text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity threats to our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third-parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity threats, including as a result of such previous incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC

secItem: Item 1C


text: Our Board is responsible for overseeing our processes for assessing and managing enterprise risk, including with respect to cybersecurity. The Board considers our risk profile when reviewing our annual business plan and incorporates risk assessment into its decisions.


text: Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee. The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security ("SVP-GIS") and our Executive Vice President and Chief Information Officer ("EVP-CIO"), and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and cybersecurity considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents.


text: At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 25 years of experience in government and industries including retail and manufacturing, and industry certifications including Certified Information Systems Security Professional ("CISSP") from ISC Squared and Global Information Assurance Certification ("GIAC") from SANS Institute. Our SVP-GIS also has experience in forensic investigations, strategic cyber risk management, and cybersecurity program development. Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS's direct reports include a number of experienced cybersecurity leaders responsible for various aspects of our cybersecurity program, each of whom is supported by a team of experienced cybersecurity professionals.


text: The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and cybersecurity testing; operation of protective cybersecurity tools and systems; cybersecurity monitoring, incident response, and digital forensics; cybersecurity research and development and support for information technology and cybersecurity functions.


text: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual cybersecurity requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.


text: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.


text: We require our associates to receive annual training on our cybersecurity policies and practices. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written cybersecurity policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our cybersecurity program and cover topics such as acceptable use of information systems, cybersecurity risk management, access management, audit and logging, patching, and cybersecurity requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary, and integrated into employee training programs and our technology procurement process. We are also subject to the Payment Card Industry Data Security Standard and perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.


text: We have adopted an Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the "DBRT"), which is led by our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy, and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant cybersecurity threats, incidents, and issues through a documented process. Potentially material cybersecurity incidents are escalated by our EVP-CIO to executive management and reviewed with members of the Company's Disclosure Committee.


text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity incidents involving our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity incidents, including as a result of the June 2018 incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.


text: We have implemented a comprehensive cybersecurity program guided by recognized industry practices and frameworks and we continue to evolve the program in order to be able to assess, identify and manage risks from the continually evolving cybersecurity threat landscape. Our cybersecurity program encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Although we maintain a cybersecurity program that we believe is reasonably designed to protect the Company, cybersecurity threats may result in adverse effects on the confidentiality, integrity, and availability of our information systems or those of third parties on which we rely, and our connected products and services.

companyName: Xylem Inc.

ticker: XYL


text: Management and Internal Cybersecurity Team Our Chief Information Officer ("CIO"), who has over 30 years of relevant work experience in information technology, including cybersecurity, is responsible for the Company's information technology systems and cybersecurity and is an integral part of the Company's management of cybersecurity and related risks. The CIO reports to the Senior Vice President, Operations and Supply Chain, who reports directly to the Chief Executive Officer.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience and holds the Certified Information Systems Security Professional certification, reports to the CIO. The CISO is responsible for assessing, monitoring and advising the Company's businesses, management and the Board of Directors ("Board") on the Company's risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan.


text: The Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications, is led by the CISO. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program, including infrastructure, governance and incident response as detailed below. On a regular basis, the CISO receives reports from the Team on these cybersecurity program matters. In addition, the CISO also receives reports and updates on incident response and cybersecurity threats.


text: The CISO and Team manage a program for enterprise cybersecurity that is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations, and secure manufacturing operations. The CISO and Team also manage a program for connected products and services cybersecurity risk management that is guided by the ISA/IEC 62443 standard to enable protection and resiliency across products and services. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our risk management processes undergo at least quarterly review to identify potential gaps and areas for additional investment, resources and focus. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying, and managing cybersecurity risks. Our Enterprise Risk Management ("ERM") Program annually assesses and, on an ongoing basis, monitors the Company's key risks, including cybersecurity risk.


text: We maintain a suite of policies – the Cybersecurity Policy, the Product Cybersecurity Policy and the Acceptable Use of Information Technology Resources Policy – that apply globally to all of our employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection. Our policies are reviewed annually to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate. Our Code of Conduct, implemented by the Board, requires our employees' adherence with our policies and practices, including with respect to cybersecurity risk management.


text: Employees receive ongoing annual education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats. Through our internal social media channel, we provide cybersecurity alerts and education. In addition, our policies require the use of a cyber risk management process to onboard new suppliers and other third parties.


text: The Company's cybersecurity risk mitigation strategy includes the use of risk transfer via insurance that provides protection against certain potential losses arising from certain cybersecurity incidents.


text: Board of Directors Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, employees and shareholders. In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to the Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. As part of its independent oversight of the key risks facing the Company, the Board and Audit Committee devote considerable time and attention to the oversight of management's approach to cybersecurity and related risk mitigation, including strategy, controls. resources, policies, standards, processes and practices. At least semi-annually, the Audit Committee or full Board receive reports from the CIO and CISO. Such reports include updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape, and other relevant topics. We have protocols and processes by which certain cybersecurity incidents, as specified by our Cybersecurity Incident Response Plan, are escalated within the Company and, as appropriate, to the Audit Committee. These escalation protocols are periodically reviewed and updated, as needed.


text: The Board receives a report on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program, including ongoing monitoring of the Company's risks, as appropriate. The ERM Program has identified cybersecurity as one of the Company's primary risks.


text: Key Internal Governance Bodies Xylem has a number of committees to bolster business resilience, protect shareholder value and enable compliance with regulatory requirements. The Enterprise Risk Committee ("ERC"), a key component of the Company's ERM Program, is comprised of senior executives and is responsible for reviewing the Company's key risks as identified by the ERM Program, including cybersecurity, and overseeing the Company's identification, assessment, management, mitigation and ongoing monitoring of these risks. As such, the ERC periodically receives reports from the CISO on cybersecurity risk.


text: The Cyber Risk Committee ("CRC"), comprised of a cross-functional group of senior executives including the CIO, CISO, Chief Financial Officer and General Counsel, provides advice and governance regarding the Company's strategic management of cybersecurity across the Company, including cybersecurity risk posture, projects, issues, threat intelligence and escalations. The CRC meets at least quarterly and receives reports and presentations from the CISO or third parties on internal and external cybersecurity matters; and, as appropriate, briefings from the CISO on cybersecurity incidents, the Company's incident response, recovery and remediation, and actual or potential impacts.


text: Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, where the Incident Response Team and relevant business and functions drill our response to a simulated cyber incident. The results of these drills are used to identify areas for improvement in our processes and technologies.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we have not experienced any material cybersecurity threats or incidents as of the date of this Report, our cybersecurity program might not be able to prevent or mitigate future successful attacks, threats or incidents.


text: As detailed elsewhere in this Report, we also rely on information technology and other third-party vendors and strategic joint venture partners to support our business and operations, including our secure processing of personal, confidential, financial, sensitive, proprietary and other types of information, and to enable our connected product and service offerings. Despite ongoing efforts to improve our and third parties' ability to protect against cyber threats, we may not be able to protect all information systems or connected products and services. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. For a more detailed discussion of these risks see the discussion set forth under "Item 1A. Risk Factors" in this Report.


text: Cybersecurity risk management is integrated into our Enterprise Risk Management ("ERM") Program, which is our approach to identifying, assessing, prioritizing and mitigating risks to the Company, with mitigation efforts focused on the highest risks. Our ERM Program assesses risks, including those related to cybersecurity, annually, and monitors such risks on an ongoing basis.


text: We maintain a comprehensive cybersecurity program that encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Our enterprise cybersecurity program is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations and secure manufacturing operations. Our connected products and services cybersecurity program is guided by the ISA/IEC 62443 standard. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, resiliency, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks.


text: We maintain cybersecurity policies that apply to all employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection, and also require the use of certain cyber risk management processes to onboard new suppliers and other third parties. We periodically review our policies to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate.


text: Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, the results of which are used to identify areas for improvement in our processes and technologies. We have protocols and processes by which certain cybersecurity incidents, as specified by our IRP, are escalated within the Company and, as appropriate, to the Audit Committee of the Board of Directors.


text: Employees receive annual and ongoing education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats.


text: The Company maintains insurance as part of its cybersecurity risk mitigation strategy to provide protection against certain potential losses arising from certain cybersecurity incidents.


text: In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to its Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. At least semi-annually, the Audit Committee or full Board receive reports from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). Reports include topics such as updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape and other relevant topics. The Board also receives a report from management on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program and ongoing monitoring of the Company's risks, including cybersecurity risk, as appropriate.


text: The Company's Cyber Risk Committee ("CRC"), comprised of a cross-functional group of senior executives, provides advice and governance regarding the Company's strategic management of cybersecurity across the Company, including cybersecurity risk posture, projects, issues, threat intelligence and escalations. At its periodic meetings, the CRC receives reports and presentations from the CISO or third parties on internal and external cybersecurity matters, and, as appropriate, briefings from the CISO on cybersecurity incidents, the Company's incident response, recovery and remediation and actual or potential impacts.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience, and is a Certified Information Systems Security Professional, is responsible for assessing, monitoring and advising the Company's various business units, management and the Board on risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan. The CISO leads the Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program.


text: Material Cybersecurity Risks, Threats & Incidents Although we have experienced actual and attempted cybersecurity threats and incidents in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations or financial condition, or are reasonably likely to have such an effect. However, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. For a more detailed discussion of the risks we face see the discussion set forth under "Item 1A. Risk Factors" in this Report.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: U.S. SILICA HOLDINGS, INC.


text: Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: • Vigilance: We maintain a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide routine mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function, our Chief Information Officer, the Director of IT Security & Risk Management, other members of management and relevant management committees and councils, including the Information Security Governance Committee.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, penetration and vulnerability testing and other assessments and exercises focused on evaluating the effectiveness of our cybersecurity measures. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also are informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Information Officer.


text: Our Chief Information Officer and the Director of IT Security & Risk Management are the members of management that are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the company. The Chief Information Officer and the Director of IT Security & Risk Management work in coordination with the other members of the Information Security Governance Committee (the "ISGC"), which includes our Chief Financial Officer, General Counsel, Environmental Health & Safety Director, Vice President of Finance, Vice President of Information Technology, Executive Vice President of Industrial & Specialty Products, and the Director of Corporate Human Resources & Talent Management.


text: The ISGC was established by the Audit Committee and its primary responsibility is to provide oversight to the Information Systems Security Program ("ISSP") to align information systems security activities to business goals, effectively manage risk, and ensure compliance. The ISGC is chaired by the Director, IT Risk Management, with the Chief Information Officer as an alternate. The ISGC's responsibilities include developing policies and supporting frameworks, controls, and procedures to protect company, customer, and employee data from cybersecurity breaches; establishing organizational risk tolerance and developing information security policies to align with this tolerance level; and ensuring adequate security controls, as specified in policies or otherwise agreed upon, to manage risk and compliance. The ISGC has developed an ISSP scorecard to communicate cybersecurity incidents and activity and report program accomplishments and provides quarterly updates to the Audit Committee, including the ISSP scorecard, and at least annual updates to the Company's extended leadership team.


text: Our Chief Information Officer and the Director of IT Security & Risk Management, in coordination with the ISGC, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Director of IT Security & Risk Management, and the ISGC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and the Chief Information Officer reports such incidents to the Audit Committee when appropriate.


text: Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, including serving as Chief Information Officer for us for the past four and one-half years, as well as for another large public company, a private consulting firm providing technology and cybersecurity advisory services and a privately held fuel oil blending and distribution company. The Chief Information Officer holds an undergraduate degree in management and leadership from Northeastern University.


text: Our Director of IT Security & Risk Management holds an undergraduate degree in computer science and a master's degree in business administration from Texas Tech University and has served in various roles in information technology for over 20 years, including serving as an IT security consultant and performing IT audit work for PricewaterhouseCoopers, Deloitte, and Grant Thornton. He then returned to the industry to oversee the IT security program for classified systems at a publicly-traded defense contractor. He next joined a publicly-traded energy services company to lead the IT security program before joining us in 2019. Certifications he has held at various points throughout his career include the following – Certified Information Systems Auditor (CISA), Check Point Certified Security Administrator (CCSA), Check Point Certified Security Expert (CCSE), Cisco Certified Network Associate (CCNA), Cisco Certified Network Professional (CCNP), and Microsoft Certified Professional (MCP).


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See "Risk Factors—Operational Risks" for additional discussion of cybersecurity risks to our business.


text: The Trust has no directors or executive officers. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"). As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Risk Management oversight and governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.


text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.


text: The Operator, Diversified, is responsible for the oversight and overall management of the Underlying Properties. The Trust also relies on Diversified's Enterprise Risk Management ( ERM) framework for cybersecurity risk management and strategy relating to the operation of the Underlying Properties. Key aspects of Diversified's cybersecurity risk management, strategy and governance are summarized below. As of December 31, 2023, cybersecurity risks have not materially affected the business of the Underlying Properties or the Trust's results of operations or financial condition.


text: Cybersecurity is a component of Diversified's ERM Program. The ERM program entails risk identification, assessment, prioritization, monitoring and mitigation processes, which are continually evaluated and enhanced. The risk assessment process takes into account broader risks such as strategic, operational and regulatory and financial implications. Additionally, the ERM program risk assessment is discussed with members of Diversified's Senior Leadership Team and its Audit Risk Committee, which includes members of Diversified's Board of Directors. In addition to Diversified's ERM Program, Diversified's governing policies and procedures create a structured approach to managing cybersecurity risk. Diversified's network is designed using a Zero Trust Approach ( ZTA) and is segmented to include several layers of security, including least privilege access, conditional access policies, and multi-factor authentication ( MFA). The ZTA encompasses identity, endpoints, infrastructure, data, and applications for enhanced visibility, intelligence and automation for Diversified's security team. Diversified network environment is completely cloud based and is therefore continuously tested from both trusted and untrusted sources - both external and internal to its networks, rather than relying on a one-time penetration testing approach. Additionally, Diversified's employees are subject to annual cybersecurity training and e-learning sessions as employees are viewed as the first line of defense against cybersecurity attacks.


text: Diversified engages with key technology partners and suppliers to ensure potentially vulnerable systems are identified and secured, including continuous incident monitoring, regular threat testing, and control and protection of confidential information. Third-party providers are subject to an assessment every 90 days, based on various criteria, such as whether the third-party provider has access to Diversified's network, data and information systems. Third-party providers that have access are required to use MFA and their system and organization controls reports are obtained and reviewed annually.


text: A dedicated Cybersecurity Council is responsible for Diversified's cybersecurity risk management and strategy. The Cybersecurity Council includes certain members of Diversified's Senior Leadership Team, including the Chief Operating Officer, Chief Financial Officer, Chief Information Officer and General Counsel. This Council meets at least once a quarter to discuss cybersecurity issues, risks and strategies. The Cybersecurity Council briefs Diversified's Board of Directors at least quarterly, on all security initiatives, including assessing risks, incidents and any remediation taken. Additionally, the Council is briefed on efforts to improve Diversified's network security systems and enhanced employee trainings. The membership of this council is adequately trained and educated to provide proper governance, risk management and control of the cybersecurity program utilizing the National Institute of Standards and Technology framework.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: CHUY'S HOLDINGS, INC.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. The Company evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. The board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The board of directors has established robust oversight mechanisms to ensure effective governance in managing risks.


text: The Audit Committee bears the primary responsibility for the board of directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our Vice President of Information Technologies ("IT") and our Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee about cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per quarter. These briefings encompass a broad range of topics, including: • the current cybersecurity landscape and emerging threats • the status of ongoing cybersecurity initiatives and strategies • incident reports and learnings from any cybersecurity events and • compliance with regulatory requirements and industry standards. In addition to its scheduled meetings, the Audit Committee, Vice President of IT and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board of directors' oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and input for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. Additionally, on an annual basis, the board of directors discusses the Company's approach to cybersecurity risk management with the Vice President of IT and CFO.


text: Our Vice President of IT, in his capacity, regularly informs the CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Vice President of IT and our Security and Compliance Engineer. Our Vice President of IT and Security and Compliance Engineer have served in various roles in information technology and information security for over 30 years and bring a wealth of expertise to their roles. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Our Vice President of IT remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Vice President of IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company conducts an annual review of its cybersecurity measures and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: In the event of a cybersecurity incident, the Vice President of IT is equipped with a incident response and recovery plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. The board of directors and senior management also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information, see Item 1A. "Risk Factors—Information technology system failures or breaches of our network security could interrupt our operations and harm our business, financial condition and results of operations."


text: Our cybersecurity strategy, which is effected through our Cybersecurity Risk Management Model, prioritizes the security and protection of our information technology networks and systems, through the detection, analysis and response to known, anticipated or unexpected threats and effective management of security risks. Our Cybersecurity Risk Management Model provides for four levels of industry-standard response activities to protect the Company against cyber threats. These are:

companyName: Bristow Group Inc.

ticker: VTOL


text: 1.Policy Framework: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems, including our Information Security Policy, which establishes guidelines for the safe and secure use of the Company's information systems and data, and our Electronic Communication Policy, which outlines the responsibilities of those using the Company's network and IT equipment. Employees and third-party service providers are required to comply with our Information Security Policy and our Electronic Communication Policy.


text: 2.Awareness Programs: All employees participate in an ongoing program of mandatory annual training and receive periodic communications regarding the cybersecurity environment to increase awareness throughout the Company. We also implemented an enhanced annual training program for specific specialized employee populations.


text: 3.Security Engineering: We leverage a combination of the International Organization for Standardization (the "ISO") best practice standards and other global standards, including Control Objectives for Information and Relevant Technology and GDPR, to measure our security posture and manage risk. In addition, we completed several cybersecurity-related initiatives such as multifactor authentication and the ISO 27001 certification, which is globally recognized as one of the highest standards of compliance and control for information security management systems. We have also implemented critical preventive measures, such as monthly phishing simulations, email and endpoint security and monitoring, database encryption, continuous patching, and network firewall security using both internal resources and independent third-party service providers. 4.IT Resiliency: Our IT Team has formalized disaster recovery processes, business continuity procedures and an incident response plan.


text: Our Data Privacy Officer is responsible for leadership, compliance, and oversight of applicable cyber and privacy laws and policies, which are designed to protect data belonging to our employees and customers and the Company's information security; while our IT Cyber Incident Management Team oversees Bristow's cyber incident response and remains in close contact with the Executive Leadership Team and the Audit Committee throughout the cyber incident resolution process.


text: Our IT Steering Committee is responsible for reviewing, approving and funding IT projects, including cybersecurity initiatives. This committee consists of five (5) members: the Chief Information Officer, the President and Chief Executive Officer, the Chief Financial Officer, the Chief Operating Officer, Government Services and the Chief Operating Officer, Offshore Energy Services.


text: The Chief Executive Officer, with the assistance of the other members of the executive leadership team, is responsible for, among other risk management measures, implementing measures designed to ensure the safety standards for personnel, information technology systems and data security, the environment and property in performing the Company's operations. The Company's Enterprise Risk Management Committee (ERM), sponsored by the CEO, was established to oversee the risk management processes and to report upon and ensure that sound policies, procedures and practices are in place for the enterprise wide management of the Company's material risks and to report the results of the Committee's activities to the Company the Board at least annually. These include risks associated with cybersecurity and any of the topics identified in our materiality assessment. Responsibilities for risk management and compliance are distributed throughout various functional areas of the business, including but not limited to a Compliance Committee established to understand and support business integrity and compliance efforts globally, and to oversee Bristow's compliance efforts with respect to COBI, relevant policies, and applicable laws.


text: Our Cybersecurity Committee consists of four (4) members: the Chief Information Officer, the Chief Financial Officer, the Director of Internal Audit and the Director of IT, Infrastructure and Flight Systems. Together with our Executive Leadership Team and the Board, the Cybersecurity Committee assists with prioritizing our cybersecurity programs as well as providing oversight around cybersecurity practices and guidance in responding to cyber incidents. Members of the Cybersecurity Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks in our industry. Committee members are also experienced and knowledgeable across Information Technology disciplines including strategy, governance, infrastructure, applications, data management, audit controls & compliance, risk management, disaster recovery, business continuity, and incident response planning.


text: The Cybersecurity Committee meets quarterly and delivers updates to management periodically and to the Audit Committee on an annual basis (and as needed). Under its charter, our Audit Committee, comprised of independent directors from our Board, must conduct at least annual reviews of any emerging cybersecurity developments and threats and the strategies to mitigate cybersecurity risks. The Cybersecurity Committee also delivers periodic updates to the Board on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. The Board reviews cybersecurity opportunities relating to our business strategy, and cybersecurity-related matters are also factored into business continuity planning.


text: As of the December 31, 2023, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on industry practices and accepted frameworks (e.g. the NIST framework).

companyName: Global Net Lease, Inc.

ticker: GNL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our IT team, in coordination with senior management, is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a risk management process for third parties, including, but not limited to service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. Our Audit Committee reviews policies with respect to major risk assessment and risk management and reviews with management the steps taken to monitor and control such exposures. As part of this function, our Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary and appropriate, regarding cybersecurity incidents that we may experience.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee receives briefings from management on our cyber risk management program and receive presentations on cybersecurity topics from management, our internal auditors IT personnel or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by our Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise.

companyName: Carlyle Group Inc.

ticker: CG


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.


text: In addition, we partner with third parties to assess the effectiveness of our cybersecurity program, including audits and assessments performed under the direction of Carlyle's Internal Audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers the firm's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."


text: Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. In addition, our Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs our Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to the firm's Disclosure Committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the firm's Disclosure Committee with these materiality assessments and any resulting reporting requirements.


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.


text: To our knowledge, cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition; however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see


text: Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 22 years of experience in information security that includes key roles managing cybersecurity risk in both government and the private sector. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that comprises senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: We have developed a comprehensive information security program that is designed to protect and preserve the confidentiality, integrity, and continued availability of all information that we own or possess. The program is a critical component of our overall IT Security, Risk, and Compliance Management Program, which is based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: Key features of the program include: • Implementation of a detailed cyber incident response plan that provides controls and procedures for identifying, assessing, containing, remediating, escalating, and reporting cyber incidents. • Cross-functional approach to addressing cybersecurity risk, with engagement among internal working groups such as Risk, Information Technology, Operations, Procurement, Legal, Compliance, and Internal Audit functions. • Information security policies and procedures that are reviewed at least annually and updated to reflect changes in law, technology, practice, and emerging threats. • Cybersecurity awareness training for employees, upon hire and at least annually thereafter; • Ongoing monitoring, and periodic assessment and testing, of our networks and systems for threats, vulnerabilities, and other cybersecurity risks, internal and external. • Periodic tabletop exercises and response readiness assessments, with participation from senior executives, led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness; results are provided to the audit committee. • Development of risk mitigation strategies that may defray costs associated with an information security breach. • Periodic cyber drills and disaster recovery tests which are designed to help ensure our business operations can continue in the event of a cybersecurity attack. • Comprehensive internal risk assessment of critical third-party service providers, including of their cybersecurity posture prior to onboarding; contractual requirements for critical third-party service providers to adhere to our standards and incidents reporting; once engaged, critical third-party service providers are required to maintain a comprehensive cybersecurity plan in conformity with industry standards. We engage industry specialists and other third parties in connection with such processes.


text: Our information security program is managed by our Chief Information Security Officer (CISO) with collaboration across lines of businesses and corporate functions. The CISO is a senior-level executive responsible for establishing and executing our information security strategy, including cybersecurity oversight. The CISO reports directly to our Chief Information Officer (CIO), who reports directly to our Chief Operating Officer (COO). The CIO and CISO are members of the management operational risk committee, which reports to the management risk committee. The COO is a member of the management risk committee, which reports to the board risk committee. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Committees of the Board of Directors—Management Committees for additional information about the management operational risk committee, which is responsible for overseeing operational risk, including cybersecurity risk, and the management risk committee, which is responsible for overseeing overall corporate risk.


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. As of February 1, 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CIO is responsible for managing our information technology strategy. Our CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies; and received a Bachelor of Science in business management and a Master of Business Administration in management information systems.


text: The CISO is responsible for managing our information security program. Our CISO has over 20 years of information technology experience and over 15 years of information security experience; is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CISO is responsible for managing our information security program. Our CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager, and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: Wheeler Real Estate Investment Trust, Inc.

ticker: WHLR


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition.


text: We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard our company's networks and digital assets and maintain the integrity of our operations.

companyName: Vital Energy, Inc.

ticker: VTLE


text: We have a robust cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.


text: In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises to refine and update incident response processes. We have a management-level Breach Disclosure Committee, which is a subcommittee of our Disclosure Committee and includes our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") that is responsible for assessing and identifying material risk from cybersecurity threats. In the event of a cybersecurity incident, the Breach Disclosure Committee is responsible for making recommendations to the General Counsel regarding the materiality of the incident based on documented guidelines for assessing risk.


text: We engage third-party vendors, assessors, consultants, auditors, and other third-party service providers. We recognize that third-party service providers introduce risk from cybersecurity threats. In an effort to mitigate these risks, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require third-party service providers to adhere to certain security standards and protocols.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Risks from cybersecurity threats are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of directors' oversight and management's role Our board of directors has primary oversight of risks from cybersecurity threats. The board of directors delegates oversight of our enterprise risk management process with respect to material risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for reviewing and discussing with management the Company's risk from cybersecurity threats and the security of the Company's data and information technology systems, reviewing management's cybersecurity strategy, as well as the implementation of cybersecurity policies, procedures and strategies. Additionally, on a periodic basis, management reviews results from assessments of key risks with the Audit Committee and the steps taken to mitigate new risks which have been identified.


text: The CISO briefs the Audit Committee on cybersecurity matters at each quarterly meeting, and annually meets with the Audit Committee in executive session to report on cybersecurity matters. In addition, cybersecurity training on the current cybersecurity landscape and emerging threats is provided to the board of directors.


text: Our CTO and CISO meet regularly to assess current cybersecurity threats and evaluate our potential vulnerability to cybersecurity risks. The CTO and CISO also engage periodically with external and internal auditors and engage periodically with the guidance of outside threat intelligent agencies including the Cybersecurity and Infrastructure Security Agency and the Oil and Natural Gas Information Sharing and Analysis Center.


text: With oversight from the CTO, the CISO is responsible for assessing and managing cybersecurity risks. With over 30 years of IT management experience, the CISO has over 15 years experience in developing, leading and managing cybersecurity programs. The CISO holds Bachelor's degree in Management Science and Computer Systems along with a Certification in Cybersecurity Oversight through the National Association of Corporate Directors ("NACD") and the Software Engineering Institute of Carnegie Mellon University.


text: We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard the Company's networks and digital assets and maintain the integrity of our operations.