text: The Head of Information Security oversees the Information Security team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Information Security and our Information Security team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Information Security, who has over 20 years of information technology experience, including over 10 years in leadership roles at First Solar, reports to the Chief Information Officer and regularly briefs the Chief Financial Officer and, at least quarterly, briefs the audit committee of the board of directors on cybersecurity matters. Effective March 16, 2025, our Head of Information Security will be departing the Company and, as a result, our Chief Information Officer will act as our interim Head of Information Security while we conduct a search for a permanent replacement. Our Chief Information Officer has 25 years of information technology experience, including 18 years in leadership roles at First Solar.


text: The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar's major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of senior management from various departments, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.

companyName: FIRST SOLAR, INC.

ticker: FSLR

secItem: Item 1C


text: The Information Security team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar's Information Security team to protect our information technology environment. Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our Information Security team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar's incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.


text: As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations during the period covered by this filing. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, "Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations."


text: We recognize the critical importance of maintaining the trust and confidence of physicians, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by NIST and other applicable industry standards, as well as the HIPAA Security Rule and other recognized frameworks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EXAGEN INC.

ticker: XGN


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats in addition to other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President of Information Services.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as performing intrusion detection and prevention. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: b.through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: d.provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: e.conduct regular phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct monthly cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: g.leverage internal and external resources to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure in our information technology, telephone or other systems could significantly disrupt our operations and adversely affect our business and financial condition," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our Audit Committee to oversee risks from cybersecurity threats.


text: Upon detection of a material cybersecurity threat, our Audit Committee receives an update from management of the cybersecurity threat, risk management and strategy processes, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our Audit Committee and board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Information Services, with support from our entire Information Services department. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications. These Information Services team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these Information Services team members report to our Chief Executive Officer, and ultimately to the Audit Committee of our board of directors about material cybersecurity threats.


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: NOODLES & Co

ticker: NDLS


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 16 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Board receives updates from management and the Audit Committee on cybersecurity risks.


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 17 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Audit Committee also reviews reports from third party service providers and discusses the findings with management. The Board receives updates from management and the Audit Committee on cybersecurity risks.


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities, and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Information Security Acceptable Use Policy, which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident occur with the relevant security coordinator according to our Incident Response Procedures.


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Chief Information Security Officer ("CISO") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The CISO also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The CISO and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to President and Chief Executive Officer, while the CISO reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The CISO has over 10 years of industry experience including management of security and vendor relationships as well as possesses several industry certifications, including certification as a Certified Information Systems Security Professional from the International Information System Security Certification Consortium and as a Certified Information Security Manager from the Information Systems Audit and Control Association.


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third party service providers in the ordinary course of business, including to assist us in performing information security assessments for third party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our CISO oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives quarterly updates from the CISO regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding the risk we face from cybersecurity threats, see the risk factor entitled "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation, damage to our reputation, and other potential losses." included in Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities; and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company, including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Director of Information Security ("DIS") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond to, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The DIS also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The DIS and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program; coordinating or contributing to reviews, audits, risk assessments, and other risk management material; development of departmental policies and procedures for board approval; and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships. The DIS also possesses several industry certifications, including certification as a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.


text: With the approval of the Audit Committee, we also engage third-party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third-party service providers in the ordinary course of business, including to assist us in performing information security assessments for third-party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third-party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our DIS oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives quarterly updates from the DIS regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the Bank is subject to SEC rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."


text: We have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: Our cybersecurity risk management program includes: • dedicated third-party cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents; • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required); • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident; • annual information security training program for all employees, including phishing awareness training; • working closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology; • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing; and • a third-party risk assessment process for service providers, suppliers, and vendors.


text: Risks from cybersecurity threats are integrated into AngioDynamics' enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, A cyber-attack or other breach of our, our distributors, or our supply chain partners' information technology systems could have a material adverse effect on our business, financial condition and/or results of operations.


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes. Our SVP of IT also leads the Security & Risk Governance committee which provides general oversight and assists in the Cybersecurity program when appropriate.


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Board of Directors receives regular updates on the Company's cybersecurity risk management program from the SVP of IT.


text: Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: As part of our strategy, we also leverage reputable third-party service providers to implement and maintain processes and controls to manage identified risks. We perform rigorous due diligence before onboarding and engage in ongoing monitoring of all third parties with access to our information assets to ensure such parties maintain adequate security controls. Our security practices also include continuous threat monitoring and detection services as well as vulnerability and patch management process to ensure systems are hardened to further protect our critical information assets.


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications, and frequent phishing awareness campaigns.


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Oversight of cybersecurity matters is the responsibility of the Risk & Compliance Committee, which is a board committee, with oversight from the Board of Directors.


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity and potential mitigations.


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications and frequent phishing awareness campaigns.


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Security Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Security Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program.

companyName: BLACKBAUD INC

ticker: BLKB


text: 1.Operational security: We leverage the industry standard CIA Triad Model in conjunction with comprehensive industry control frameworks, compliance regulations, privacy requirements and best practices, including: the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, PCI DSS, System and Organization Controls ("SOC") 1, SOC 2, GDPR, HIPAA, the Trans-Atlantic Data Privacy Framework and Cloud Security Alliance.


text: 2.Product security: Our development teams take part in regular training and use industry best practices to build security into our solutions.


text: 3.Incident response: We monitor the threat landscape 24/7 in coordination with a third-party firm, routinely test our incident response capabilities and preparedness and maintain proactive relationships with law enforcement.


text: 4.Ongoing landscape analysis: We continually evaluate upcoming and changing data privacy regulations and provide thought leadership for our customers on the operational impacts of these regulations and compliance requirements.


text: We believe that information and technology security is a shared responsibility and, therefore, incorporate data and privacy protection education into the customer experience through ongoing resources such as best practices content, one-on-one consultations with customer success managers and bbcon sessions. We also participate in global communities and conference platforms to share information and present on best practices to improve the industry's security awareness posture. In addition, Blackbaud employees are all engaged in on-going security and privacy awareness training campaigns to ensure they are empowered to protect both Blackbaud's and our customers' data.


text: Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.


text: We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts.


text: Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company.


text: In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings, claims and investigations and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this Annual Report on Form 10-K for additional information regarding the Security Incident and its past and potential impact on the Company.


text: Notwithstanding our strong commitment to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and Chief Information Security Officer ("CISO"), who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight.


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, Chief Information Security Officer, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud. Blackbaud, Inc.


text: Overview of Processes for Assessing, Identifying and Managing Material Cyber Risks Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program. Our cybersecurity program has been and will continue to be further enhanced by our compliance with the settlement of governmental investigations relating to the Security Incident. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident.


text: Integration into Overall Risk Management System or Processes Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company. Our enterprise risk management ("ERM") framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall strategy. Additionally, our cybersecurity program is further integrated with our overall risk management program through our Chief Information Security Officer's ("CISO") participation in such governance structures as our Risk Steering Committee and our Disclosure Committee, both of which are described in detail below.


text: Engagement of Third Parties We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts. Blackbaud, Inc.


text: Risks from Third-Party Service Providers and Others Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.


text: Risks from Cybersecurity Threats; Actual and Potential Material Impact In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings and claims and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident and its past and potential impact on the Company.


text: Management's Assessment and Management of Cybersecurity Threats Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and CISO, who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, CISO, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud.


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight. Blackbaud, Inc.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IMMUNIC, INC.

ticker: IMUX


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Head of IT who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Executive Officer and General Counsel oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Executive Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our internal information technology ("IT") team who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from our internal information technology team.


text: Our Chief Executive Officer provides periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer and the Director of Information Technology, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our legal, operations, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer, the Director of Information Technology and third-party cybersecurity experts, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with legal, operations, information technology, and/or compliance personnel.


text: Risk Identification and Assessment. Regions devotes significant financial and non-financial resources to identify and mitigate threats to the confidentiality, availability and integrity of its information systems. As more fully described below, the Regions IS Program's controls and risk management practices are designed to prevent and detect cybersecurity threats in order to reduce the likelihood that they materially affect Regions' business strategy, operations, or financial condition.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions will continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are competed to ensure optimal delivery and to denote material changes in the engagement.


text: As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attack or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. The Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack as well as topics including fraud.


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves the Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the information security program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: Cybersecurity Incidents. In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the Technology Risks in Item 1A. "Risk Factors".


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions is aiming to continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are completed to to denote material changes in the engagement.


text: As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attacks or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. Regions' Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education at least annually. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack.


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves Regions' Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the IS Program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging or risk or material issue.


text: Our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations, has primary responsibility for our IS Program.


text: Cybersecurity Incidents. We have not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the "Technology Risks" discussion within in Item 1. "Risk Factors".


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.

companyName: NEWMARKET CORP

ticker: NEU


text: Additionally, we have established protective measures for the forensic analysis of cyber incidents. While we are proactive in our efforts to mitigate these threats through robust security processes and disaster recovery plans, the evolving nature of cybersecurity threats means that our systems may not always be able to identify or protect against a threat promptly or at all. As a result, there is a continuous risk of potential financial, legal, business, and reputational damage to our company stemming from cybersecurity threats.


text: We employ a number of people who are part of our Information Technology group and are dedicated to and responsible for assessing and managing cybersecurity threats. Our Information Technology Director, who has over 25 years of experience in information security serving in roles of increasing responsibility, works with our cybersecurity employees to set priorities and is responsible for cybersecurity oversight and the escalation of incidents with business impact to senior leadership based on our Information Security Incident Management Policy.


text: We utilize specialized third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external cybersecurity experts and vendors to augment our internal security team. Through these third-party services, our detection capabilities include, but are not limited, to, real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide real-time alerts, log aggregation, and threat intelligence feeds, which are integrated into our incident response platform.


text: Additionally, we engage third-parties to conduct independent assessments of our cybersecurity posture that evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Third-party service providers are integral to our business operations and are incorporated into our enterprise-wide risk management program, which subjects the providers to rigorous vetting processes and ongoing oversight. We use specialized monitoring tools that evaluate the cybersecurity posture of our third-party providers using a cybersecurity scorecard. This allows us to continually assess the cybersecurity risk levels associated with these external partners.


text: Our approach to managing cybersecurity risks (including third-party risk) is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the operational risks section for more information. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: The Board of Directors oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the Board on our cybersecurity risk profile, emerging threats, and the efficacy of our risk mitigation strategies, including our continuous improvement initiatives. These initiatives aim to enhance the resiliency of our cybersecurity program as well as our broader operational risk management strategies.


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.


text: Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings at the NCG Committee providing insights from the compliance perspective relating to cybersecurity.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: Our management also conducts a quarterly enterprise-wide risk assessment that considers a wide spectrum of risks facing the Company, including cybersecurity. Through these quarterly risk assessments, management informs the Audit Committee on the cyber risk landscape facing the Company and the Company's preparedness to manage such risk. The enterprise-wide risk assessment is a top-down risk assessment that leverages the assessments performed by cyber risk management.


text: Engagement with External Experts The Company engages top-tier external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities (including staff enhancement of certain functions) and transformation to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.


text: Oversight of Third-Party Service Providers Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. Our third-party risk management program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the NCG Committee, the Audit Committee and our internal Enterprise Risk & Compliance Committee. Our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out by our third-party service providers.