text: Monitoring and Mitigation In addition to the ongoing cybersecurity program management carried out by the Senior Director of Information Security, the Company also has the Buckle Incident Response Team ("BIRT"), a cross-functional group with relevant expertise and authority to support all aspects of the incident response, recovery, and reporting of a security incident. BIRT uses a well-defined incident response plan that outlines processes to prepare for and detect cybersecurity threats, analyze the severity, materiality, and impacts, determine who should be notified and involved in the Company's response, and define actions necessary to contain and recover in the event of an incident. As part of this process, cybersecurity incidents surpassing a certain level of severity necessitate communications to the Board of Directors. On an annual basis, the Company performs tabletop exercises designed to enhance BIRT's readiness and effectiveness in handling cybersecurity incidents.


text: To mitigate the financial impact of potential cybersecurity incidents, the Company maintains comprehensive cyber insurance coverage. This coverage is reviewed annually to ensure it aligns with the Company's risk profile and the evolving cyber threat landscape. In addition to covering losses associated with an incident, this insurance coverage also provides for additional access to third-party resources and expertise to augment Buckle resources should a cyber incident occur.

companyName: BUCKLE INC

ticker: BKE

secItem: Item 1C


text: Although the Company has combatted cybersecurity threats in the normal course of business, these threats have not materially affected its operations, business strategy, results of operations, or financial condition. While the Company strives to implement best-in-class cybersecurity measures, it recognizes that the threat landscape is continually evolving. Future attacks, if not successfully prevented or mitigated, could materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for additional information.


text: Buckle is committed to earning and maintaining the trust of its guests, teammates, vendors, and shareholders. This commitment, as it relates to technology and data, requires a focus on protecting business operations and preserving the confidentiality, integrity, and availability of information by preventing, identifying, and mitigating cybersecurity threats and effectively responding to any security incidents when they occur. The Company's commitment to cybersecurity is integral to its business strategy, operational integrity, and brand reputation.


text: Leading the Company's cybersecurity risk management and strategy at the management level is our Vice President of Information Security, who reports directly to the Vice President of Information Technology. The Vice President of Information Security has been with the Company for over 19 years, serving in various capacities with deep understanding of the underlying architecture, technologies, and systems utilized by the Company. The Vice President of Information Security and his team are responsible for designing and implementing the Company's strategies, policies, and processes to assess, identify, and manage risk related to cybersecurity threats, along with threats associated with our use of third-party service providers. A combination of widely accepted tools, relationships with external experts, in-house expertise, and in-house technologies are integral to the Company's strategy for managing cybersecurity threats. The Company executes ongoing assessment and testing of processes and practices through regular teammate training, phishing exercises, network and endpoint monitoring, penetration testing, vulnerability scanning, and attack simulations. The Company's incident response plan is based on recognized industry security standards and control frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Third parties are also engaged to perform assessments and validate the Company's cybersecurity measures, including information security maturity assessments and independent reviews of the operating effectiveness of the information security control environment.


text: While the Board of Directors is ultimately accountable for risk management, the Audit Committee oversees management's processes for identifying, implementing, and mitigating cybersecurity threats. On at least a quarterly basis, the Vice President of Information Security provides the Audit Committee with updates regarding the Company's ongoing cybersecurity program. These updates regularly cover the latest in the Company's evolving approach to managing cybersecurity risks, reviewing key metrics on the effectiveness of the program, and discussing recent developments, key strategic initiatives, the current threat environment, and outcomes from specific evaluations and tests. Additionally, to ensure appropriate knowledge and oversight of cybersecurity risks, the Audit Committee Chair holds a CERT Certificate in Cybsersecurity Oversight from the CERT Division of the Software Engineering Institute at Carnegie Mellon University, which he earned in January 2024.


text: Monitoring and Mitigation In addition to the ongoing cybersecurity program management carried out by the Vice President of Information Security, the Company also has the Buckle Incident Response Team ("BIRT"), a cross-functional group with relevant expertise and authority to support all aspects of the incident response, recovery, and reporting of a security incident. BIRT uses a well-defined incident response plan that outlines processes to prepare for and detect cybersecurity threats, analyze the severity, materiality, and impacts, determine who should be notified and involved in the Company's response, and define actions necessary to contain and recover in the event of an incident. As part of this process, cybersecurity incidents surpassing a certain level of severity necessitate communications to the Board of Directors. On an annual basis, the Company performs tabletop exercises designed to enhance BIRT's readiness and effectiveness in handling cybersecurity incidents.


text: Although the Company has combatted cybersecurity threats in the normal course of business, these threats have not materially affected its operations, business strategy, results of operations, or financial condition. While the Company strives to implement highly effective cybersecurity measures, it recognizes that the threat landscape is continually evolving. Future attacks, if not successfully prevented or mitigated, could materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for additional information.


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the ISO 27002 and NIST SP 800-37 Rev. 2 frameworks, to which risk management in relation to our information systems is aligned. We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with anomaly identification enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The Company partners with third-party service providers and employs processes to assess, identify, and manage material risks from cybersecurity threats arising from the use of such third-party service providers. Our latest assessment attempted to identify vulnerabilities in our network and systems from external, internal, and social engineering perspectives. Our cybersecurity practices (including with respect to third-party service providers) have been assessed to represent a level of maturity consistent with industry best practices.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, and financial condition. For more information about these risks, see the disclosure under the heading "Technology and Cybersecurity Risks" in Part I, Item 1A. Risk Factors.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The audit committee of the Company's board of directors provides structured oversight of the Company's risk management program, which focuses on the most significant short-, intermediate-, and long-term risks the Company faces. The Company has an information security compliance committee (the "Committee") that consists of the members of the Company's compliance committee, which reports to the board of directors, and at least three members of Company management. The Committee is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Committee plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security manual. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our designated Chief Information Security Officer ("CISO").


text: At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of the board of directors for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.


text: The CISO, the Vice President, Engineering – Security, Compliance and Trust, or the Director of Engineering Security and Compliance also issues an annual written report to the board of directors on the Program and material cybersecurity risks.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company has adopted and maintains written policies and procedures for the protection of Company's information systems and nonpublic information stored on those systems, which are based on the Company's risk assessment and that address all other specific topics as may be required by applicable laws and regulations.


text: The Program includes processes to coordinate and facilitate the implementation of information security best practices and services throughout the Company and to comply with applicable cybersecurity requirements under federal and state laws and regulations, including, but not limited to, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act of 1996, and the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies, 23 NYCRR 500. The Program is based on the Company's risk assessment and designed to perform in accordance with applicable laws and regulations.


text: The Company has established and maintains a comprehensive information security incident management plan (the "Plan") that allows the Company to respond quickly and effectively to cybersecurity threats and cybersecurity incidents, including cybersecurity breaches, in accordance with applicable laws and regulations.


text: The Company routinely engages third-party industry experts to work in conjunction with our internal audit team in performing risk assessments of the Program and the Plan and of the Company's execution of the Program and the Plan.


text: The CISO, in coordination with the Director of Engineering Security and Compliance and the information security managers, is responsible for leading the assessment and management of cybersecurity risks. The Company's information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services. The CISO reports to the board of directors, the audit committee, and senior management on cybersecurity threats.


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the ISO 27002, NIST SP 800-37 Rev. 2, and NIST Cybersecurity frameworks, to which risk management in relation to our information systems is aligned. We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with anomaly identification enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The audit committee of the Company's board of directors provides structured oversight of the Company's risk management program, which focuses on the most significant short-, intermediate-, and long-term risks the Company faces. The Company has an information security compliance committee (the "Committee") that consists of the members of the Company's compliance committee, which reports to the board of directors, and at least three members of Company management. The Committee is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Committee plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security manual. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our Vice President, Engineering – Security, Compliance, and Trust, who maintains a CRISC certification, has more than twenty years of experience in information security, risk management, and regulatory compliance in the financial services industry, and serves as our designated Chief Information Security Officer ("CISO").


text: At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of the board of directors for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors. The CISO also issues an annual written report to the board of directors on the Program and material cybersecurity risks.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company has adopted and maintains written policies and procedures for the protection of Company's information systems and nonpublic information stored on those systems, which are based on the Company's risk assessment and that address all other specific topics as may be required by applicable laws and regulations. The Company requires all team members with access to any of its information systems, including contractors, to complete social engineering, cybersecurity, and compliance training programs annually.


text: The CISO, in coordination with the information security managers, is responsible for leading the assessment and management of cybersecurity risks. The Company's information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services. The CISO reports to the board of directors, the audit committee, and senior management on cybersecurity threats.


text: We have established a set of policies and procedures to assess, identify, and manage material risks from cybersecurity threats, codified in the Bausch Health Cybersecurity Program (the "Program"). The purpose of the Program is to establish a comprehensive framework intended to identify, manage, and where possible mitigate risks; prevent or identify and manage security incidents; protect our information assets, systems, and networks from potential threats; and enable a prompt response and recovery from cyber-attacks.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The NIST CSF offers a framework for cybersecurity management, including asset identification, systems protection, threat detection, and incident response and recovery. In particular, our cybersecurity strategy, as set forth in the Program, uses NIST Special Publication 800-53, which covers the steps in the CSF that address security safeguards across five dimensions of information security (Identification, Protection, Detection, Response, and Recovery). The Program guides the execution of our cybersecurity responsibilities for our digital infrastructure, including network security, endpoint security, data protection, incident response, awareness and training, compliance, and risk management.


text: The policies and procedures established pursuant to the Program include: • Risk Identification – Seeking to identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners, including using audits and testing. • Protection – Implementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technology. • Detection – Detection of the occurrence of anomalies and cybersecurity events through monitoring and communication to appropriate personnel. • Response – Establishing appropriate responses when cybersecurity events are detected, including through response planning and establishment of communications channels. • Recovery – Seeking to ensure resilience and restore any capabilities or services that were impaired due to a cybersecurity incident, through recovery planning and other measures. Pursuant to the Program, the Bausch Health Information Technology Security Department develops specific cybersecurity policies, procedures and guidelines. Key cybersecurity risk drivers, mitigation strategies, and key updates are incorporated as part of our ongoing Enterprise Risk Management processes. Our executive management team is responsible and accountable for the Program, cybersecurity risks generally, and ensuring that appropriate resources are allocated to addressing such risks, with Board-level oversight from the Audit and Risk Committee of the Board of Directors. We review and seek to improve the Program through assessments from external, independent third parties, who review documentation, conduct interviews with key stakeholders, assess security roadmap progression and maturity against industry benchmarks, report on our internal incident response preparedness and help identify areas for continued focus. We also have insurance coverage for potential losses arising from a cybersecurity incident and to provide professional services that mitigate potential business impacts during cybersecurity incidents.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition. Please refer to "Risk Factors— Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our or our third-party service providers' information technology systems could compromise sensitive information related to our business or prevent us from accessing critical information and subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline." under Item 1A. of this Form 10-K for additional description of cybersecurity risks and potential related impacts on our Company.


text: The Audit and Risk Committee of the Board, comprised fully of independent directors, is responsible for assisting the Board in oversight of risk, including cybersecurity risks. As part of that responsibility, the Audit and Risk Committee regularly reviews our enterprise risk assessment results, including the results of any cybersecurity risk assessments or audits, reports of investigations into any significant cybersecurity risks, and assessments of our insurance coverage for significant operational risks, including cybersecurity.


text: In addition, we have established a Global Cybersecurity Disclosure Committee, a senior-level, cross-functional governance committee comprised of representatives from our Information Technology, Compliance, Finance, and Legal departments, which is engaged during certain cybersecurity incidents to determine further response, escalation and reporting needs. The Global Cybersecurity Disclosure Committee meets quarterly to review information technology risk metrics and as needed in the event of a potentially material security incident, including at the discretion of Vice President of Information Security. The Global Cybersecurity Disclosure Committee is responsible for oversight of the implementation of appropriate remediation for security incidents where required, as well as determining whether to discuss any information security incidents with the Audit and Risk Committee of the Board of Directors and if external reporting is required under relevant laws, regulations or SEC rules. Members of our Global Cybersecurity Disclosure Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging cybersecurity and data privacy risks.


text: We have established a formal set of policies and procedures to identify, assess, manage and report on material risks derived from cybersecurity threats and vulnerabilities, codified in the Bausch Health Cybersecurity Program (the "Program"). The purpose of the Program is to deploy a comprehensive framework designed to reasonably protect our information assets, systems, and networks from potential threats; and enable a prompt response to cybersecurity events and, if necessary, recovery from cyber-attacks using a combination of risk management and cybersecurity frameworks.


text: The Program is based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF") version 2.0. The CSF offers a framework for cybersecurity management, including program governance, asset and risk identification, systems protection, threat detection, and incident response and recovery. In particular, our cybersecurity strategy, as set forth in the Program, uses the CSF to address security safeguards across six dimensions of information security (Govern, Identification, Protection, Detection, Response, and Recovery). The Program guides the execution of our cybersecurity responsibilities for our digital infrastructure, including network security, endpoint security, data protection, incident response, awareness and training, compliance, and risk management.


text: The policies and procedures established pursuant to the Program include: • Govern – Identify cybersecurity priorities and related outcomes as a component of the Company's strategic planning processes. • Identification – Identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners, including using audits and testing. • Protection – Implementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technologies. • Detection – Detection of the occurrence of anomalies and cybersecurity events through logging, monitoring and communicating to appropriate personnel. • Response – Establishing appropriate responses when cybersecurity events are detected, including response planning and leveraging communications channels. • Recovery – Restore any capabilities or services that were impaired as a result of a cybersecurity incident, by executing documented recovery plans. Pursuant to the Program, the Bausch Health Information Technology Security Department develops specific cybersecurity policies, procedures and guidelines. Key cybersecurity risk drivers, mitigation strategies, and key updates are incorporated as part of our ongoing Enterprise Risk Management processes. Our executive management team is responsible and accountable for the Program, cybersecurity risks generally, and ensuring that appropriate resources are allocated to addressing such risks, with Board-level oversight from the Audit and Risk Committee of the Board of Directors. We review and seek to improve the Program through assessments from external, independent third parties, who review documentation, conduct interviews with key stakeholders, assess security roadmap progression and maturity against industry benchmarks, report on our internal incident response preparedness and help identify areas for continued focus. We also have insurance coverage for potential losses arising from a cybersecurity incident and to provide professional services that mitigate potential business impacts during cybersecurity incidents.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While as of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition, we have experienced cybersecurity incidents from time to time, and any future incidents have the potential to have a material adverse effect on our business strategy, results of operations and/or financial condition. Please refer to "Risk Factors— Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our or our third-party service providers' information technology systems could compromise sensitive information related to our business or prevent us from accessing critical information and subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline." under Item 1A. of this Form 10-K for additional description of cybersecurity risks and potential related impacts on our Company.


text: We rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations. We have established a security program and processes to assess, identify and manage cybersecurity risks related to our IT and OT systems, as well as our products. Our global cybersecurity organization is led by our chief information security officer (CISO), who reports directly to our chief information officer (CIO) and under the organization of our chief information and digital officer (CIDO). Our current CISO has extensive information technology experience, including in security architecture, software development and engineering, as well as leading security operations and incident response, offensive and defensive cyber projects in increasing roles of responsibility. He also previously held Certified Information Systems Security Professional (CISSP) and GIAC Certified Forensics Analyst certifications. Our current CIDO has extensive experience overseeing information technology and security programs, including roles of increasing leadership within our Information and Digital organizations over the last ten years, and prior to that in increasing roles of responsibility managing information systems, including over 18 years at General Electric. Our current CIDO holds CISSP and other IT certifications.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Our enterprise cybersecurity program is designed to monitor and continually enhance our enterprise security posture, with the goal of preventing cybersecurity incidents to the extent feasible, including assessments to better understand our readiness for cybersecurity threats and the resilience of our critical business functions, with the goal of avoiding or reducing the impact if such an event were to occur. We have implemented cybersecurity policies mapped to industry and government standards and frameworks, such as U.S. National Institute of Standards and Technology (NIST) and International Standard of Organization (ISO). Our cybersecurity strategy and maturity is aligned to the NIST-Cybersecurity Framework (NIST CSF). This framework provides us a structured approach to managing our cybersecurity risk through its five core functions: Identification of digital assets, their risks, and business context; Protection, by implementing safeguards such as firewalls, network segmentation, and email security; Detection: through monitoring for anomalies and potential threats on the network, endpoints and data; Response, by having up to date incident response plans and skilled teams in place, including utilizing a crisis committee to respond in the event of a cybersecurity incident; and Recovery, achieved through ensuring data and system backups as well as testing our disaster recovery procedures. We also regularly review our cybersecurity policies and require annual cybersecurity training for our employees. Our product cybersecurity focus begins with our design protocols and is supported by quality testing, provider education, and packaging and distribution standards. We use penetration testing to simulate cyberattacks and better understand our exploitable weaknesses, and we monitor threat intelligence feeds, including avenues for product users to report vulnerabilities directly to us, and use scanning tools to detect and assess vulnerabilities that could affect our products. In addition, we conduct product, enterprise and vendor/third party risk assessments, vulnerability assessments and analyses to gain insights into potential vulnerabilities and their impact on critical functions, and leverage their outcomes to prioritize our security investments and balance our resource allocation.


text: We use third party security providers for specialized areas such as incident response, penetration testing, and on-demand cybersecurity services, including staff augmentation and consulting. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities.


text: We engage and rely upon third parties to provide services and/or goods, represent and or otherwise act on our behalf. Prior to engaging or conducting any business with or on our behalf, such parties undergo a due diligence review, and a third party security risk assessment is conducted to validate they are legally permitted and qualified to maintain appropriate safeguards to protect our information assets in connection with the services they intend to provide.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our enterprise risk management (ERM) program. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the Company on an annual basis. Risks are discussed with appropriate members of management, who manage risk coverage, monitoring and reporting in the relevant risk function, including our cybersecurity program, and incorporate those activities as part of developing our strategic plan. The ERM program's annual risk assessment is presented annually to our Board of Directors and the Risk Committee of the Board.


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including cybersecurity risks. While the Board has the ultimate responsibility for risk oversight, each committee of the Board also oversees risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. The Risk Committee of our Board also focuses on an enterprise-wide approach to risk management, and has primary oversight responsibility for areas of quality and nonfinancial compliance issues, including cybersecurity risks. The Risk Committee receives periodic updates from the CISO and CIDO on our cyber risks and threats, assessments of our cybersecurity program and the evolving threat landscape. Our Board of Directors also receives annual updates on such cybersecurity matters, or more frequently as appropriate under the procedures described below. Our Board and Risk Committee also receive cybersecurity risk assessments as part of the annual ERM program presentation described above.


text: We have established controls and procedures to escalate enterprise level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Under our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts, including a crisis committee as needed in accordance with our incident response plans, for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to our financial results, operations, and/or reputation are immediately reported by management to the Board of Directors, or individual members or committees thereof, as appropriate, in accordance with our established escalation framework. In addition, we have established procedures to help ensure that members of management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity risks that we face.


text: We rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations. We have established an enterprise cybersecurity program, which is administered by a cross-functional team of cybersecurity professionals that includes employees and third party contractors and vendors, that utilizes various tools, methodologies and processes to assess, identify and manage cybersecurity risks related to our IT and OT systems, as well as our products. Our cybersecurity program is designed to monitor and continually enhance our enterprise security posture, with the goal of preventing cybersecurity incidents to the extent feasible, including assessments to better understand our readiness for cybersecurity threats and the resilience of our critical business functions, with the goal of avoiding or reducing the impact if such an event were to occur. We have implemented cybersecurity policies mapped to industry and government standards and frameworks, such as U.S. National Institute of Standards and Technology (NIST) and International Standard of Organization, and our strategy is aligned to the NIST CyberSecurity Framework that provides us a structured approach to managing our cybersecurity risk through its five core functions. We regularly review our cybersecurity policies and require annual cybersecurity training for our employees. We also periodically conduct simulation exercises involving employees at various levels of the organization, as well as our Board of Directors, to prepare for cybersecurity incidents and response planning.


text: Our product cybersecurity focus begins with our design protocols and is supported by quality testing, provider education, and packaging and distribution standards. We use penetration testing to simulate cyberattacks and better understand our exploitable weaknesses, and we monitor threat intelligence feeds, including avenues for product users to report vulnerabilities directly to us, and use scanning tools to detect and assess vulnerabilities that could affect our products. In addition, we conduct product, enterprise and vendor/third party risk assessments, vulnerability assessments and analyses to gain insights into potential vulnerabilities and their impact on critical functions, and leverage their outcomes to prioritize our security investments and balance our resource allocation.


text: We engage and rely upon third parties to provide services and/or goods, represent and/or otherwise act on our behalf. Prior to engaging or conducting any business with or on our behalf, such parties undergo a due diligence review, and a third party security risk assessment is conducted to validate they are legally permitted and qualified to maintain appropriate safeguards to protect our information assets in connection with the services they intend to provide. We perform supplemental reviews as necessary commensurate with the risk associated with each third party, for example, if or when a third party is affected by an incident, that directly or indirectly impacts our company we undertake a full assessment and implement additional controls commensurate to the risk. Furthermore, to minimize risks and vulnerabilities to our systems, our cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers.


text: Assessing, identifying, and managing cybersecurity related risks are also integrated into our enterprise risk management (ERM) program. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the Company on an annual basis. Risks are discussed with appropriate members of management, who manage risk coverage, monitoring and reporting in the relevant risk function, including our cybersecurity program, and incorporate those activities as part of developing our strategic plan. The ERM program's annual risk assessment is presented annually to our Board of Directors.


text: Our global cybersecurity organization is led by our chief information security officer (CISO), who reports directly to our chief information officer (CIO) and under the organization of our chief information and digital officer (CIDO). Our current CISO has over 19 years of extensive information technology experience, including in security architecture, software development and engineering, as well as leading security operations and incident response, offensive and defensive cyber projects in increasing roles of responsibility. He also previously held Certified Information Systems Security Professional (CISSP) and GIAC Certified Forensics Analyst certifications. Our current CIDO has extensive experience overseeing information technology and security programs, including roles of increasing leadership within our Information and Digital organizations over the last ten years, and prior to that in increasing roles of responsibility managing information systems, including over 18 years at General Electric. Our current CIDO holds CISSP and other IT certifications.


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including cybersecurity risks. While the Board has the ultimate responsibility for risk oversight, each committee of the Board also oversees risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. The Risk Committee of our Board also focuses on an enterprise-wide approach to risk management, and has primary oversight responsibility for areas of quality and nonfinancial compliance issues, including cybersecurity risks. The Risk Committee receives periodic updates from the CISO and CIDO on our cybersecurity risks and threats, assessments of our cybersecurity program and the evolving threat landscape. Our Board of Directors also receives annual updates on such cybersecurity matters, or more frequently as appropriate under the procedures described below. Our Board of Directors also receive cybersecurity risk assessments as part of the annual ERM program presentation described above.


text: We have established controls and procedures to escalate enterprise level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Under our framework, cybersecurity issues, including those involving vulnerabilities introduced by our IT, OT systems and use of third-party software, are analyzed by subject matter experts, including a crisis committee as needed in accordance with our incident response plans, for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to our financial results, operations, and/or reputation are immediately reported by management to the Board of Directors, or individual members or committees thereof, as appropriate, in accordance with our established escalation framework. In addition, we have established procedures to help ensure that members of management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: We design and assess our program based on the National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO) and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST, ISO and other standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from senior management on our cyber risk management program. Board members receive presentations on cybersecurity topics from senior management, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our senior management team, including the Senior Director of Information Services, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Senior Director of Information Services has over 20 years of industry experiences leading and overseeing cybersecurity programs at public and private companies.


text: Our senior management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST, ISO and other standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our senior management team, including the Senior Director, IT and Facilities, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Senior Director, IT and Facilities has over 20 years of industry experiences leading and overseeing cybersecurity programs at public and private companies.


text: Cybersecurity risk management is a key component of our overall risk management efforts at Franklin Covey. We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may have material effects on the confidentiality, integrity, and availability of our information systems, networks, and offerings. Cybersecurity risk is addressed at both management and Board of Director levels as described below.

companyName: FRANKLIN COVEY CO

ticker: FC


text: Management's Role in Assessing Cybersecurity Risk and Directing Strategy At the management level, primary responsibility for assessing and managing cybersecurity threats and material risks rests with our Chief Information Officer (CIO), who reports directly to our Executive Vice-President of Operations. Our CIO has over two decades of experience in information technology and cybersecurity and is a Certified Information Systems Security Professional (CISSP). The CIO leads a team of five other information system professionals, three of whom also have CISSP credentials. Our CIO and cybersecurity team are responsible for understanding, managing, and communicating cybersecurity risk to our management and works with our legal department to oversee compliance with various legal, regulatory, and contractual cybersecurity requirements.


text: Our cybersecurity program is aligned with the National Institute of Standards and Technology (NIST) 800 Cybersecurity Framework and uses a layered strategy, relying on technology and human processes to safeguard our systems and client data. Our cybersecurity strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, multi-factor authentication, identity access management, endpoint security, mobile security, application security, network security, web security, and encryption. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support and operations; and other functions. The Company provides ongoing mandatory cybersecurity training for associates that is intended to help them understand cybersecurity risks and comply with our cybersecurity policies.


text: We engage third party professionals to assess our cybersecurity program and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance. In addition, our internal audit function regularly meets with the cybersecurity team and is implementing a program to periodically test the control framework and operation of our cybersecurity incident response plan. The results of these tests will be presented directly to the Audit Committee of the Board of Directors.


text: The cybersecurity team meets frequently to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have developed an incident response plan which is designed to "respond, restore, and resume" operation of our information systems and platforms. Our incident response plan also governs our immediate response to attacks, including detection, notification, escalation, assessment, and remediation efforts. The cybersecurity team routinely tests the incident response plan across the organization to validate the procedures for appropriately assessing and escalating risks and incidents. Our cybersecurity team may also coordinate its incident response efforts with external advisors and key stakeholders if necessary.


text: Board of Director Oversight The Audit Committee of the Board of Directors has the primary responsibility for cybersecurity risk oversight, including risk priorities, resource allocation, and oversight structures. The Audit Committee and Board of Directors receive regular reports from the CIO on a variety of topics including cybersecurity strategy, the threat landscape, recent developments and trends, and key initiatives. Our incident response plan includes documented protocols which govern established reporting thresholds for escalating cybersecurity incidents within the Company and where appropriate, to the Audit Committee or full Board of Directors.


text: Cybersecurity Risks, Threats, and Incidents While we have not experienced any material cybersecurity incidents, there can be no guarantee that we, or any third parties with which we interact, will not be the subject of future successful attacks, threats, or incidents. We rely significantly on information technology for the operation of our business, including our All Access Pass and Leader in Me portals. For more information on cybersecurity risks we face, refer to Part I, Item 1A Risk Factors under the section entitled Cybersecurity and Information Technology Risks, which should be read in conjunction with the information presented in this Item 1C.


text: Cybersecurity risk management is a key component of our overall risk management efforts at Franklin Covey. We have cybersecurity processes, technologies, and controls in place to assist in our efforts to assess, identify, and manage material risks from cybersecurity threats that may impact the confidentiality, integrity, and availability of our information systems, networks, and offerings. Cybersecurity risk is addressed at both management and Board of Director levels as described below.


text: We engage third party professionals to assess our cybersecurity program and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance. In addition, our internal audit function regularly meets with the cybersecurity team and periodically tests the control framework and operation of our cybersecurity incident response plan. The results of these tests are presented directly to the Audit Committee of the Board of Directors.


text: We are regularly subject to attempted cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our business and our overall enterprise risk management program. Like other global companies, we have experienced cyber threats and incidents, although none to date have been material or had a material adverse effect on our business or financial condition. We have a multilayered approach for assessing, identifying, preventing, evaluating, managing and monitoring cybersecurity risks, that is designed to help prevent such attacks and protect our information, systems, assets and operations from internal and external cyber threats and to help mitigate risks of cyber incidents. Our board of directors delegated authority to the risk oversight and sustainability committee to assist in fulfilling its oversight responsibilities with respect to management's identification, prevention, evaluation, management, and monitoring of our critical enterprise risks. The risk oversight and sustainability committee is briefed by our Head of Global IT or counsel on a quarterly basis regarding cybersecurity risks and mitigation strategies. We continually invest in efforts to protect, monitor, and mitigate cybersecurity risks, including through our robust information security function, training and compliance programs, and regular employee training.

companyName: KADANT INC

ticker: KAI


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets, and our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include incident response plans designed to help coordinate our response to cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents. We seek to enhance our policies and practices to better protect our platform, adapt to changes in regulations, identify potential and emerging security risks and develop mitigations for those risks, including conducting cyber incident tabletop exercises with our management team.


text: We engage external parties, including consultants, network security firms and other experts, to help us assess and enhance our cybersecurity oversight. For example, we have hired an external security vendor to conduct penetration and vulnerability testing on our networks and receive regular updates about industry cyber risks.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third-party service providers provide us information about their security policies and procedures. We monitor security incidents involving our third-party providers and adjust our procedures as necessary.


text: We do not believe that there have been or are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our board of directors has delegated oversight of cybersecurity to the risk oversight and sustainability committee. The risk oversight and sustainability committee receives quarterly updates from management and provides feedback regarding cybersecurity, including updates regarding recent incidents in the industry and the cyber threat landscape, and is notified between such updates regarding significant new cybersecurity threats or incidents as necessary. The board of directors receives regular reports from the risk oversight and sustainability committee.


text: We have a Head of Global IT whose global information security team (IT Security Team) is responsible for leading organization-wide cybersecurity strategy, policy, standards and processes and works across relevant operating entities to assess and prepare us to address cybersecurity risks. Our Head of Global IT and IT Security Team perform due diligence on the IT security systems and processes of all potential acquisition targets, and newly acquired companies are not permitted access into our IT networks or systems until they have met the necessary security standards. The Head of Global IT's cybersecurity experience includes managing the network, infrastructure security and a cyber security team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government. In addition, our IT Security Team consists of employees that have security certifications from reputable cybersecurity training organizations, including CompTIA, and over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance.


text: We have also established a cross-functional Corporate Incident Response Team (CIRT) led by our General Counsel and consisting of various leaders, including our Head of Global IT, that is responsible for coordinating our response to cybersecurity incidents that present significant risk to us. The board of directors will be notified if the CIRT has been activated and provided periodic updates concerning the incident.


text: In an effort to deter and detect cyber threats, we require all employees who use an official company email account to conduct business to complete regular trainings on data protection, cybersecurity, incident response and prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks.


text: Cybersecurity is an important element of our overall enterprise risk management program. Like other global companies, we have experienced cybersecurity threats and incidents, although none to date have been material or had a material adverse effect on our business, results of operations or financial condition. We have a multilayered approach for assessing, identifying, evaluating, managing and monitoring risks related to cybersecurity threats, that is designed to help protect our information, systems, assets and operations from internal and external cybersecurity threats and help mitigate risks of cybersecurity incidents. We invest in efforts to protect, monitor, and mitigate risks from cybersecurity threats, including through our information security function, training and compliance programs, and regular employee training.


text: As part of our enterprise risk management program, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets, and our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include incident response plans designed to help coordinate our response to cybersecurity incidents. We seek to enhance our policies and practices, as appropriate, to adapt to changes in regulations and evolving cybersecurity risks, including by conducting cybersecurity incident tabletop exercises with our management team.


text: We engage external parties, including consultants, network security firms and other experts, to help us assess and enhance our cybersecurity oversight. For example, we have hired an external security vendor to conduct penetration and vulnerability testing on our networks and receive regular updates about cybersecurity risks in the industry.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and request that material third-party service providers provide us information about their security policies and procedures. We monitor cybersecurity incidents involving our third-party providers and adjust our procedures, as appropriate.


text: In an effort to deter and detect cybersecurity threats, we require all employees who use an official company email account to conduct business to complete regular data protection and cybersecurity trainings, which cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting potential incidents immediately. We also use technology-based tools to mitigate risks from cybersecurity threats.


text: As of the date of this filing, we do not believe that there currently are or have been any cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information on risks related to cybersecurity threats, please see Part I, Item 1A, "Risk Factors."


text: Our cybersecurity program is integrated with the enterprise risk management framework and governance processes utilized by management and our board to oversee enterprise risk. Our board of directors has delegated oversight of cybersecurity risk to the risk oversight and sustainability committee to assist in fulfilling its oversight responsibilities with respect to management's identification, prevention, evaluation, management, and monitoring of our critical enterprise risks. The risk oversight and sustainability committee receives quarterly updates from our Head of Global IT or counsel regarding cybersecurity, including updates regarding recent cybersecurity incidents in the industry and the cybersecurity threat landscape, and is notified between such updates regarding significant new cybersecurity incidents, as appropriate. The board of directors receives regular reports from the risk oversight and sustainability committee.


text: Our cybersecurity program is overseen by our Head of Global IT, who is responsible for identifying and managing material cybersecurity risks. Our Head of Global IT oversees our global information security team ( IT Security Team), which is responsible for leading organization-wide cybersecurity strategy, policy, standards and processes and works across relevant operating entities to assess and manage risks from cybersecurity threats. Our Head of Global IT and IT Security Team perform due diligence on the IT security systems and processes of all potential acquisition targets and have processes in place to manage post-acquisition network integration, including requiring all newly acquired companies to meet necessary security standards before they are permitted access into our IT networks or systems. The Head of Global IT's cybersecurity experience includes managing the network, infrastructure security and a cybersecurity team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government. In addition, our IT Security Team consists of employees that have security certifications from reputable cybersecurity training organizations, including CompTIA, and over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We believe these risks include, among other things, operational risks resulting in system disruption; intellectual property theft; fraud; extortion; harm to associates or customers including by way of inadvertent release of information; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We have invested in data security and privacy protections, and we follow what we believe to be industry-standard recommendations for data security. However, if we fail to properly assess and identify cybersecurity threats, we may become increasingly vulnerable to such risks.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: To identify and assess material risks from cybersecurity threats, our corporate risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our corporate risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including programs across identity and access management, training and awareness, threat management, cybersecurity operations, cybersecurity enablement, and cybersecurity data, host, and network security. This includes regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool. These standards are aligned to the National Institute of Standards and Technology ("NIST"), International Organization for Standardization, Center for Internet Security, and experts are engaged by us to evaluate the integrity of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To help us preserve the availability of critical data and systems, maintain regulatory compliance, and achieve our goal of managing our material risks from cybersecurity threats, and with an aim to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities: • Closely monitor emerging data protection laws and implement changes to our processes designed to comply with such data protection laws; • Undertake regular reviews of our policies and standards related to cybersecurity; • Proactively inform our customers of substantive changes related to customer data handling; • Conduct annual customer data handling and use requirements training for associates; • Conduct annual cybersecurity management and incident training for associates involved in our systems and processes that handle sensitive data; • Conduct regular cybersecurity training and awareness for all associates and all contractors with access to corporate systems; • Through policy, practice, and contract (as applicable) require associates, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • Maintain what we believe to be customary and appropriate third-party information security coverage for incident loss mitigation.


text: We also maintain an incident response plan designed to coordinate the activities we take with a goal to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with regulatory examiners, internal and external auditors, and other third-parties, as well as a regular review by both our technology risk management team and corporate risk management team to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also aim to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: As disclosed above, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. However, any failure in, or unauthorized access to, our information systems, as such term is defined in Item 106(a) of Regulation S-K, could disrupt our business, result in unintentional disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses, and have a material adverse effect on our business, financial condition, results of operations and prospects. Failures, interruptions, or data breaches involving our information systems, or the information systems of our vendors, could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations and prospects.


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. The expenses we have incurred from cybersecurity incidents, including the Vendor Incident have been immaterial to date. Nevertheless, we also believe risks from certain cybersecurity threats, including as a result of our previously disclosed Vendor Incident could potentially result in charges, settlements or other potential liabilities that could materially affect our business strategy, results of operations, and financial condition, depending on the outcome of pending lawsuits as discussed further below.


text: As previously disclosed, on June 21, 2023, our wholly-owned subsidiary Umpqua Bank was informed by one of its technology service providers (the "Vendor") that a widely reported security incident involving MOVEit, a filesharing software used globally by government agencies, enterprise corporations, and financial institutions, resulted in the unauthorized acquisition by a third-party of the names and social security numbers or tax identification numbers of certain of Umpqua Bank's consumer and small business customers (the "Vendor Incident"). Other than the information described above, no Umpqua Bank account information was compromised as a result of the Vendor Incident, and no information from Umpqua Bank's commercial customers was involved in the Vendor Incident. On June 22, 2023, Umpqua Bank sent an email to potentially affected consumer and small business customers informing them of the Vendor Incident. In August 2023, the Vendor, on behalf of Umpqua Bank, also sent notice via U.S. mail to the 429,252 Umpqua Bank customers whose information was involved in the Vendor Incident.


text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.


text: Separately and as previously disclosed, Umpqua Bank experienced an on-premises MOVEit security incident in May 2023. The on-premises instance was removed from the network immediately and decommissioned, and the unauthorized actor did not obtain any customer information or Umpqua Bank data. An independent forensics firm was engaged and confirmed our assessment of this on-premises MOVEit incident, which did not cause any interruption of business operations. We do not currently believe the on-premises incident will have a material adverse effect on our business, operations, or financial results.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Privacy and Information Risk Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. They also have several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Professional Hacker.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these members of management report to the ERMC about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Our processes also aim to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: As disclosed above, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. However, any failure in, or unauthorized access to, our information systems, as such term is defined in Item 106(a) of Regulation S-K, could disrupt our business, result in unintentional disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses, and have a material adverse effect on our business, financial condition, results of operations and prospects. Failures, interruptions, or data breaches involving our information systems, or the information systems of our vendors, could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations, and prospects.


text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment, and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations, or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Additionally, the Disclosure Committee periodically receives reports on cybersecurity threat risks to ensure that required disclosures are accurate and timely.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or consumers; violation of data privacy or data security laws and other litigation and legal risk; and reputational risks.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate risk, including reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • regular, mandatory cybersecurity training programs for relevant employees; • comparing our processes to standards set by the International Organization for Standardization ("ISO"); • leveraging the ISO information security incident management model to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • leveraging third-party threat intelligence services designed to model and research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • periodically reviewing our consumer facing policies and statements related to cybersecurity; • conducting regular phishing email simulations for relevant employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) requiring employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident. These approaches vary in maturity across the business and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.


text: We describe how risks associated with a potential cybersecurity incident are reasonably likely to materially affect us, including our business, results of operations and financial condition, under the heading "A significant information security or operational technology incident, including a cyberattack or a data breach, could disrupt our operations and adversely impact our operating results, cash flows and reputation," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management, including topics such as data security posture, results from third-party assessments, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Information Security Leadership Team, comprised of Chris Walter, our Chief Information Officer, Frank Madigan, our Vice President, Information Technology and Security and Kelvin James, our Senior Manager, Information Security (the "InfoSec Leadership Team").


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our InfoSec Leadership Team. The executives on this team have collectively over 60 years of prior work experience in the management of information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. In addition to their work experience, Mr. Madigan has a Master of Business Administration in Information Technology Management and Mr. James has a Master of Science in Information Security and Assurance.


text: The InfoSec Leadership Team is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.


text: As discussed above, the InfoSec Leadership Team reports about cybersecurity threat risks, among other cybersecurity related matters, to senior management and the Audit Committee, which provides updates to the full Board of Directors.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: We operate our segments and their practices through FTI Consulting and its subsidiaries in 31 countries with different business, client, and geographic cybersecurity risk profiles. We aim to proactively identify and assess our vulnerability to cybersecurity threats and actual cybersecurity incidents on an ongoing basis at both the enterprise level, as well as at a more operational level, differentiating unique risks related to our segments, practices, clients, employees, and the locations in which business is conducted. Our Information Technology Group ("ITG") closely monitors and analyzes cybersecurity incidents and risks and our progress mitigating and resolving such threats. This information is regularly discussed with our outside directors and executive management and other interested parties.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Cybersecurity risk is integrated and managed as part of our broader enterprise risk management program under the direction of our Vice President – Chief Risk and Compliance Officer – who works closely with our Chief Information Officer and others, including the Head of our Cybersecurity & Privacy division to identify, review, assess and address cybersecurity and other security risks. Our Chief Risk and Compliance Officer, Chief Information Officer and the Head of our Cybersecurity & Privacy division are members of the Company's cybersecurity response team (the "Cyber Response Team"). The Cyber Response Team's responsibilities include maintaining a Cybersecurity Incident Response Plan, which sets out a path for how cyber threats and incidents are identified and escalated up to and including the Board of Directors and other leadership, when appropriate. Direct threats are escalated promptly to the appropriate team, following a path that considers both the nature of the threat, the level of risk, and the degree to which it has been substantiated. Indirect threats, such as third-party incidents, are escalated through the ITG to the appropriate corporate functions, as the situation warrants.


text: Where appropriate, we engage reputable third-party vendors to provide cybersecurity-related services, including security monitoring, risk evaluations, penetration testing, audit, and incident response services, which are aligned with internationally accepted frameworks. Our vendors are selected based on specific due diligence activities, such as evaluations of controls, policies, and processes of such vendors for protecting data, and resolving incidents, as well as entering into written contracts with such vendors that include terms addressing data security, privacy, and incident response expectations, responsibilities and liabilities, and termination rights of the parties. We routinely monitor vendor performance, review compliance with contract terms, and address concerns.


text: Further, our Vendor Code of Conduct addresses our expectations with respect to data security. When our Procurement group processes a vendor relationship involving information systems, various groups will review the vendor and its systems for potential data security-related issues and risks associated with using the tools, technology, data processing and other services of such vendor. Our contracts include terms addressing the safeguarding of our data.