text: After becoming aware of a potential cybersecurity incident, our IT Service Desk reports the incident and any pertinent information to our CISO. Our IT Service Desk is the central point of contact for reporting computer incidents or intrusions.


text: The CISO then conducts a preliminary analysis of the incident and determines whether activating the full IRT is warranted. Types of incidents that would generally require the activation of our IRT include but are not limited to a breach of personal information, a denial-of-service (DoS) or distributed DoS attack, excessive port scans, a firewall breach, or a virus or malware outbreak.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC

secItem: Item 1C


text: If the type of incident or the threat created by the incident necessitates a full-scale response by the IRT, the CISO notifies a team of network and security engineers, security analysts, and Windows / Unix / Linux systems administrators (collectively, the IT Security and Engineering Teams).


text: At the CISO's direction, the IT Security and Engineering Teams gather intel regarding the incident and take pre-planned steps to mitigate harm, address system weaknesses, and block ongoing threats. For example, our network engineers analyze network traffic for external attacks, search for signs of a firewall breach, and take action to block a suspected intruder's network traffic; our security analysts and engineers look for indications of an attack or suspicious activity by monitoring and reviewing the network activity of our business applications and the audit logs of our mission-critical servers; and our systems administrators examine system logs of our critical systems for any abnormal activity, confirm our mission-critical computers are up to date on all service packs and patches, and ensure backups have been created for our critical systems. The CISO reports the incident to our executive management team, Service Center Board, and SCC.


text: Our CISO, executive management team, Service Center Board, and SCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.


text: Procedures Governing our Third-Party Vendor Relationships. Similar to our governance approach with respect to responding to cybersecurity incidents, we have implemented a layered, collaborative governance system to manage our third-party vendor relationships and to implement our Vendor Management Policy. Prior to working with any vendor, we conduct a comprehensive security screening to evaluate the vendor's security protocols and identify any potential vulnerabilities that could compromise our sensitive data. At least annually, we also perform a security assessment of the vendor to identify any change in the vendor's security posture that may negatively impact the security of our information systems. Our CISO or other designated IS personnel oversees and makes a final recommendation regarding the vendor security assessments, determines the necessity of vendor site visits, and coordinates and provides a final report on any site visit that occurs. Our vendor relationships are monitored by our Vendor Management Department, the day-to-day operations of which are led by our Vendor Manager. In coordination with the applicable Business Unit Manager, the Vendor Manager categorizes and ranks the risks presented by our vendors, performs vendor due diligence, and provides periodic reports to our Board and Risk Committee concerning vendor risk management. Before entering into any vendor contract, the Business Unit Manager that will be contracting for the vendor's service or product must perform a thorough risk evaluation. In addition to working alongside the Vendor Manager to categorize and rank vendor risks, the Business Unit Manager participates in contract review and negotiations, establishes performance-monitoring controls, and completes vendor reviews. The CISO or other designated IS personnel may participate with the Business Unit Manager in contract negotiations as needed.


text: Procedures Governing our Corporate Account Takeover Responses. Like our approaches to responding to cybersecurity incidents and managing our vendor relationships, our strategy for managing corporate account takeover (CATO) threats integrates organizational operations at multiple governance levels involving our Board, executive management team, members of our Senior Management of Electronic Banking Services (EBS Management Team), an Electronic Banking Services Manager (EBS Manager), and our CISO. Our Board reviews our CATO Policy for compliance with the Texas Department of Banking standards for the risk management of CATOs and charges our EBS Management Team with the responsibility of determining necessary courses of action to ensure adherence to applicable guidance and regulations. Our EBS Management Team also ensures that our CATO Policy is understood and complied with across all of our operational divisions. Some of the responsibilities of our EBS Manager include developing, implementing, and maintaining policies and procedures to comply with our CATO Policy, coordinating the performance of period risk assessments of IBC Link, our online banking product, establishing trainings for IBC Link customers regarding security controls that mitigate CATO risks, reporting CATO incidents to executive management, and coordinating with our management team and IBC Link customers if an actual or threatened CATO attack is identified. Our CISO is responsible for ensuring appropriate security controls are implemented to prevent, detect, and respond to CATOs, establishing incident-response procedures to be employed if a CATO threat is in progress, and timely notifying our primary federal regulator of any CATO incidents that are required to be disclosed to comply with applicable laws, regulations, and CATO Policy procedures.


text: Notwithstanding the robust nature of our defensive measures and security processes and the multi-layered governance system that we have established to mitigate, monitor, analyze, and respond to incidents, cybersecurity threats are increasingly difficult to detect, and the risk of a data breach or cyber-attack is pervasive and severe. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks, stay apprised of changes in the cyber environment, and invest in strengthening our cybersecurity infrastructure. For additional information on our risks related to cybersecurity, please see "Risk Factors—Risks Related to Our Business— Our information systems may experience an interruption or breach in security."


text: Risk Management and Strategy Liberty Broadband's corporate level Information Technology ("IT") and cybersecurity functions are provided by Liberty as part of the services agreement described in Part I, Item 1. "Business." Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter's cybersecurity functions rests with its board of directors and Audit Committee.


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the NIST CSF.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at GCI. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see Part I, Item 1A. "Risk Factors" under the section entitled "Cyberattacks or other network disruptions could have an adverse effect on our company and GCI's business" in this Annual Report on Form 10-K.


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with Liberty discussed in Part I, Item 1. "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: At GCI, there is an Enterprise Security Office ("ESO"), led by the Chief Information Security Officer ("CISO"), which is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The CISO provides regular reporting to GCI executive management and the ISSC.


text: Liberty Broadband has also established a Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at GCI, including cybersecurity. The Compliance Committee is composed of members of Liberty Broadband's ISSC as well as GCI's executive leadership team, including the President & Chief Operating Officer, General Counsel, and Chief Financial Officer. The CISO reports periodically to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. GCI's CISO has more than 20 years of experience and hold multiple certifications including Certified Information Security Systems Professional and Certified in Risk and Information System Control. Both have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.


text: We have designed and implemented processes to assess, identify, manage, detect, and respond to material cybersecurity risks and threats to our IT systems, including the prevention, detection, mitigation, and remediation of cybersecurity incidents in order to protect the confidentiality, integrity, and availability of our IT systems and the information residing on those systems. These processes are part of our overall risk management process and are embedded in our operating policies, procedures, and controls.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: To protect our IT systems and information from cybersecurity risks, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools. We also utilize a third-party security operations center connected to a networks operation center to identify, investigate, and resolve any cybersecurity threats and incidents.


text: We regularly assess technological risks to our IT systems and information and monitor our IT systems for potential vulnerabilities and risks. We frequently conduct mandatory cybersecurity and IT systems awareness training for all employees with access to our systems. We also conduct regular reviews and tests of our IT cybersecurity processes, including reviews, assessments, and exercises.


text: We aim to incorporate responsible practices throughout our cybersecurity risk management processes. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engage independent third-party specialists to review our cybersecurity environment, including formal reviews and assessments, and we request specific, actionable recommendations for improvement.


text: While we have not, as of the date of this Report on Form 10-K, experienced a cybersecurity threat or incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our mining and manufacturing operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes through regular reviews and assessments, to provide incident response assistance and expertise, and to provide a level of financial protection in the event of cybersecurity incident related costs and losses. See "Risk Factors - We may be adversely affected by any disruption in, or failure of, our information technology systems, including due to cybersecurity risks and incidents."


text: Our Manager of Information Technology ("MIT") is responsible for our IT cybersecurity policies, procedures, and controls and reports to our Chief Financial Officer ("CFO"). Our MIT has a Bachelor of Business Administration degree in management information systems and has over 20 years of relevant experience in the IT field. Team members also include third-party service providers who have relevant education and experience in cybersecurity.


text: Our CFO is informed about and coordinates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our C EO and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our MIT regularly reports to and reviews our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.


text: We maintain a cybersecurity program designed to assess, identify, and mitigate risks from cybersecurity threats. This program is informed by the five elements of the National Institute of Standards and Technology framework: identify, protect, detect, respond, and recover. We utilize various methods to achieve these objectives including but not limited to company-wide policies and operating procedures, periodic testing, systems monitoring, patch management, and mandatory ongoing employee trainings. Additionally, we partner with third-party experts to conduct periodic penetration tests and to evaluate our information technology infrastructure for vulnerabilities. We also evaluate cybersecurity risks associated with third-party vendors that provide the hosted applications we use in our financial close process through review of their System and Organization Controls ("SOC") 1 reports at least annually. We continue to invest in our information technology infrastructure and cybersecurity program to strengthen our ability to protect the confidentiality, integrity, and availability of our data and the security of our information systems. In addition to our cybersecurity program, we assess cybersecurity risks as part of our overall risk management processes, primarily through our annual Enterprise Risk Assessment. Our Enterprise Risk Assessment surveys various employees and leaders throughout our organization with the goal of evaluating our risk landscape, enhancing our overall understanding of risks to our business, and ultimately managing and/or mitigating identified risks. We assess various risks, including cybersecurity related risks, based on the likelihood of an incident occurring, impact to our organization if an incident occurred, and the level of internal control we currently have over the risk. The results are analyzed to identify vulnerabilities and then risk management/mitigation plans are designed, implemented, and evaluated for effectiveness.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: In the event of a cybersecurity incident, we maintain an incident response plan in an effort to contain and mitigate the threat. As part of our incident response plan, our Cybersecurity Incident Response Team (a cross-functional taskforce comprised of senior representatives), is responsible for convening to assess the potential impact to our business, including financial reporting requirements and legal implications.


text: We, like other companies in our industry, face a number of cybersecurity risks, including cybersecurity incidents, in connection with our business. Although such risks and incidents have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors."


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board administers this oversight function directly through our Board as a whole, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. Our Audit Committee, a subcommittee of our Board, is responsible for the oversight of risks from cybersecurity threats. The Audit Committee receives updates at least quarterly from our Head of Information Technology regarding developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, how management is managing those risks, and, if any, material cybersecurity incidents and the impact to our business and performance.


text: At the management level, our Head of Information Technology is responsible for assessing and managing risks from cybersecurity threats through oversight of our information technology infrastructure and cybersecurity program. The individual occupying this role has over 20 years of experience in information technology and cybersecurity and has served in senior cybersecurity leadership positions for over 10 years. Our Head of Information Technology conducts bi-weekly meetings with our information technology department to remain apprised of cybersecurity matters. In the event of a cybersecurity incident, our Head of Information Technology may inform our Executive Vice President and Head of Technological Operations and/or Audit Committee, depending on the severity of the incident in accordance with the established severity and response matrix as defined in our incident response plan.


text: Cybersecurity risk management is an integral part of Payoneer's control infrastructure and is included as an overall risk in our enterprise risk management program. Payoneer's cybersecurity risk management program is designed to align with industry best practices like National Institute of Standards and Technology ("NIST") and Control Objectives for Information Technology ("COBIT") which help provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Risk Committee of the Board of Directors (the "Risk Committee") of material cybersecurity threats and incidents. Our cybersecurity team is responsible for assessing our cybersecurity risk management program considering industry best practice and aligning to regulatory requirements and engages with third-party security experts for advisement on cybersecurity risk assessments and system enhancements. In addition, our cybersecurity team provides training to employees on a periodic basis.

companyName: Payoneer Global Inc.

ticker: PAYO


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Risk Committee. The Risk Committee is responsible for reviewing our cybersecurity and the protection of data integrity policies and practices, including making recommendations for improvements in these areas. The Risk Committee oversees that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Risk Committee also reports material cybersecurity risks to our Audit Committee, as the case may be, and material cybersecurity incidents would be reported to the full Board of Directors by management and/or the Risk Committee.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored and escalated appropriately, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Our CISO has more than 25 years of experience in various roles related to information security and technology, including 14 years as CISO and other leading cyber security roles in the fintech industry. Management, the CISO and our cybersecurity team, periodically update the Risk Committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors" in this Annual Report on Form 10-K.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We operate in an increasingly interconnected digital landscape and we recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. In the normal course of business, we may collect and store certain sensitive information, including proprietary and confidential business information, intellectual property, sensitive third-party information, employee information and other personal information. We rely on our own information systems and third-party information systems for the management of this information in addition to our management of business processes including inventory, payment of obligations, collection of cash, human capital management, financial tools and other processes and procedures. Our ability to manage our business effectively depends on the reliability, security and capacity of these systems. We seek to address these risks by safeguarding assets, data, and operations through the cybersecurity risk management processes described below: Risk Assessment:

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Regular assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities. These assessments include penetration testing, vulnerability scanning, and red teaming exercises conducted by third-party service providers, which help us to evaluate the likelihood and potential impact of cybersecurity incidents. Feedback from these assessments is incorporated into our systems and procedures through upgrades intended to further improve our security posture.


text: A monitoring and detection system has been implemented to help identify cybersecurity incidents. The IT Security Department is tasked with monitoring certain network activities, logs, and system behavior, leveraging threat detection technologies. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to follow industry best practices and aligns with legal and regulatory requirements. This plan is designed to provide for immediate action to contain the incident, mitigate the impact, and restore normal operations efficiently.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees receive training on recognizing and reporting potential cybersecurity threats, best practices for data protection, and adhering to cybersecurity policies and procedures. Additionally, periodic simulated phishing exercises are conducted to enhance employee readiness in identifying and mitigating phishing attacks.


text: Access control policies have been implemented to limit unauthorized access to sensitive information and we seek to maintain and monitor critical systems. Multi-factor authentication is used for remote access, use of privileged accounts and access to critical systems.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.


text: The above cybersecurity risk management processes are integrated into the Partnership's overall risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered an important component of our enterprise-wide risk management approach. We have assembled a Cybersecurity Steering Committee comprised of IT management, cybersecurity specialists, and representatives of business management, including the CTO and internal legal counsel. The Cybersecurity Steering Committee reviews information security policies and cybersecurity risks in conjunction with other operational, financial, and strategic risks to ensure alignment with our business objectives. The Cybersecurity Steering Committee convenes regularly to review and monitor the Partnership's programs for the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Cybersecurity Steering Committee receives reports on security incidents, threat intelligence, and vulnerability assessments from our IT Security Department.


text: The Cybersecurity Steering Committee regularly reports to the CFO through the CTO and reports annually on cybersecurity to the Audit Committee during a scheduled meeting. These reports include, as appropriate, updates on the current cybersecurity landscape, incident trends, and any significant developments that may impact the Partnership's security posture.


text: To enhance the effectiveness of our cybersecurity program, we periodically engage external assessors, consultants, and auditors. These third-party service providers conduct independent evaluations of our cybersecurity measures, helping to identify areas for improvement and adherence to industry standards and best practices.


text: Our IT Security Department recognizes that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process designed to assess and oversee the cybersecurity practices of our vendors. Before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.


text: Impact of Risks from Cybersecurity Threats The energy industry increasingly depends on information and operational technology to sustain critical functions. However, the rise in cybersecurity incidents, whether caused by deliberate attacks or accidental events, poses substantial challenges. As these threats grow in complexity and scale, the industry's efforts to prevent, detect, mitigate, and remediate such incidents become progressively more demanding and complex.


text: During 2024 and through the date of this Annual Report on Form 10-K, though the Partnership and our service providers may have experienced cybersecurity incidents, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Partnership, including our business strategy, result of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our IT Security Department aims to monitor and assess these risks to maintain the security and continuity of our operations. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. Please see "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Board of Directors oversees risks from cybersecurity threats. Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, the Audit Committee and the Board of Directors hold discussions with management, including the CTO on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures annually and as needed during both scheduled and special meetings. If new material cybersecurity risks arise, the Board of Directors and the Audit Committee are informed through regular discussions between the CFO and both the Chairman of the Board and the Audit Committee Chair. These discussions are then brought to the attention of the Board of Directors and Audit Committee at the next meeting.


text: Management's Role and Expertise The CTO and the Cybersecurity Steering Committee are responsible for overseeing and executing our cybersecurity strategy, including the assessment and management of cybersecurity risks. The CTO reports directly to the CFO and maintains communication with the Audit Committee, the Board of Directors and the Cybersecurity Steering Committee with respect to information security and cybersecurity matters.


text: The CTO holds a Master of Business Administration from the University of Kentucky/University of Louisville's joint executive program and has an extensive background in information security, risk management, and incident response with over twenty years of varying information technology roles with increasing responsibility at both private and public companies. The CTO is supported by a dedicated team of cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Reliance has implemented processes for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into the Company's overall enterprise risk management systems and processes. The Company's cybersecurity risk program is largely based on the U.S. National Institute for Standards and Technology ("NIST") cybersecurity framework and other applicable industry frameworks. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and containment. The Company has also engaged third parties in connection with the assessment and advancement of its cybersecurity risk management processes. We undertake regular vulnerability scanning, periodic penetration testing and maturity assessments with the support of third parties; vulnerabilities are subsequently addressed based on risk/benefit analyses.

companyName: RELIANCE, INC.

ticker: RS


text: To support our preparedness, we have constituted a Cybersecurity Review Committee ("CRC") and adopted a written incident response plan ("IRP"). The CRC is comprised of cross-functional personnel including Reliance's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO"), General Counsel and Vice President, Enterprise Risk. In the event of a cybersecurity incident, our CRC refers to our IRP and existing management internal controls processes. Pursuant to these prescribed processes, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon reporting obligations, escalating information about the incident to senior management and potentially representatives from the Board, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises to test our incident response procedures, identify cybersecurity gaps and vulnerabilities and improvement opportunities and exercise team preparedness.


text: Reliance mandates regular cybersecurity training for employees and applicable contractors designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training covers various cyberattack methodologies, including insider attacks, phishing and other forms of social engineering, and other email attacks, malware attacks, data protection, data handling, password protections, cloud and internet security and cybersecurity fundamentals for mobile devices. We take a risk-based approach with respect to our use and oversight of third-party service providers, using a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors, and negotiating for cybersecurity-related terms in vendor agreements as appropriate. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.


text: Cybersecurity Risks Like other complex corporations, Reliance is the target of cyber-attacks from time to time, which have to date been immaterial individually and in the aggregate to our business strategy, results of operations or financial condition. There can be no assurance that any future cybersecurity incidents will not be material to our business. For additional information about risks related to cybersecurity, please see the risk factor set forth under the caption Item 1A. "Risk Factors" the Risk Factor captioned " We rely on information management systems and any damage, interruption or compromise of our information technology management systems, networks or data could disrupt and harm our business."


text: Roles and Responsibilities Cybersecurity is an important element of our risk management processes and an area of particular focus for Reliance's Board of Directors and management. The Company's CIO serves as single point of communication and coordination for protecting the Company and its digital information. The CIO performs an initial assessment of each reported cyber incident and escalates all non-trivial cybersecurity incidents and risks to the CRC. The CRC is primarily responsible for assessing and managing material risks from cybersecurity threats and is comprised of a cross-functional team including the CIO, as well as senior representatives from the Company's risk management, finance and legal functions. The CIO has 15 years of experience in managing of cybersecurity.


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the enterprise risk management processes and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management processes.


text: The Board has designated the Audit Committee to be responsible for oversight of cybersecurity risk. The Audit Committee receives regular reports from the CRC and the CIO that may discuss topics such as prior assessments, cybersecurity trends, prior cybersecurity events, and planned enhancements. In addition, the Audit Committee also receives regular periodic reports regarding information technology general controls in connection with its oversight of internal control over financial reporting. The Chair of the Audit Committee regularly briefs the Board on these matters.


text: Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to our tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data"). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework. Cybersecurity risks are assessed and managed alongside other material risks, including financial, operational, legal, and strategic risks, to ensure a comprehensive approach to risk oversight.


text: We rely on our management and third-party service providers, as described further below, to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Attacks are increasingly sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Accordingly, risks related to a cybersecurity event, including litigation and enforcement risks, are elevated due to the dynamic nature and sophistication and frequency of these threats.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Brent Winn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Winn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2020. Mr. Winn currently oversees key functions for our company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Winn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any material cybersecurity incidents to our Board.


text: Our cybersecurity efforts are managed through third-party service providers and third-party software providers who will notify Mr. Winn of a significant cybersecurity incident report that details the nature of the incident, the measures taken to mitigate its impact, and the steps implemented to remediate the situation. We receive periodic summary reports from our providers that outline emerging threats, trends, and the overall effectiveness of our current cybersecurity controls. These processes ensure that Mr. Winn remains actively informed and engaged in overseeing the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls in an effort to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, at least annually and more frequently as necessary due to business changes or external changes, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes aimed at providing for the availability of critical data and systems, maintaining regulatory compliance, identifying and managing our risks from cybersecurity threats, and protecting against, detecting, and responding to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework (however, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business); use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;


text: proactively inform our customers of substantive changes related to customer data handling through disclosures in our SOC 2 Type 2 report or other contractually mandated disclosures; conduct annual cybersecurity training for employees and contractors with access to PDF systems and sensitive data; conduct incident management training and practice for individuals with responsibilities responding to a cyber incident;


text: conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; use findings and root cause analysis of cybersecurity incidents to improve our cybersecurity processes and technologies;


text: maintain technologies designed to provide network and endpoint monitoring, regular vulnerability assessments, and annual penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident;


text: maintain an employee handbook, Code of Conduct, and Acceptable Use policy that makes clear the importance of cybersecurity and protection of PDF and customer intellectual property; and our incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage. We regularly exercise and update the plan after actual incident responses or simulated incident response scenarios.


text: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third-party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or to our systems. Third-party risks are included within our broader overall risk assessment and management process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers during vendor onboarding and during periodic reviews. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and regularly monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or independent information security assessments or certifications. Additionally, we have processes designed to monitor public and federal government database and other sources for evidence of known and/or exploited vulnerabilities in third-party services including those provided as SaaS and we take action to remediate or establish compensating controls if those systems are determined to be critical to our cybersecurity. We also maintain disaster recovery plans in place for all mission critical parts of the business, although we do not have a business continuity plan developed to account for all continuity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We, and our third-party service providers, are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incident; if we or our third-party providers fail to protect confidential information and/or experience a cyber incident, there may be damage to our brand and reputation, material financial penalties, and legal liability." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not identified any known cybersecurity threats including as a result of any prior cybersecurity incidents, that have materially impacted us, including the expenses we have incurred from cybersecurity incidents that were immaterial. This includes penalties and settlements, of which there were none. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors, who views our focus in these areas as essential for the success of our company and the broader technology industry in which we operate. As described in the Audit Committee Charter of the Board of Directors, the Audit Committee is tasked with oversight of certain risk issues, including cybersecurity. The Audit Committee is comprised entirely of independent directors, two of whom have significant work experience related to information security issues or oversight. Management reports high severity security incidents to the Audit Committee after they are discovered. Additionally, management provides a summary four times per year of all security incidents to the Audit Committee. The full Board of Directors is also provided an annual assessment of our security program, our internal response preparedness, and assessments led by outside assessors and auditors.


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and information security processes and business policies impacting our overall cybersecurity risk.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Operations and a cross section of subject matter experts from Information Technology, Exensio Cloud Operations and Corporate Legal and team. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, data privacy risks and regulatory frameworks, developing cybersecurity strategy, implementing effective information and cybersecurity programs and experience in security controls testing and the planning and executing of independent cybersecurity assessments.


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Network Security.


text: The Vice President of Operations and Executive Vice President of Products and Solutions are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.


text: Our cybersecurity risk management initiative is a cornerstone of our information security program, which includes a cross-functional management team with representatives from Legal, Enterprise Risk Management, Information Security, Information Technology, and Engineering. The cybersecurity risk management work is directed by the Enterprise Risk Management Team in collaboration with the Information Security Team and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program includes a cybersecurity incident response plan and playbook.

companyName: Vertex, Inc.

ticker: VERX


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management initiative is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management initiative includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a risk management team responsible for managing our cybersecurity risk assessment processes and acts as a check and balance on our information security team which is responsible for maintaining, monitoring, and updating our security controls as well as managing our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan and playbook that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A."Risk Factors – We are exposed to cybersecurity and data privacy risks that, if realized, could expose us to legal liability, damage our reputation, and harm our business."


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our General Counsel, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Chief Operating Officer and General Counsel manage the cybersecurity risk management program. The Vertex Executive Leadership Team has oversight over their management and the program. Our Chief Operating Officer is responsible for managing and mitigating our material risks from cybersecurity threats. His team of information security professionals manage our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Operating Officer has over twenty-five years of leadership experience in global business operations, including information security and compliance. Our General Counsel has overall management responsibility of cybersecurity risks. His team of attorneys and certified risk professional assess cybersecurity risks, assist the information security team with mitigating identified risks, and aligns the management of cybersecurity risks with the management of enterprise risks. Our General Counsel's experience includes over twenty years in positions of leadership in global organizations supervising compliance and risk professionals.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing where possible, and mitigating cybersecurity threats, and responding to security incidents when they occur. We also maintain controls and procedures that enable prompt escalation of certain cybersecurity incidents so decisions about public disclosure and reporting of such incidents can be timely made.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: The Company relies on a comprehensive Enterprise Risk Management ("ERM") program, which includes cybersecurity as an important component. Our cybersecurity program is focused on the following key areas:


text: Risk Assessment and Remedial Measures. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting security controls to address such risks.


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the specific systems, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring using security information and event management (SIEM), multi-factor authentication (MFA), vulnerability and patch management, third-party dark web monitoring and threat-intelligence services.


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. The testing conducted by our in-house security teams includes audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. Individual controls are evaluated and periodically improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Company's Chief Security Officer ("CSO") works collaboratively across the Company with other members of TTEC's leadership team to implement cybersecurity programs designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.


text: Third-Party Risks. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents, among other events that require resilient response. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.


text: The Company requires employees to complete periodic mandatory training on cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks. The full impact of security events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's CSO (who maintains chief information security officer ("CISO") responsibilities at TTEC among other responsibilities), Chief Information Officer ("CIO"), the Chief Privacy Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee of the Board receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, and the steps the Company is taking to address the security risks, among other relevant information, and shares information with the full Board as appropriate. The Board also has access to and periodically meets with the Company's CSO, CIO, and Chief Legal & Risk Officer about the approaches and progress that the Company is making on its cybersecurity risk management priorities.


text: The Board and the Security & Technology Committee also receive prompt information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed.


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.


text: Our CIO holds an undergraduate degree in Computer and Electrical Engineering and has served in various roles in information technology for over 25 years, including serving as either the chief technology officer or chief information officer for two large public companies and a technology start-up.


text: The Company has previously experienced significant cybersecurity incidents. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical studies, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The cybersecurity function within the Company helps identify, assess and manage the Company's cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments and applicable reports.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: Confidentiality agreements with employees and third-parties may not prevent unauthorized disclosure of trade secrets and other proprietary information;


text: The adoption and deployment of AI in our, and any third-party collaborators' operations, and in particular our and any third-party collaborators' R&D efforts to explore new targets and develop effective products, may not be effective and may expose us to risk;


text: If our information technology systems or data, or those of third-parties upon which we rely, are or were compromised or experienced significant disruptions of our information technology systems or data security incidents, we could experience adverse consequences including but not limited to significant financial, legal, regulatory, business and reputational harm; litigation; fines and penalties;


text: disruptions of our business operations; loss of revenue or profits; loss of customers or sales; or other adverse consequences; and We rely on trade secret and proprietary know-how which can be difficult to trace and enforce and, if we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Internal Controls and SOX Compliance, who has over 20 years in the areas of internal controls and SOX compliance reporting; our Director of IT Security and Compliance, who has over 20 years of IT experience, the past four of which have been in security; and our CFO, who has over 20 years of business development experience.


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and cybersecurity function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, Information Systems and Data).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Senior Director of Information Technology (IT), internal IT, information security and legal functions, and third-party service providers (collectively, Cybersecurity Team) help identify, assess and manage our cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response strategy, incident detection and response measures, a vulnerability management policy, risk assessments, encryption of certain data, network security controls, data segregation, access controls, physical security controls, systems monitoring controls, personnel training, penetration testing, cybersecurity insurance, dedicated cybersecurity personnel, background checks for certain personnel, vendor management strategies, and asset management strategy (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence service providers, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract manufacturing organizations. We maintain a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. The strategy includes vendor risk assessments, security assessment reviews, and imposing information security contractual obligations on a vendor as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategy may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our management and its designees report to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we have implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Liberty's corporate level IT and cybersecurity functions assess, identify, and manage risks from cybersecurity threats at the corporate level, while Formula 1 and QuintEvents operate their own cybersecurity functions with oversight from Liberty.

companyName: Liberty Media Corp

ticker: FWONA


text: Live Nation, an equity affiliate, as a separate publicly traded company from Liberty, operates its own cybersecurity function. Oversight for Live Nation's cybersecurity functions rests with its board of directors, of which an employee of Liberty is a member, in collaboration with Live Nation's Global Data Governance Board and Audit Committee.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our Board of Directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level, Formula 1 and QuintEvents. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see " The degradation, failure or misuse of the Company's information systems could cause a disruption of services or improper loss, use and disclosure of personal data or other confidential information, resulting in increased costs, liabilities or loss of revenue. " in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management We have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: At Formula 1, the Head of Information Security, together with the Director of IT, are responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk as well as regular reporting to Formula 1 executive management and the ISSC.


text: Liberty and Formula 1 have also established a Risk and Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at Formula 1, including cybersecurity. The Risk and Compliance Committee is composed of members of Liberty's ISSC as well as members of Formula 1's executive leadership team, including the Chief Financial Officer and General Counsel. The Head of Information Security provides quarterly updates to the Risk and Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom, technology, media and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Formula 1's Head of Information Security and Director of IT together have more than 30 years of experience and the Head of Information Security has multiple certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. All have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: We operate in the biopharmaceutical sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and the results of operations, including intellectual property theft, fraud, extortion, harm to employees, third party vendors or customers, violation of privacy laws and other litigation and legal risk, and reputational risk.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: We have designed and implemented a cybersecurity program which includes administrative, technical, and physical controls and processes to manage and mitigate material risks from internal and external cybersecurity threats, including but not limited to the following: A team responsible for designing, implementing, and continually improving our policies, procedures, and technology. A risk management process to identify, assess, and treat internal and external ( third-party) cybersecurity risks.


text: An incident management program to effectively and efficiently identify, review, and escalate incidents with the appropriate stakeholders (e.g., CEO, CFO, Legal, Finance, and others, as required).


text: A vulnerability management program to scan and penetration test, on an ongoing basis, our systems and networks to identify and treat identified vulnerabilities.


text: A security awareness program that educates our team members on an ongoing basis on internal security policies and secure behaviors.


text: Engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security program.


text: Periodically reporting risks, previous and current incidents, and ways to mitigate risks to the Chief Executive Officer, the Audit Committee of the Board of Directors, and other members of senior management.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. Refer to Item 1A – " Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches " and " We are dependent on information technology, systems, infrastructure and data," which are incorporated by reference into this Item 1C. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.


text: Board of Directors The Audit Committee operates under a written charter adopted by the Company's Board of Directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats. For further information about the Audit Committee's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.


text: Our team of cybersecurity professionals is led by our Vice President, Infrastructure and Security, who along with other members of the IT team collectively over extensive experience in the cybersecurity space in both the pharmaceutical and non-pharmaceutical sectors, many of whom have obtained professional security certifications. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. For further information about Management's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.


text: Risk Management and Strategy QVC Group's corporate level IT and cybersecurity functions are provided by LMC as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in LMC's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. QVC operates its own cybersecurity function with oversight from QVC Group.

companyName: QVC Group, Inc.

ticker: QVCGA