology cybersecurity framework (NIST CSF). (i) strategic development and continuous iteration of a risk strategy in line with our information services and business goals; (ii) engineering and architecture of cybersecurity preventative and response solutions and capabilities;


text: (iii) governance, risk, and compliance defining policies, standards, and systems of control and measurement in line with industry best practices and regulatory requirements;


text: (iv) cybersecurity operations designed to prepare, identify, contain, eradicate, and recover from cyber-related incidents; and (v) identity and access management defining global practices for access, authentication, and authorization to technology systems.


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party continuous monitoring security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.


text: In February 2022, we determined that our Company was the subject of a targeted cyber-attack which resulted in having to shut down most of our connectivity, operating and accounting systems globally to manage the safety of our entire global systems environment, and we initiated our cybersecurity incident response plan. We had limited ability to conduct operations for a period of approximately three weeks, including but not limited to arranging for shipments of freight or managing customs and distribution activities for our customers' shipments. While we continue to incorporate learnings from the cyber-attack, we do not expect to have a further material adverse impact on the Company's business from this cyber-attack. Since the cyber-attack, we have accelerated investments in our CSRM program, strengthened the security of our systems and networks and enhanced continued monitoring of the known information security environment. We also added a Chief Information Security Officer (CISO) to our IS leadership.


text: Our Board of Directors provides direct oversight of and evaluates our CSRM at least annually. The Board's oversight is led by James Dubois, former CISO and Chief Information Officer (CIO) with the Microsoft Corporation, who communicates with cybersecurity leadership throughout the year. The Board is provided updates via our Enterprise Risk Management program quarterly, while meeting with the CISO at least annually.


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience. The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures and engaged third-party service providers to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.


text: Our processes for assessing and identifying cybersecurity risks include, but are not limited to, the following elements: • regular network security assessments and vulnerability scans performed by third parties; • third-party audits of our information systems, • third-party systems for monitoring and analysis of network activity and threat intelligence; • systems for protecting our information technology, such as firewalls and anti-virus software; • cybersecurity awareness training for our employees and contractors, including senior management; • and processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices.


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to cyber incidents. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future. See Item 1A. Risk Factors "Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions."


text: The Audit Committee of our Board of Directors provides oversight over our cybersecurity risk management and strategy. The committee receives updates from our information technology management and external advisors on our cybersecurity posture, initiatives, and incidents on an annual or as needed basis. Our information technology department is responsible for assessing and managing our cybersecurity risks on a day-to-day basis and their processes for managing cybersecurity risks include implementing and maintaining security controls, policies, and procedures to protect our information systems and the information residing therein. They also provide periodic awareness notifications to our employees and contractors on cybersecurity best practices and their roles and responsibilities. In addition, we have established an incident response plan to coordinate our response to and recovery from any cybersecurity incidents. Our Director of Information Technology has over 20 years of experience in managing organizations in the energy and telecom industries. We also have a Certified Information Systems Security Professional, who has eight years of experience in cyber and information security.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: STAAR SURGICAL CO

ticker: STAA


text: We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • skilled internal information security (IS) and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets, including "phishing" tests; • periodic reviews of key cybersecurity policies, and updating as needed; • information governance policy and a cybersecurity incident response plan that includes procedures for monitoring data use and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Based on the information available to us as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity, including data security risk mitigation efforts, to the Audit Committee. Under the Audit Committee charter, the Audit Committee has responsibility for discussing with management the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled.


text: The Audit Committee receives reports from management on the Company's cybersecurity risks and the Company's cybersecurity program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. The Audit Committee regularly updates the Board on such matters,and the Board also periodically receives presentations from management directly on our cybersecurity risk management.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and reporting on such risks to the Audit Committee. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.


text: STAAR utilizes internal personnel and external service providers to support the Company's cybersecurity efforts. Our Chief Information Officer (CIO) leads a team of IS professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our retained external cybersecurity consultants. Our CIO has over two decades of experience, including experience building IT and IS functions and teams, as well as cybersecurity programs. Our CIO holds an M.B.A. in management, has an audit and accounting background, and serves on the SoCalCIO Board, a Southern California organization developing and supporting local CIOs. The CIO and IS team collaborate closely with STAAR's legal, privacy, and internal audit functions to address cybersecurity and data privacy risks. The Company's internal IS and data privacy specialists have certifications from various organizations, including ISC2 (Certified Information Security Systems Professional or CISSP), Global Information Assurance (GIAC), the Computing Technology Industry Association (CompTIA) and International Association of Privacy Professionals (IAPP).


text: Pursuant to the Shared Services Agreement, the Company depends on the proper functioning, availability and security of SITE Centers' information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties. SITE Centers grants limited access to its systems to third parties providing specific outsourced functions or other services and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the critical information systems on which the Company relies, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees and others, could result in liability for the Company and have a significant impact on the Company's operations and reputation.

companyName: Curbline Properties Corp.

ticker: CURB


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the networks used by the Company, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. The Company's management team reviews the findings, if any, of these assessments, assesses the identified risks and takes action based on the Company's risk profile. In order to assess the risks posed to the information systems by third-party service providers and vendors, the SITE Centers' information technology department, coordinating with the Company's internal audit services team, evaluates and implements, as appropriate, new software and network application vendors' contracts, internal policies, certifications and System and Organization Controls ("SOC") reports during the procurement of solutions and services.


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the networks on which the Company relies, the information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. SITE Centers contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, SITE Centers has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The SITE Centers' information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates aimed at reducing risk.


text: SITE Centers has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect SITE Centers' on-site data center, and electrical power protection and generation facilities. SITE Centers also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company and SITE Centers conduct annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of their respective risk mitigation efforts. SITE Centers also maintains cybersecurity insurance (of which the Company is an additional insured); however, there is no assurance that the insurance SITE Centers maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Under the leadership of the Company's Chief Technology Officer, the SITE Centers' information technology department is primarily responsible for assessing and managing material risks to SITE Centers' information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the SITE Centers information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the SITE Centers' information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors (the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part of our overall risk assessment.


text: The Company has experienced risks from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of the information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies— A disruption, failure or breach of the networks or systems on which the Company relies, including as a result of cyber-attacks, could harm its business."


text: Strategy and Governance The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Private Credit Income Corp


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receives reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessments and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.


text: Crescent's Head of Information Technology has over 30 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships."


text: The Company's risk management program includes procedures, systems, and processes for assessing, identifying, and managing material risks from cybersecurity threats. Overall, we address cybersecurity risks through the Board of Directors (the "Board") and management oversight and a system of controls and procedures designed to protect the confidentiality, integrity, and availability of the Company's information assets. The Company employs a comprehensive system of monitoring, detection, internal reporting, and prompt escalation of certain cybersecurity incidents, plans for incident response and recovery, technical safeguards, third-party risk management, and mandatory training and awareness campaigns.

companyName: MANITOWOC CO INC

ticker: MTW


text: Governance and Management Oversight The Board, in conjunction with the Audit Committee of the Board ("Audit Committee"), oversees the Company's Enterprise Risk Management process, which includes cybersecurity risks. The Board and the Audit Committee receive regular presentations and discuss topics on cybersecurity risks with management, including the Director of Cybersecurity and the Senior Vice President Global Information Systems. The presentations and discussions address a range of topics, including recent cybersecurity developments, the threat environment, evolving standards and technology, vulnerability assessments and related remediation plans, education and training programs, and cybersecurity insurance. The Board also receives periodic training on recent developments and trends in cybersecurity from a third-party advisor. Based on the Company's procedures, the Board and Audit Committee receive prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, and regular updates until such threat or incident has been addressed.


text: The Director of Cybersecurity and the Senior Vice President Global Information Systems work closely with the CEO, CFO, General Counsel and other members of management to design, implement and maintain policies, procedures and practices to protect the Company's information systems and promptly respond to any cybersecurity threats or incidents, consistent with the Company's response and recovery plans. The Global Information Services team monitors the prevention, detection, and mitigation systems in real time and reports such threats and incidents to the Director of Cybersecurity, Senior Vice President Global Information Systems, the CEO, CFO, General Counsel, and other members of management, when appropriate. The process provides for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Global Information Services team has relevant educational and industry experience. The Director of Cybersecurity has served in various roles in information technology and security at Manitowoc for over 30 years, including the last six years overseeing cybersecurity. The Senior Vice President Global Information Systems has been with Manitowoc for over 24 years, leading the Global IS team since 2022.


text: Controls, Procedures and Technical Safeguards The Company has enterprise security policies, controls and procedures designed to protect the confidentiality, integrity, and availability of our information assets. Among other areas, the comprehensive system addresses intrusion detection, encryption, device hardening, and monitoring through various controls, including phishing protection solutions, administrative password management tools, system patching, encryption, and intrusion prevention and detection systems.


text: The Company regularly engages in assessments, testing and subsequent remediation of our policies, procedures and practices that are designed to address cybersecurity threats and incidents. These efforts include a variety of third-party vendors and activities, including audits, assessments, penetration tests, threat modeling, tabletop exercises and vulnerability testing. We have also engaged a third party to perform an independent review of our information security environment. The results of such assessments, audits and reviews, along with remediation and development plans, are reported by management to the Board and Audit Committee.


text: The Company deploys technical safeguards designed to protect the Company's information systems, including firewalls and systems for anti-malware, intrusion detection and prevention. The technical safeguards are regularly evaluated, tested, and improved through vulnerability assessments and updated cybersecurity intelligence. The Company also maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and such plans are tested, evaluated and updated on a regular basis.


text: The company evaluates and oversees cybersecurity risks presented by third parties, including vendors, and service providers, and the systems of third parties that could impact our business. We seek vendor partners who are reliable, reputable and maintain cybersecurity programs. We also rely on contractual terms for indemnification and to ensure vendors and service providers employ industry best practices to protect confidential information.


text: The Company uses employee training and education as part of the comprehensive system designed to protect the Company's information systems. Through mandatory training and ongoing awareness campaigns, including phishing simulations, we are educating our personnel about cybersecurity risks and providing them with the tools to identify, prevent and report potential cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage, and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and the related information processes, stored, or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by IT senior leadership, including the Company's Senior Vice President of Information Technology (SVP-IT); • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and • periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; and • monitoring information systems to detect attacks and indicators of potential attacks.


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting, and correcting information system flaws, security alerts, and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third-party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.


text: Our cybersecurity incident management plan includes the following, among other things: • The SVP-IT leads the team in the development, documentation, review and testing of security procedures, and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis; • The SVP-IT works with the Executive Team on the identification, assessment, verification, and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately. • The CIRT team, in consultation with outside experts if needed, is responsible for the following: o Initial containment; o Analysis to establish root cause of incidents, identification and evidence collection;


text: o Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified; o Implementing solutions designed to solve underlying problems and prevent re-occurrence; o Recovery and restoring normal business functionality;


text: o Review after closure of each incident and conducting a post-mortem analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the CIRT evaluates competency and any additional training requirements needed.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected us or our business strategy, results of operations, financial condition and/or cash flows. Moreover, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial condition and/or cash flows. See Item 1A, Risk Factors above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential, and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.


text: We have invested in robust data security and privacy protections. We follow industry-standard recommendations for data security such as those outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-171 and evolving Cybersecurity Maturity Model Certification (CMMC) frameworks. We have developed cybersecurity policies and procedures, including a data classification system to ensure the protection of critical data. In addition to periodic internal review, we also employ external auditors as needed, and cybersecurity testing firms to review our cybersecurity posture.


text: We maintain a CIRT, whose responsibilities are described above. We conduct periodic tests with this team to maintain readiness and resiliency while regularly reviewing its policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.


text: Our Board of Directors receives an update from our SVP-IT twice per year. In addition, our Government Security Committee of the Board of Directors is responsible for reviewing Cybersecurity Posture and overall resilience of the aerospace and defense portion of the network. The Government Security Committee reviews global cybersecurity risk with the SVP-IT at least four times a year. These reviews included standard cybersecurity-related metrics as well as other detailed reviews of sensitive systems. Our SVP-IT has over 25 years of experience in IT, which include various leadership roles at other large corporations and holds an Executive Master in Cybersecurity degree from Brown University.


text: We rely on our technology network infrastructure and information systems to operate our business, rent our equipment, interact with vendors and customers, support and grow our customer base and bill, collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: H&E Equipment Services, Inc.


text: The Company has robust processes for assessing, identifying and managing material risks from cybersecurity threats that are integrated into our overall risk management process. The Company utilizes the National Institute of Standards and Technology (NIST) framework as the basis for our cybersecurity management approach. Under the supervision of the Chief Information Officer ("CIO"), we review our cybersecurity insurance policy and regularly identify all computing assets including hardware, software, and network infrastructure for a comprehensive risk assessment. We consider threats that may originate from both internal and external sources and build in technical security controls based on a defense-in-depth strategy. To identify risks, we complete vulnerability assessments on a recurring basis to proactively identify potential weaknesses. We additionally employ third party external and internal penetration testing on an annual basis to assist in identifying additional vulnerabilities in our environment. We also perform disaster recovery exercises throughout the organization annually by our in-house team. In connection with our threat management and overall risk management process, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors and apply the MITRE ATT&CK framework to review defensive coverage against cybersecurity attacks. Employees at H&E receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. Our managed detection and response partner provides 24/7 monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. A cybersecurity incident is defined as any successful unauthorized access, disclosure, or misuse of computing systems, data or networks, including hacking and theft, of any scope that may or may not have an impact to the organization. We have a comprehensive incident response plan that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents. As of December 31, 2024, risks from cybersecurity threats have not materially affected the Company's financial condition or operations.


text: The Company's information security and cybersecurity program is managed by our CIO whose team includes a VP of Infrastructure and Director of IT Security (collectively, "the IT Security Team"), whom all have the necessary expertise, certifications and experience to lead our enterprise-wide cybersecurity strategy, policy, architecture and processes. The CIO has over 26 years of experience and has been a member and leader of our Company's information systems and technological advancements for the past 22 years. The Director of IT Security, reporting to our VP of Infrastructure, is responsible for our overall network security and assessing and managing cybersecurity risks and threats. The Director of IT Security has over 16 years of experience working in IT security and holds CISSP and GIAC certifications. The VP of Infrastructure reports to our CIO, and has principal responsibility for our network infrastructure and the operation of our cybersecurity program, network and system administration. The VP of Infrastructure has over 30 years of experience in system administration and has specialized in ERP systems and network infrastructure. Collectively, the IT Security Team prepares updates and presentations for the Board of Directors, Audit Committee and executive management.


text: The IT Security team reports the detection, mitigation and remediation of cybersecurity incidents to executive management and the Audit Committee of the Board of Directors. If we were to experience a cybersecurity incident, our Director of IT Security will inform the rest of the IT Security Team, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and in accordance with our incident response plan, notify executive management and the necessary finance, operations and legal team functions. The CIO additionally reports all cybersecurity incidents to the Audit Committee of the Board. Once a cybersecurity incident is reported to the Audit Committee of the Board, and potentially the overall Board of Directors, the Audit Committee, with the input of the IT Security Team and executive management, will discuss impact, determine how to address it and whether or not the incident would require external reporting, if applicable.


text: The Company's Board of Directors, specifically the Audit Committee, is responsible for oversight and governance related to our cybersecurity processes and risk management. The CIO reports the results of the annual comprehensive risk assessment, including the evaluation of cybersecurity risks, the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Board of Directors on an annual basis and reports cybersecurity risk updates to the Audit Committee on a semi-annual basis, or more frequently should a cybersecurity risk or event emerge requiring additional communication. The Audit Committee will report on the cybersecurity risk updates it receives from the CIO to the Board of Directors or as needed have the CIO report subsequently to the full Board of Directors.


text: We recognize the importance of maintaining the security of our electronic networks, information systems, and data. We face significant and persistent cybersecurity threats, including risks heightened by the numerous geographies that we serve; our reliance on complex information networks; remote work among certain of our employees; reliance on digital operations to service certain of our customers; and our use of third-party software and services. Our vendors and customers also face cybersecurity threats. A cybersecurity incident impacting our company or any of our vendors or customers could materially adversely affect our operations and/or financial condition. To protect against and prevent cybersecurity incidents, we employ a comprehensive approach where our Board and management teams work together to oversee our cybersecurity program. We are committed to maintaining robust cybersecurity oversight, controls, and strategies that are designed to help us assess, identify, and manage cybersecurity risks.

companyName: Regional Management Corp.

ticker: RM