text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: Longbridge's cybersecurity risk management and strategy is co-led by its Chief Operating Officer ("COO") and its Vice President of Information Technology ("VP of IT"). Longbridge's COO has extensive leadership experience with enterprise information technology in the mortgage banking industry, where he has held various executive roles, including Chief Privacy Officer and Chief Information Officer. Longbridge's COO has developed and executed IT strategy, including cybersecurity programs, and helped achieve and maintain Sarbanes-Oxley compliance and SOC-2 certification. Longbridge's VP of IT has extensive leadership experience with enterprise information technology, both in the banking and manufacturing industries. She has also developed and executed IT strategy, including cybersecurity programs and helped achieve and maintain Sarbanes-Oxley compliance. Longbridge's COO, accompanied by its VP of IT, regularly discusses Longbridge's cybersecurity risks and posture, and its information technology roadmap, with the Audit Committee. In these reviews, Longbridge's COO informs the Audit Committee of what Longbridge believes are the key focus items of Longbridge in its cybersecurity program and the COO and VP of IT provide an overview of their views of emerging threats, and any significant cyber response activities or incidents.

companyName: Ellington Financial Inc.

ticker: EFC

secItem: Item 1C


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to assess, identify, and manage material risks from cybersecurity (including cybersecurity threats associated with the use of third-party service providers), to safeguard our information systems, and to protect the confidentiality, integrity, and availability of the data on our information systems.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework. Management has formed cross-functional risk and information security committees (the "Security Committees") to initiate, develop, review and implement cybersecurity policies, procedures and training to mitigate cybersecurity risks. Our information technology ("IT") cybersecurity leadership team works closely with our Security Committees and internal audit team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Sr. Director Cybersecurity and Network, the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC VP IT Operations, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the NIST framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.


text: Engagement of Consultants for Risk Management Services Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts to perform a variety of functions for the Company. These include, but are not limited to, cybermaturity audits, targeted ransomware assessment and table-top exercises, red and purple team attack simulations, internal penetration tests and other internal and external audits. These partnerships enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, the Company implements processes to oversee and manage these risks. The Company utilizes software products and services to monitor and protect the Company's environment from possible third-party breaches impacting the Company's environment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Third-parties who have access to highly sensitive information due to services performed and data retained are subject to increased scrutiny.


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity incidents that we believe have materially affected, or are likely to materially affect, the Company.


text: Board of Directors and Audit Committee Oversight Our board of directors (the "Board") understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: The audit committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: Management's Role Managing Risk Senior IT leadership play a pivotal role in managing cybersecurity risk and keeping the Audit Committee apprised of cybersecurity developments. Senior IT leadership provide comprehensive briefings to the Audit Committee on a periodic basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;


text: learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and senior IT leadership maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Company, at the direction of the Audit Committee, conducts periodic reviews of the Company's cybersecurity posture and the effectiveness of its risk management strategies. These reviews help in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Using a risk-based prioritization approach, the IT cybersecurity leadership team and the Security Committees focus on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and improving compliance processes to protect the Company's operations and data. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations.


text: The Company has also implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and vulnerability and patch management.


text: The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC SVP & Chief Information Officer, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the National Institute of Standards and Technology ("NIST") framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to prompt remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.


text: The audit committee of the Board (the " Audit Committee ") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including multi-layered technical security measures, mandatory user security awareness and training, access control policies and activity monitoring. Additionally, we engage third-party cybersecurity experts to assess the security of our network.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: We design and assess our program based on the NIST Special Publication 800-171 and the Cybersecurity Maturity Model Certification (CMMC) levels 1. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CMMC maturity models as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is designed to be integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks. The Committee oversees our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our Chief Executive Officer (CEO), CFO, and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and the Audit Committee (the Committee) contributes to oversight of cybersecurity risks.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential, as appropriate.


text: The Board may also receive briefings from management on our cyber risk management program, and may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO) or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our CFO, Head of Information Technology, General Counsel and our Vice President of Quality Assurance, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and oversees our retained external cybersecurity experts, which includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from cybersecurity experts; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer data that use to provide services for our customers ("Information Systems and Data").

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our Chief Information Security Officer ("CISO") with help from our legal department and our security and compliance team from our IT infrastructure department help identify, assess and manage the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, conducting scans of the threat environment, conducting internal and external threat and vulnerability assessments, conducting internal and external audits, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting third party assessments and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, incident detection and response, disaster recovery plan, encryption of certain data, network security controls, access controls, asset management, tracking and disposal, employee training, penetration testing, systems monitoring and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security and compliance team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and evaluates material risks from cybersecurity threats and reports to the audit committee of the board of directors ("Audit Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including outside legal counsel, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers and threat intelligence service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes vulnerability scans related to vendors and a review of vendors' security certification reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, the Company may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: We have not experienced a cybersecurity incident that would materially affect the company's business strategy, results of operations or financial position.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.


text: The Company's CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the CFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the CFO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Principal Financial Officer ("PFO") who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.


text: The Company's PFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's PFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the PFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the P FO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") team, our Chief Information Security Officer ("CISO"), and our Enterprise Risk Management Committee, as overseen by the Board of Directors, primarily through its Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, malware protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to improve our cybersecurity posture, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts as needed to evaluate the efficacy of our security measures. We engage reputable third-party tools and products to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the following certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material affect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.


text: Cybersecurity Incident Reporting and Management We have not identified any cybersecurity incidents that have materially affected or vulnerabilities to cybersecurity threats that are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption requirements, malware protection, remote access, multifactor authentication, confidential and privacy information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the Certified Chief Information Security Officer (CCISO) certification from EC-Council and certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material effect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.


text: Cybersecurity Incident Reporting and Management We have not experienced any cybersecurity incidents that have a material impact on our business strategy, results of operations, or financial condition. Nor have we identified vulnerabilities to known threats that are reasonably likely to materially affect the same. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.


text: As a healthcare-focused company, we understand the importance of managing cybersecurity risks that we face and have established a cybersecurity risk management program as part of our enterprise risk management program.

companyName: Phreesia, Inc.

ticker: PHR


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.


text: Our cybersecurity program includes safeguards that are designed to protect the Company's information systems from cybersecurity threats. Such safeguards include firewalls, automated intrusion detection systems, anti-malware functionality and access controls, which are evaluated and improved through periodic vulnerability assessments and ongoing cybersecurity threat intelligence. We have established and maintain an incident response plan that addresses the Company's response to and recovery from a cybersecurity incident. The incident response plan is tested and evaluated on an annual basis.


text: The Company's cybersecurity program is supported by engagement of third-party service providers who help identify, assess and respond to cybersecurity risks. For example, the Company regularly engages third parties to perform and facilitate assessments on our cybersecurity measures, including information security maturity assessments, audits, tabletop exercises, threat modeling and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to leadership, the Audit Committee, and/or the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by the assessments, audits and reviews.


text: As part of our cybersecurity risk management program, we maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. Further, all personnel are required to undergo cybersecurity training during onboarding and, thereafter, on an annual basis to reinforce the Company's information security policies, standards and practices.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may from time to time experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") holds oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, who serves as the Company's Security Officer, along with other members of management including the Senior Director of Security Engineering, the Chief Privacy Officer, and the compliance, audit, and risk teams.


text: The Company's Chief Technology Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Senior Director of Security Engineering. The security team includes approximately 40 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.


text: The Board and the Audit Committee each receive regular presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered defense-in-depth approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced and will likely experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") maintains oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, along with other members of management including the Chief Information Security Officer, the Chief Privacy Officer, and the compliance, audit, and risk teams.


text: The Company's Chief Information Security Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program and reports to the Chief Technology Officer. The Chief Information Security Officer has more than 15 years of cybersecurity experience, including leadership roles at four publicly traded companies. He is a Certified Information Systems Security Professional, holds a M.S. in Security Technologies from the University of Minnesota and is an alumnus of the FBI Citizen's Academy. The Chief Technology Officer has served in various leadership roles in information technology and information security at the Company for over 14 years and holds a B.S. in computer science from Worcester Polytechnic Institute. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Chief Information Security Officer. The security team includes approximately 36 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.


text: The Board and the Audit Committee each receive quarterly presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.


text: The Company has established an information security program that uses a risk-based methodology to ensure the confidentiality, integrity, and availability of its information. The Board of Directors and the Enterprise Risk Management Committee set enterprise risk strategy and make risk-informed decisions, which includes assessment and response to cybersecurity risk. The Board has appointed an Information Security Officer ("ISO") to oversee the program. The program utilizes a combination of automated tools, manual processes, and third-party assessments to identify and assess potential cybersecurity threats. The program is supported by an organization structure that reflects support from across the business. Program objectives and results are regularly reported to the Enterprise Risk Management Committee, Audit Committee, and Board of Directors.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Company conducts risk assessments and compliance audits, both internally and by independent third parties for comparison against industry standards, including the National Institute of Standards and Technology ("NIST") cybersecurity framework and Federal Financial Institution Examination Council ("FFIEC") guidance. Risk assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent, and effective response to actual or attempted cybersecurity incidents impacting the Company. The plan includes considerations for (1) detection, (2) analysis, which may include timely notice to our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. In addition, we also maintain a formal information security training program for all employees that includes training on topics such as phishing and email security best practices. Employees are also required to complete regular training on data privacy.


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. For further discussion of risks from cybersecurity threats, see the section captioned "Operational Risks" in Item 1A. Risk Factors.


text: We use third party partners to audit, assess, and test our cybersecurity program governance and control effectiveness on an annual basis. These engagements include an IT general controls review, internal and external penetration testing, social engineering testing, and incident response exercises. Findings and recommendations from these engagements are reported to the Enterprise Risk Management and Audit Committees.


text: We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented a third-party risk management program to manage the cybersecurity risks associated with its use of third-party service providers.


text: Cybersecurity Incidents While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe.


text: The Board and the Enterprise Risk Management Committee have oversight responsibility for our information security program and receive regular updates on the status of the program and any emerging threats or incidents with the potential to impact operations or financial performance. To ensure that the Board is fully informed about cybersecurity risks, the ISO provides regular reports to both the Board and the Enterprise Risk Management Committee. These regular reports include an overview of the Company's current cybersecurity risk assessment, key risk areas, and any significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Enterprise Risk Management Committee receives regular updates on cybersecurity trends and emerging threats from program management. Our Audit Committee also plays a role in overseeing the Company's cybersecurity and information security program. The Audit Committee reviews final reports from third-party engagements and receives presentations at its meetings concerning cybersecurity risk and related issues. All members of the Board receive copies of Audit Committee reports.


text: Company management is responsible for assessing and administering the cybersecurity risk program. Specifically, the Chief Information Officer ("CIO") and the ISO are responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The ISO has relevant expertise in cybersecurity, with 18 years of experience managing components of the information technology and information security programs at the Company. The ISO has established expertise and proficiency in cybersecurity, and holds several cybersecurity certifications, including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISC). The ISO and CIO work closely with other management positions, including the Chief Risk Officer, Chief Financial Officer, General Counsel, President, and CEO to ensure that the Company has effective communication and understanding regarding its cybersecurity risk and related controls.


text: The IT and Security teams monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through various processes. These processes include risk assessments, vulnerability assessments, penetration testing, program exercises, security incident and event management, continuous monitoring, and threat intelligence gathering.


text: In 2023, the Board held an education session with outside experts on cybersecurity. The Company has also implemented a cybersecurity training and compliance program to ensure regular education for all employees. In addition, external parties are engaged to assess Company information security programs and practices, including incident management, service continuity, and information security compliance programs.


text: The Company has established an information security program that uses a risk-based methodology to ensure the confidentiality, integrity, and availability of its information. The Board and the Enterprise Risk Management Committee set enterprise risk strategy and make risk-informed decisions, which includes assessment and response to cybersecurity risk. The Board has appointed an Information Security Officer ("ISO") to oversee the program. The program utilizes a combination of automated tools, manual processes, and third party assessments to identify and assess potential cybersecurity threats. The program is supported by an organization structure that reflects support from across the business. Program objectives and results are regularly reported to the Enterprise Risk Management Committee, Audit Committee, and Board.


text: The Company conducts risk assessments and compliance audits, both internally and by independent third parties, for comparison against industry standards, including the National Institute of Standards and Technology cybersecurity framework and Federal Financial Institution Examination Council guidance. Risk assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent, and effective response to actual or attempted cybersecurity incidents impacting the Company. The plan includes considerations for (1) detection, (2) analysis, which may include timely notice to our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery, (6) post-incident review, and (7) external reporting through a Current Report on Form 8-K (if deemed material). In addition, we also maintain a formal information security training program for all employees that includes training on topics such as phishing and email security best practices. Employees are also required to complete regular training on data privacy.


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. For further discussion of risks from cybersecurity threats, see the section captioned "Operational Risks" in Item 1A. Risk Factors.


text: We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third party service providers and are not under our direct control. The Company has implemented a third party risk management program to manage the cybersecurity risks associated with its use of third party service providers.


text: Cybersecurity Incidents While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Annual Report on Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe.


text: The Board and the Enterprise Risk Management Committee have oversight responsibility for our information security program and receive regular updates on the status of the program and any emerging threats or incidents with the potential to impact operations or financial performance. To ensure that the Board is fully informed about cybersecurity risks, the ISO provides regular reports to both the Board and the Enterprise Risk Management Committee. These regular reports include an overview of the Company's current cybersecurity risk assessment, key risk areas, and any significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Enterprise Risk Management Committee receives regular updates on cybersecurity trends and emerging threats from program management. Our Audit Committee also plays a role in overseeing the Company's cybersecurity and information security program. The Audit Committee reviews final reports from third party engagements and receives presentations at its meetings concerning cybersecurity risk and related issues. All members of the Board receive copies of Audit Committee reports.


text: Company management is responsible for assessing and administering the cybersecurity risk program. Specifically, the Chief Information Officer ("CIO") and the ISO are responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The ISO has relevant expertise in cybersecurity, with 19 years of experience managing components of the information technology and information security programs at the Company. The ISO has established expertise and proficiency in cybersecurity, and holds several cybersecurity certifications, including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISC). The ISO and CIO work closely with other management positions, including the Chief Risk Officer, Chief Financial Officer, General Counsel, President, and CEO to ensure that the Company has effective communication and understanding regarding its cybersecurity risk and related controls.


text: In 2024, the Board held an education session with outside experts on cybersecurity. The Company has also implemented a cybersecurity training and compliance program to ensure regular education for all employees. In addition, external parties are engaged to assess Company information security programs and practices, including incident management, service continuity, and information security compliance programs.


text: PMI relies heavily on the availability, reliability, and security of our information systems, networks, data, and intellectual property to, among other things, help manage our business processes and operations, collect and interpret data, and communicate internally and externally with employees, suppliers, consumers and customers, and business partners. We have a cross-functional cybersecurity risk program developed using standard industry practices, which monitors and manages cybersecurity threats to our business and information systems. We invest in administrative, technical, and physical safeguards, including continuity planning, to enhance resilience on our core processes, to maintain information security protections of our data and to safeguard the privacy of consumers, customers, employees and business partners.

companyName: Philip Morris International Inc.

ticker: PM


text: Our cybersecurity risk program, managed by our Chief Information Security Officer ("CISO") and the information security team, is conducted under our enterprise risk management framework and operates on a risk-based approach in assessing risks from cybersecurity threats, as follows: • Cybersecurity Threat Scenarios. Our cybersecurity risk assessment process consists of identifying and compiling a catalogue of top cybersecurity threat scenarios relevant to PMI, which facilitates risk assessments with our IT and business stakeholders. • Cybersecurity Maturity Assessment. Our risk exposure from relevant cybersecurity threat scenarios is mitigated by evaluating existing cybersecurity capabilities and corresponding maturity to identify and address areas for improvement. • Cybersecurity Threat Assessment. To establish PMI's current and target cybersecurity risk exposure, residual risk exposure from the most relevant cybersecurity threat scenarios across IT platforms and regions is evaluated and measured based upon the cybersecurity maturity assessments. • Cybersecurity Risk Program. PMI has a cybersecurity risk program to enhance its ability to identify, prevent, mitigate, respond and recover from disruptive cybersecurity threats and incidents and to reduce cybersecurity risk exposure. Improvements in our cybersecurity defense capabilities are prioritized based upon the results of cybersecurity threat assessments and cybersecurity maturity assessments. Identified issues from these assessments form the improvement initiatives under our cybersecurity risk program. As discussed in more detail below under "Governance," the program's key improvement initiatives, their implementation status, and the overall progression in our cybersecurity capability maturity are regularly presented to the applicable governing body within PMI. In addition, our cybersecurity risk program operates in coordination with the following:


text: Cyber Defense. Our dedicated cyber defense team provides services to identify, help prevent, detect and respond against cybersecurity threats and intrusions and collaborates with internal and external stakeholders to help protect PMI's information, mitigate operational disruptions and maintain business continuity. The cyber defense team's controls and procedures identify and enable escalation of cybersecurity incidents to the applicable governing body within PMI, as appropriate, to meet disclosure and reporting requirements for such incidents.


text: Third-Party Cyber Risk Management. Some of our information systems and networks are developed, supplied, or managed by third-party service providers. Our third-party cyber risk management process analyzes and seeks to control risks associated with outsourcing products or services, such as "supply chain" style cyberattacks, and identifies preventative and detective controls to mitigate third-party vendor and service provider cybersecurity risks that could adversely impact our business and operations.


text: Education and Awareness. PMI regularly provides its workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.


text: We engage external assessors and other third parties to independently evaluate our cybersecurity risk management process, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.


text: PMI follows a risk evaluation process for issues identified through internal audits, security assessments, third-party cybersecurity risk assessments, or self-assessment disclosures, and resulting information technology risks are recorded for risk remediation, transfer, avoidance, or acceptance as appropriate. Some of our information systems are managed by specialist third-party service providers, and we work with internal specialists to protect systems and data from unauthorized access and other cybersecurity threats.


text: The Audit and Risk Committee of our Board of Directors oversees our policies and practices with respect to risk assessment and risk management, including a review, in coordination with our management, of PMI's management of cybersecurity. Our CISO presents reports to the Audit and Risk Committee or to the full Board of Directors at least quarterly, which reports include cybersecurity risk status along with key performance indicators and key risk response strategies and plans.


text: The Corporate Risk Governance Committee receives quarterly reports on the Company's overall cybersecurity risk exposure including the individual top cybersecurity threat scenario residual risk ratings and the plan and status of the cybersecurity risk program, to facilitate calibration with other enterprise risk domains and validation of the risk response plans. The Corporate Risk Governance Committee includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President Operations, and our Chief Digital & Information Officer ("CDIO").


text: Cybersecurity incidents that have been determined to meet established SEC reporting consideration thresholds are promptly communicated to the Disclosure Committee, which is responsible for evaluating the potential materiality of such incidents and ensuring the accuracy, timeliness and completeness of related disclosures under applicable reporting obligations, and other relevant communications or presentations. The Disclosure Committee's membership includes the following executives: the Corporate Secretary; the GC; the CFO; the Controller & Principal Accounting Officer; the Chief Risk Assurance Officer; and the Vice President, Investor Relations. In addition, the CISO serves as an advisor to the Disclosure Committee.


text: The CISO has served in various roles in information technology and information security for over 25 years, including in the telecommunications and management consultancy sectors and serving as the Chief Information Security Officer of two large public companies. The CDIO holds an engineering degree and has served in various senior positions in information technology for over 20 years, including serving as Senior Vice President, IT Sales, and Global Chief Information Officer at a public company. The CEO has served in various positions in finance and general management at PMI for over 30 years, including as Chief Financial Officer and Chief Operating Officer, and holds a master's degree in economics. The CFO has over 15 years of experience in finance and management, having held several executive positions in charge of finance, legal affairs information systems and industry administration at various companies. The GC has served at PMI for 18 years in several positions within the Legal & Compliance department, including as Vice President and Associate General Counsel of various regions, and holds two master's degrees having studied law, management and finance.


text: As of the date of this Annual Report on Form 10-K, PMI is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect PMI, its business strategy, results of operations or financial condition. For additional information concerning PMI's risks related to cybersecurity, see Item 1.A. Risk Factors.


text: PMI relies heavily on the availability, reliability, and security of our information systems, networks, data, and intellectual property to, among other things, help manage our business processes and operations, collect and interpret data, and communicate internally and externally with employees, suppliers, consumers and customers, and business partners. We have a cross-functional cybersecurity risk program developed using standard industry practices, which monitors and manages cybersecurity threats to our business and information systems. We invest in administrative, technical, and physical safeguards, including continuity planning, to enhance resilience on our core processes, to maintain information security protections of our data and to safeguard the privacy of consumers, customers, employees and business partners. As of the date of this Form 10-K, cybersecurity threats have not materially affected our business, financial condition, or operating results.


text: Education and Awareness. PMI regularly and annually provides its in scope workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.


text: We engage external assessors, auditors and other third parties to independently evaluate our cybersecurity risk management process and related controls, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.


text: Cybersecurity threats and computer crime pose a risk to the security of the Company's information technology ("IT") systems and those of third-party service providers with whom it does business, as well as the confidentiality, integrity and availability of the data stored on those systems. As part of our overall risk management framework, the Company has developed and maintains an information security program consisting of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risks.

companyName: DallasNews Corp


text: Effective assessment, identification and management of material risks from cybersecurity threats involve a comprehensive and proactive approach. The Company's key processes include, but are not limited to, the following:


text: The Company's IT department has developed and implemented cybersecurity policies and procedures designed to align with industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and applicable regulatory requirements.


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.


text: Employee Training and Awareness: Mandatory ongoing cybersecurity training is provided to all employees to educate them about potential cybersecurity risks. Management fosters a culture of cybersecurity awareness and encourages employees to be proactive in identifying and reporting security issues.


text: Access Control and Authentication: The IT department maintains strong access controls and multi-factor authentication to ensure that only authorized personnel have access to sensitive systems and data. This access is regularly reviewed and updated as needed based on job roles and responsibilities.


text: Security Control: The IT department has implemented and continually monitors security controls, including firewalls, end-point detection and response, intrusion detection/prevention systems, file integrity monitoring and data encryption, to protect against cybersecurity threats. These tools and controls are regularly updated to address vulnerabilities and ensure the security of information technology infrastructure.


text: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with regulatory policies and cybersecurity best practices, and any identified weaknesses are promptly addressed.


text: Vulnerability Scans: Vulnerability scans are executed quarterly across the environment to proactively identify software weaknesses and vulnerabilities that could be exploited in a cybersecurity attack. Any identified vulnerabilities are promptly addressed.


text: Encryption and Data Protection: Encryption methods are in place to protect certain sensitive data. There are also programs in place to monitor and secure the Company's retained data.


text: Asset Inventory: The Company maintains an up-to-date inventory of all assets, including hardware, software, data and network infrastructure. Assets critical to the Company's operations have been identified and prioritized accordingly.


text: Continuous Monitoring: The IT department has implemented monitoring tools and processes to detect and respond to cybersecurity threats in real time.


text: A third-party security information and event management ("SIEM") partner provides security monitoring and alerts twenty-four hours a day, seven days a week. The Company engages an independent Qualified Security Assessor organization to perform penetration testing in order to validate the Company's Payment Card Industry ("PCI") compliance and adherence to the PCI Data Security Standard. The Company also collaborates with outside legal counsel to ensure compliance with regulatory requirements.


text: The Company has implemented and continues to maintain its IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with third-party service providers. These include, but are not limited to, an IT acceptable use policy, a contractor/consultant work policy and a vendor management policy.


text: The Company has experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on its business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on the Company's business strategy, results of operations, or financial condition to date, any actual or perceived breach of its security could cause operational disruption and result in delays or inability to produce, print and deliver its publications and other third-party print publications, damage the Company's reputation, cause the Company to lose existing customers, prevent the Company from attracting new customers, or subject the Company to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect the Company's business strategy, results of operations, or financial condition. In addition, more resources may be needed for the security of the Company's information technology systems in the future, which could increase the cost of doing business or otherwise materially adversely affect the Company's business strategy, results of operations, or financial condition.


text: Both management and the Company's board of directors are involved in the oversight of risks from cybersecurity threats. The Company's information security program is designed to ensure that management and the board of directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and Chief Financial Officer ("CFO") and Vice President ("VP") of IT Operations and Strategy covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT Operations and Strategy, who reports to the CFO. The qualifications of the VP of IT Operations and Strategy include 25 years of IT management, cybersecurity and information governance experience. The VP of IT Operations and Strategy is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems and operations, in order to prioritize mitigation efforts.


text: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols.


text: Incident Response Plan Oversight: Management reviews, updates and approves the Company's incident response plan. Management ensures that the plan is tested annually to determine the Company's ability to respond effectively. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.


text: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.


text: Reporting to the Audit Committee: Management provides an annual comprehensive report to the Audit Committee on the Company's cybersecurity posture, incident response activities and risk mitigation efforts.


text: The VP of IT Operations and Strategy is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT Operations and Strategy and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT Operations and Strategy then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.


text: Cybersecurity threats and computer crime pose a risk to the security of the Company's information technology ("IT") systems and those of third-party service providers with whom it does business, as well as the confidentiality, integrity and availability of the data stored on those systems. As part of our overall risk management framework, the Company has developed and maintains an information security program consisting of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risks.


text: Effective assessment, identification and management of material risks from cybersecurity threats involve a comprehensive and proactive approach. The Company's key processes include, but are not limited to, the following:


text: The Company's IT department has developed and implemented cybersecurity policies and procedures designed to align with industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and applicable regulatory requirements.


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.


text: Employee Training and Awareness: Mandatory ongoing cybersecurity training is provided to all employees to educate them about potential cybersecurity risks. Management fosters a culture of cybersecurity awareness and encourages employees to be proactive in identifying and reporting security issues.


text: Access Control and Authentication: The IT department maintains strong access controls and multi-factor authentication to ensure that only authorized personnel have access to sensitive systems and data. This access is regularly reviewed and updated as needed based on job roles and responsibilities.


text: Security Control: The IT department has implemented and continually monitors security controls, including firewalls, end-point detection and response, intrusion detection/prevention systems, file integrity monitoring and data encryption, to protect against cybersecurity threats. These tools and controls are regularly updated to address vulnerabilities and ensure the security of information technology infrastructure.


text: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with the Company's policies, and any identified weaknesses are promptly addressed.


text: Vulnerability Scans: Vulnerability scans are executed quarterly across the environment to proactively identify software weaknesses and vulnerabilities that could be exploited in a cybersecurity attack. Any identified vulnerabilities are promptly addressed.


text: Encryption and Data Protection: Encryption methods are in place to protect certain sensitive data. There are also programs in place to monitor and secure the Company's retained data.


text: Asset Inventory: The Company maintains an up-to-date inventory of all assets, including hardware, software, data and network infrastructure. Assets critical to the Company's operations have been identified and prioritized accordingly.


text: Continuous Monitoring: The IT department has implemented monitoring tools and processes to detect and respond to cybersecurity threats in real time.


text: A third-party security information and event management ("SIEM") partner provides security monitoring and alerts twenty-four hours a day, seven days a week. The Company engages an independent Qualified Security Assessor organization to perform penetration testing in order to validate the Company's Payment Card Industry ("PCI") compliance and adherence to the PCI Data Security Standard. The Company also collaborates with outside legal counsel to ensure compliance with regulatory requirements.


text: The Company has implemented and continues to maintain its IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with third-party service providers. These include, but are not limited to, an IT acceptable use policy, a contractor/consultant work policy and a vendor management policy.


text: The Company has experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on its business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on the Company's business strategy, results of operations, or financial condition to date, any actual or perceived breach of its security could cause operational disruption and result in delays or inability to produce, print and deliver its publications and other third-party print publications, damage the Company's reputation, cause the Company to lose existing customers, prevent the Company from attracting new customers, or subject the Company to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect the Company's business strategy, results of operations, or financial condition. In addition, more resources may be needed for the security of the Company's information technology systems in the future, which could increase the cost of doing business or otherwise materially adversely affect the Company's business strategy, results of operations, or financial condition.


text: Both management and the Company's board of directors are involved in the oversight of risks from cybersecurity threats. The Company's information security program is designed to ensure that management and the board of directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and the Vice President of Information Technology ("VP of IT") covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT, who reports to the Company's President. The qualifications of the VP of IT include 26 years of IT management, cybersecurity and information governance experience. The VP of IT is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems and operations, in order to prioritize mitigation efforts.


text: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols.


text: Incident Response Plan Oversight: Management reviews, updates and approves the Company's incident response plan. Management ensures that the plan is tested annually to determine the Company's ability to respond effectively. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.


text: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.


text: Reporting to the Audit Committee: Management provides an annual comprehensive report to the Audit Committee on the Company's cybersecurity posture, incident response activities and risk mitigation efforts.


text: The VP of IT is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of Brookfield Oaktree Holdings, LLC oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of Brookfield Oaktree Holdings, LLC on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of Brookfield Oaktree Holdings, LLC.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside Oaktree's and our control.


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Our board of directors oversees our cybersecurity program and receives quarterly updates from the cybersecurity team on matters including Oaktree's cyber risk management program (and risks to us related to cybersecurity) and updates to the cybersecurity program, including active and recently completed initiatives.


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors – Risks Relating to Our Business and Structure – We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of BOH oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of BOH on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of BOH.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 25 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Prosper recognizes the critical importance of protecting the company's assets and customer data against new and existing risks using appropriate organizational measures, policies, procedures, and technical solutions while maintaining robust cybersecurity measures to safeguard our information systems and protect the security, confidentiality, integrity, and availability of our data.

companyName: PROSPER MARKETPLACE, INC


text: Managing Material Risks & Integrated Overall Risk Management Prosper has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information security ("InfoSec") team works closely with our information technology team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Third-Party Risk Management Engagement Prosper engages with a range of external experts, including external auditors, cybersecurity assessors and penetration testers as part of our InfoSec and cybersecurity programs. Our collaboration with these third-parties includes services such as external audits, threat assessments and guidance on key security initiatives. These partnerships allow us to leverage specialized knowledge and insights, consistent with our aim for industry-best practices.