text: As mentioned, the Company's Information Security Officer is primarily responsible for managing and updating the information security program. The responsibilities for managing the information security program include cybersecurity risk assessment, assessing the types and appropriateness implemented controls and coordinating related control testing, coordinating user training with each department and the appropriateness, data storage and maintenance, incident response, and third-party risk management. Specifically, the information technology department, as a whole, consists of information security professionals with varying degrees of education and experience with senior management in department having higher professional education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, the Company's Information Security Officer and Chief Information Officer have relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate actions taken the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.

companyName: CITY HOLDING CO

ticker: CHCO

secItem: Item 1C


text: The Company's information security program encompasses the security policies and procedures in place throughout the enterprise network to address compliance, transaction, reputation, and strategic risks. Our Information Security Officer is primarily responsible for this managing the information security program that includes identifying, assessing, and mitigating cyber threats. Our Information Security Officer reports directly to the Chief Information Officer.


text: Our objective for managing cybersecurity as part of the information security program is to ensure adequate procedures and proper controls are in place in order to provide an objective system for recording and aggregating information, supporting the institution's strategic goals and objectives, and protecting the security and confidentiality of the institution's customers and business activities. Our information security program leverages guidance from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The information security program is periodically reviewed by the board of directors and updated by the Information Security Officer to adapt to potential new threats and conditions.


text: The Company employs a combination of patch management, network security, malicious code prevention, and user awareness and training to assist with preventing cybersecurity incidents. Users are made aware of policies and procedures regarding appropriate use of networks, systems, and applications. Additionally, employees are trained in handling sensitive data and made aware of specific requirements when handling client data. Review and assessment of network infrastructure is completed, periodically. The Company, in certain instances, may rely on vendors, third-party support, or other outsourcing opportunities. Before introducing a new product or service, the internal controls and competence of a vendor, maintenance and upkeep of a third-party provider's systems, and financial condition of the third-party vendor are evaluated. Internal and external auditors and independent external partners are engaged and periodically review the Company's processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Policy that provides a documented framework for bringing together and organizing the resources for dealing with any event that harms or threatens the security of information. The goal of the Incident Response Policy is to facilitate a quick and efficient response to incidents, and to limit their impact while protecting information assets. The plan defines roles and responsibilities, documents the steps necessary for effectively and efficiently managing an information security incident, and defines channels of communication. The Information Security Officer and Chief Information Officer coordinate investigations of potential cybersecurity incidents.


text: Our internal processes, and controls are designed to contain, mitigate, or resolve cybersecurity incidents. As of the report date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "System Failure, Cybersecurity Breaches, Fraud and Employee Misconduct Could Subject the Company to Increased Operating Costs, as Well as Litigation and Other Potential Losses" in Item 1A. Risk Factors.


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. LNC's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: The work done by each of these divisions is applied both tactically and strategically to operations, as well as to broader risk management activities.


text: The governance, risk and compliance division of the Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the company's most significant IT and cyber risks, the results of which are leveraged by IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.


text: The work done by the Information Security team integrates into the LNC's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on LNC's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, LNC's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the IT leadership team and the Audit Committee of LNC's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.


text: While the Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.


text: Monitoring and Incident Response The CSRI division of the Information Security team is responsible for the operation of LNC's internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of LNC's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from LNC's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.


text: The Privacy team, which is part of the compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into the Information Security incident response program. The Information Security team works closely with the Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems or the information systems of third parties on which we rely may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses" and 'Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: LNC's Board of Directors is responsible for regular oversight of LNC's overall risk management process. The Board reviews the most significant risks the company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the LNC Board of Directors.


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer and Head of IT ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.


text: The current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third-party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses," "Item 1A. Risk Factors – Operational Matters – We are subject to third-party information system and other operational risks due to our reliance on third-party vendors and suppliers and the outsourcing of certain of our business operations" and "Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer (" CISO ") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.


text: Information security and data privacy have been, and continue to be, vitally important to the Company. Our Board, in coordination with the Audit Committee, provides oversight of the Company's major information technology risk exposures, including those related to cybersecurity, data privacy and data security, and oversees the steps management has taken to monitor and mitigate such risk exposures. Cybersecurity and related matters are recurring topics at Audit Committee meetings and the Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") regularly provide the Audit Committee, and periodically the entire Board, with updates on the Company's cybersecurity risk profile and strategy. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 38-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our governance, risk and compliance team conducts due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), integrated into our enterprise crisis management and business continuity program, which provides protocols and procedures for evaluating and responding to material cybersecurity incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity event.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 39-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber or other data security incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our IT governance, risk and compliance team conduct due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), which provides protocols and procedures for evaluating and responding to material cybersecurity and other data security incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity or data security event.


text: As of the date of this report, no cybersecurity or data security incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."


text: We recognize the importance of maintaining the safety and security of our people, systems, and data and have a holistic process, supported by our management and Board of Directors, for overseeing and managing cybersecurity and related risks. As part of AES, we are also supported by AES' cyber risk management program.

companyName: IPALCO ENTERPRISES, INC.


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2020.


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cyber security professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.


text: The Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.


text: We consider cybersecurity as part of the enterprise risk process, including organized and structured reporting protocols. The prioritization of cybersecurity risk is aligned with overall risk management processes.


text: In addition, the Company's management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. The Company's CEO, CFO and other members of senior management participate in such meetings.


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and the Board. We regularly practice our incident response through executive tabletop exercises.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are informed by frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program addresses threats in a prioritized manner and, in particular, focuses on the following key areas: • gap analysis to identify programmatic opportunities for improvement that can be incorporated into the cyber strategy; • policies and standards that are annually reviewed and communicated; • exceptions management and internal audits that support cybersecurity requirements through assessing control implementation risks; and • monitoring and regular reporting of cyber resilience and posture at operational and strategic levels.


text: We engage assessors, consultants, auditors, or other third parties in connection with any such processes, including: • external vulnerability assessments, including penetration tests; • internal audit reviews; • threat intelligence; • incident management; • audits of NERC-Critical Infrastructure Protection regulated environments by the NERC Registered Regional Entity; and • program development support, as needed.


text: Our risk management program for third-party service providers includes risk-based assessments of their interactions with our data and systems. We implement monitoring and response processes for key third-party service providers.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in training, including phishing exercises, monthly safety meetings, and an annual cybersecurity awareness update. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Potential security breaches (including cybersecurity breaches) and terrorism risks could materially and adversely affect our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.


text: While cybersecurity risk can never be eliminated entirely, we devote significant resources to our cybersecurity program that we believe is reasonably designed to mitigate our cybersecurity and information technology ("IT") risks—which include, among others, unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. Cybersecurity risk management processes have been integrated into the Company's overall risk management system, including our ERM process. Threats to our cyber/digital landscape are regularly identified and then assessed in terms of their potential business impact. Mitigation strategies are developed based on our assessment of the potential business impact (both quantitatively and reputationally) of the threat. Because a cybersecurity threat can have implications beyond IT, the Company draws on cross-functional expertise to determine the potential business impact and proportional mitigation efforts or solutions. This expertise may involve third-party resources with functional expertise related to the specific threat or business impact. As part of our risk management profile, we regularly review available cybersecurity data regarding our business partners (suppliers, dealers, third-party service providers and others) and regularly engage with them on risk mitigation efforts.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company e-mail and access to Company assets.


text: When a cybersecurity incident is detected, our response is governed by our IT Security Incident Response Policy, providing a rigorous, standardized process to ensure efficacy of the response. In general, when a cybersecurity incident is identified, our policy requires an initial review and triage of the incident. When a cybersecurity incident is determined to be significant, it is brought to the attention of a cross-functional leadership team consisting of our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Human Resources Officer and General Counsel and is addressed by that team, along with other internal stakeholders, using processes that leverage subject-matter expertise from across the Company. As with risk mitigation, we may engage third-party advisors, from time to time, as part of our incident response and management process. As part of our risk mitigation efforts, we also maintain cybersecurity insurance to defray the costs of potential information security breaches.


text: In fiscal 2024, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with quarterly reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: Reporting directly to our Chief Operating Officer, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.


text: In fiscal 2025, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with semi-annual reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: Reporting directly to our General Counsel, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.


text: The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer ("CISO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: The Company's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and routine vulnerability scans, and a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.


text: We maintain policies and procedures for the safe storage, handling and secure disposal of customer information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could, ultimately, place sensitive customer or employee information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails targeting employees. We test employees monthly to determine their susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), Chief Legal Officer ("CLO") and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.


text: The Company conducts due diligence prior to engaging third-party service providers which have access to the Company's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Seacoast requires critical and high-risk providers to have an ongoing monitoring plan.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and cybersecurity risk has increased in recent years. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. See Item 1A. "Risk Factors" for further discussion of the material risks associated with an interruption or breach in our information systems or infrastructure.


text: Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee ("ITC").


text: The Enterprise Risk Management Committee ("ERMC") of the Board has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO and CIO attend ITC and ERMC meetings and provide cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program summary report to the full Board of Directors. Our CRO, in conjunction with our CISO and CIO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CISO, the Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. In 2023 our CISO reported to our CIO; however, for 2024 the CISO will report to our CRO, who in turn reports to our CEO.


text: Our CISO has cybersecurity experience spanning more than 20 years. Prior experience includes serving as the CISO at a mid-size regional financial institution and serving in manager roles at large professional services firms. He holds a degree in Computer Science and Mathematics and maintains several industry certifications.


text: The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer, who reports to our Chief Risk Officer, manages our information security strategy and development within our overarching Enterprise Risk Management program.


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third party technology and expertise as appropriate.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the CEO, CFO, CRO, Head of Legal, and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.


text: Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee.


text: The Enterprise Risk Management Committee of the Board has primary responsibility for overseeing the Company's comprehensive ERM program. The ERM program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO attends ITC and ERMC meetings and provides cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program to the full Board of Directors. Our CRO, in conjunction with our CISO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. The Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats.


text: Our CISO has cybersecurity and information technology experience spanning more than 30 years. Prior experience includes serving as the CISO for a multi-national cloud hosting organization serving the legal community and several senior leadership roles in both information technology and information security at a large financial institution, Fortune 500 organizations and a large professional services firm. The CISO holds a degree in Computer Science and maintains appropriate industry certifications.


text: The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the NIST Cybersecurity Framework. HCSG regularly monitors and measures the performance of its IT System and Assets and its Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize, or process HCSG's data take a similar, risk-based approach to information security.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Management maintains the cybersecurity risk prevention program which includes ongoing employee education and procedures for cybersecurity incident prevention, detection and response. The Company retains third parties, including IT professionals and legal counsel, specializing in cybersecurity risk management to assist in implementing cybersecurity controls. The Company oversees and identifies material risks from cybersecurity threats associated with its use of third-party service providers by reviewing SOC 1 or SOC 2 reports (whichever is more applicable) for key outsourced systems, including all systems which house protected health information or personally identifiable information. The cybersecurity risk prevention program is part of the Company's overall risk management program.


text: Please refer to the risk factor titled "Cyber-attacks and breaches could cause operational disruptions, fraud or theft of sensitive information" in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.


text: The Company has a Cyber Incident Response Plan ("IRP") which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, the Chief Compliance Officer provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.


text: Board of Directors' Oversight of Cybersecurity Risks Our Board is responsible for overseeing the Company's risk management process. The Board focuses on the Company's general risk management strategy, including the most significant risks facing the Company, and ensures that appropriate risk mitigation strategies are implemented by management. The Audit Committee oversees the Company's cybersecurity risk mitigation efforts. The Audit Committee reports to the full Board as appropriate, including when a matter rises to the level of a material risk.


text: The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the National Institute of Standards and Technology Cybersecurity Framework. The Company regularly monitors and measures the performance of the IT Systems and Assets and the Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize or process our data take a similar, risk-based approach to information security.


text: Please refer to the risk factor titled "We have experienced cyber attacks and breaches, and may in the future experience cyber attacks and breaches which could cause operational disruptions, fraud or theft of sensitive information." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.


text: As previously disclosed in a Form 8-K filed on October 16, 2024, on October 9, 2024 we identified a cybersecurity incident, which involved unauthorized activity within some of our systems. We immediately activated the Company's Cyber Incident Response Plan ("IRP") to investigate such activity with the assistance of leading third-party cybersecurity experts. We also notified law enforcement authorities. We continue to monitor the situation and take appropriate actions consistent with our response protocols. As of the date of this filing, the incident has not caused, and is not expected to cause, disruption of the Company's business operations. And although there can be no assurance, we do not believe the identified cybersecurity incident will have a material effect on our business, financial condition, results of operations or cash flows.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.


text: The Company has an IRP which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, Mr. Bundick provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.


text: UnitedHealth Group manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and Chief Information Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Chief Digital and Technology Officer and Chief Information Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We have obtained various certifications from industry-recognized certifying organizations as a result of certain external audits. We also perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit and Finance Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Chief Digital and Technology Officer and Chief Information Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Information Security Officer has experience leading a global digital portfolio for a large multinational corporation and held key leadership roles for a large technology and software company, including overseeing information security, before joining UnitedHealth Group.


text: As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident, which we believe was committed by cybercrime threat actors. As of the date of this report, we have not determined the incident is reasonably likely to materially impact our financial condition or results of operations.


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and our Chief Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the effectiveness of the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and the Chief Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Audit and Finance Committee has also added a leading cybersecurity incident and response firm to serve as its advisor on cybersecurity matters.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of significant threats and incidents to management, including the Chief Digital and Technology Officer and the Chief Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee and appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and evaluate whether they employ appropriate and effective controls and continuity plans for their systems and operations.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to address unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Chief Digital and Technology Officer and our Chief Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Security Officer has more than 30 years of experience as a security professional in both the private and public sectors, including in law enforcement. Prior to joining UnitedHealth Group, he served in security leadership roles at several large multinational corporations and has additionally served on cybersecurity advisory boards for some of the largest corporations in the country.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: We continuously assess our risk of cyber threats to adapt quickly to the ever-changing challenges and risks surrounding cybersecurity. Atmos Energy has implemented policies, procedures, and controls to identify, protect, detect, and respond to cyberattacks or acts of online terrorism. Atmos Energy is also subject to the U.S. Department of Homeland Security Transportation Security Administration (TSA) security directive for our natural gas pipeline monitoring and control systems.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: The potential impact of cybersecurity risks on our business operations, results of operations, or financial condition is discussed in the "Technology and Cybersecurity Risks" section of Item 1A "Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties, or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to identify, protect, detect, and respond from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations, and financial condition in the future. The following describes our risk management and strategy and corporate governance as it pertains to cybersecurity.


text: Risk Management and Strategy Atmos Energy's cybersecurity program leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) in its design of controls intended to reduce the risk and potential impact of cybersecurity incidents. This comprehensive approach encompasses continuous monitoring, risk assessments, a cybersecurity incident response plan, and regular evaluations to align our practices with industry standards. Additionally, we actively engage in cybersecurity risk management practices and continually improve procedures and practices to support the continued safe and reliable delivery of natural gas to our customers.


text: The identification and management of cybersecurity risk is a component of our Integrated Risk Management process, which applies adaptive process improvement to help us respond to the changing cybersecurity landscape. Additionally, we use third parties to enhance our collective capability to monitor, detect, and respond to cybersecurity incidents. Further, we maintain collaborative relationships with government officials, law enforcement, and industry peers to keep informed of trends and potential cyber tactics. Finally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: We have an information technology cybersecurity incident response plan to manage cybersecurity incidents. The plan provides guidelines for actions in response to cyber security incidents that may occur at or otherwise affect Atmos Energy. These guidelines include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors. This plan, which is periodically reviewed and tested, is supported by third parties to provide guidance and support to our cybersecurity management team.


text: We also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or our information technology systems. Atmos Energy currently conducts cyber assessments on potential vendors that will have access to information technology systems, data or facilities that house such systems or data. Following approval, those vendors are contractually required to manage their cybersecurity risks and provide notification in the event of a cybersecurity incident.


text: Our Vice President and Chief Information Officer (CIO), who has over two decades of experience in information technology, is responsible for overseeing our cybersecurity program. The CIO oversees an IT Information security team responsible for our overall cybersecurity program. This team is comprised of several IT professionals with varying degrees of cybersecurity experience and is led by our Director – Cybersecurity who has over 30 years of experience in information technology and cybersecurity. The Director – Cybersecurity reports to the CIO, who reports to the Senior Vice President and Chief Financial Officer.


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary and Senior Vice President, Human Resources. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.


text: The Audit Committee of the Board of Directors oversees the company's cybersecurity risks. Additionally, our Board of Directors periodically engages with third-party advisors to provide further education about cybersecurity risks.


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary, Senior Vice President, Human Resources, and Senior Advisor. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Our operations are dependent on our ability to process financial transactions in a secure manner. Failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers, could disrupt our business or the businesses of our customers, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.


text: We seek to use a defense-in-depth approach for cybersecurity management, layers of technology, policies and training at all levels of the enterprise designed to keep our assets secure and operational. We use various processes as part of our efforts to maintain the confidentiality, integrity and availability of our systems, including security threat intelligence, incident response, identity and access management, endpoint extended detection and response protection, network segmentation, data encryption, and event monitoring. In an effort to validate the effectiveness of our cybersecurity program and assess such program's compliance with legal and regulatory requirements, we engage third-party service providers to perform audits, assessments and penetration tests.


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. All employees who have access to our systems are required to undergo annual cybersecurity training and, each year, our employees must review and acknowledge our cybersecurity policies. Further, our Information Systems team is trained to understand how to manage, use and protect personally identifiable information. User access controls have been implemented to limit unauthorized access to sensitive information and critical systems. Employees are required to use multifactor authentication and keep their passwords confidential, among other measures.


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, before contracting with certain technology service providers, when possible, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and to require them to adhere to security standards and protocols. Finally, we maintain cybersecurity insurance coverage.


text: Impact of Risks from Cybersecurity Threats While we have not been materially impacted by cyber incidents, we have been subject to other intentional cyber incidents from third parties over the last several years, including denial of service attacks which attempt to interrupt service to customers and malicious software attacks on computer systems which attempt to allow unauthorized entrance. We also face risks related to cyber attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber attacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third party service providers to conduct other aspects of our business operations and face similar risks relating to them. While we conduct security assessments on our higher risk third party service providers, we cannot be sure that their information security protocols are sufficient to withstand a cyber attack or other security breach. There can be no assurance that cyber incidents will not occur and they could occur more frequently and on a more significant scale.


text: Board of Directors' Oversight and Management's Role Our Information Systems team is responsible for our efforts to comply with applicable cybersecurity standards, establish effective cybersecurity protocols and protect the integrity, confidentiality and availability of our Information Systems infrastructure. This team is responsible for cybersecurity threat prevention, detection, mitigation and remediation for the combined organization. Our cyber incident response plan requires all detections of suspicious activity in our Information Systems environment to escalate that activity to our Information Security Team who then evaluates the threat. Management (including representatives from the legal, operations, human resources, Information Systems and risk management departments) is notified by the Information Services team whenever a discovered cybersecurity incident may potentially have a significant impact on our business operations.


text: Our Board of Directors has delegated the responsibility for the oversight of cybersecurity risks to the Information Security and Technology Committees, which are ultimately responsible for assessing and managing our material risks from cybersecurity threats. The Information Security team and the Information Security Committee provide periodic cybersecurity program updates to senior management and to the Board. Management also updates the Board as new risks are identified and the steps taken to mitigate such risks.


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Services Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.


text: Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework. Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification. We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection. We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation. Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation. Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis. We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer and other senior executives are part of the notification chain.


text: Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and their team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.


text: The CISO brings nearly two decades of cybersecurity experience to their work at Verizon. Prior to joining Verizon, they held executive-level cybersecurity roles at other large public companies, where they were responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of their leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the presidents of Verizon Global Services and Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.


text: Verizon's Management Audit Committee (VMAC), which includes our Chief Financial Officer, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.


text: Verizon also operates a robust internal audit program. Each year, Verizon's internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. The results of the assessment are presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.


text: Board Oversight of Cybersecurity Risk The Audit Committee of the Board of Directors (Board) has primary responsibility for overseeing Verizon's risk management and compliance programs relating to cybersecurity and data protection and privacy.


text: As part of the Board's oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the full Board dedicated to Verizon's cybersecurity risks, threats and protections. The CISO provides a mid-year update to this annual review to the Audit Committee and, as warranted, additional updates throughout the year. The Audit Committee also receives a report from senior management on Verizon's cybersecurity posture and related matters at each of its other meetings during the year at which the CISO is not present.


text: Supplier Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Supplier Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyber attacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While, to date, we have not been subject to cyber attacks that, individually or in the aggregate, have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework - Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification - We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection - We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation - Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation - Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis - We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.


text: Our processes for assessing, identifying, and managing cybersecurity risks include tabletop exercises to test and reinforce our incident response controls, control gap analyses, penetration tests, data recovery testing, internal and external security assessments, and threat intelligence monitoring. We also conduct annual cybersecurity and data privacy training, which is mandatory for all our full- and part-time employees. In addition to our in-house cybersecurity capabilities, we also engage assessors, consultants and other third parties to assist with various cybersecurity matters. For example, Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer (CEO) and other senior executives are part of the notification chain.


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and her team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.


text: The CISO brings nearly two decades of cybersecurity experience to her work at Verizon. Prior to joining Verizon, she held executive-level cybersecurity roles at other large public companies, where she was responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of her leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer (CFO) and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the head of Verizon Global Services and the President of Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.