text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CISO has 27 years of cybersecurity experience, 17 of which are in the oil and gas industry. The Company's CISO is certified in strategic planning, policy and leadership, and is one of less than 400 CISOs globally that has graduated from the FBI's CISO Academy in Quantico, Virginia. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors.

secItem: Item 1C


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engages a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; Director of Corporate Security; and the Information Security Manager. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO annually briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.


text: The Company relies on our internal Technology Solutions team and third-party vendors to provide effective and efficient service to our customers, process claims and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information. We monitor the risks presented by the possibility of cybersecurity breaches of any of these systems. Accordingly, we have significantly invested, and will continue to invest, in technology security initiatives, information technology policies and resources, and teammate training to mitigate the risk of improper access to private information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full Board. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief information security officer, who is typically accompanied by the Company's chief security officer and chief information officer, on the Company's latest information security risks and mitigation strategies.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.


text: The Company's chief information security officer, under the direction of our chief security officer, is responsible for developing and implementing our information security program. Our chief information security officer and our chief security officer each has more than 35 years of experience in technology, operations, information risk and security. Our chief information security officer has deep experience developing comprehensive information security programs for large and complex financial services and insurance organizations. Our chief security officer brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.


text: Our Information Security team has deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.


text: In addition, external partners and products are submitted through a security risk assessment process facilitated through our security scorecard tool for data security risk and vulnerability maturity rating, and our teammates undertake a yearly security and compliance online training with test certification. Our teammates are also subject to security awareness communications and random simulated phishing campaigns. Teammates are also required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on location. In 2023, substantially all Brown & Brown teammates completed ethical conduct training; cybersecurity awareness training; the California Consumer Privacy Act (CCPA) Survey; and the Annual Certification for Insurance Licensees training as a reminder of the regulatory obligation to report certain changes to the jurisdictions in which they are licensed.


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our Security Operations Center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions teams for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the Board of Directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.


text: We recognize the importance of maintaining the security of our electronic networks, information systems, and data. We face significant and persistent cybersecurity threats, including risks heightened by the numerous geographies that we serve; our reliance on complex information networks; remote work among certain of our employees; reliance on digital operations to service certain of our customers; and our use of third-party software and services. Our vendors and customers also face cybersecurity threats. A cybersecurity incident impacting our company or any of our vendors or customers could materially adversely affect our operations and/or financial condition. To protect against and prevent cybersecurity incidents, we employ a comprehensive approach where our Board and management teams work together to oversee our cybersecurity program. We are committed to maintaining robust cybersecurity oversight, controls, and strategies that are designed to help us assess, identify, and manage cybersecurity risks.

companyName: Regional Management Corp.

ticker: RM


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our enterprise risk management ("ERM") program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.


text: Our Senior Director of Information Security (the "SDIS"), who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.


text: In addition, we engage third-party consultants to conduct evaluations of the operational effectiveness of our security controls. These consultants perform penetration testing on our cybersecurity practices and procedures on an annual basis.


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cyber security events that may negatively impact us or our data.


text: We also require all employees to perform annual cybersecurity training. We expect our employees to follow our company-wide policies and procedures relating to cybersecurity matters, which include policies related to IT security, remote access, multifactor authentication, use of the internet and social media, and handling of confidential information, among other items. Additionally, while we have insurance coverage in place designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for information about our cybersecurity risks.


text: Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data intrusions, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We have established an enterprise-wide cybersecurity program that provides overall governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program is based upon leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework, International Organization for Standardization, and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, and to enhance our ability to focus resources appropriately.


text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning.


text: We have implemented a third-party risk management process that assesses the inherent risks of third-party service providers and informs our engagement, contracting with, and oversight of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and vulnerabilities, of prospective and existing service providers.


text: We manage information security incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to data security and privacy risks, and reviews information technology's program to monitor and assess data security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.


text: Our CISO is a certified information security manager, and has primary responsibility for our cybersecurity program, and the management and oversight of our information security department. Our CISO has more than 20 years of experience in information technology, including 13 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.


text: As a global technology company, and the provider of electronic trading platforms and solutions for fixed-income and other securities, we view cybersecurity as fundamental to our business. Accordingly, we aim to appropriately secure all of our business operations, including information that we generate in the performance of our services, and data provided to us by third parties, including clients, vendors, business partners and employees.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and control the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the Institute of Standards and Technology ("NIST") Cyber Security Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains robust policies and procedures relating to our data collection, use and processing activities as well as mechanisms for monitoring our data systems and usage. We do not have retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws, including the EU General Data Protection Regulation (the "GDPR"), the UK Data Protection regime and the California Consumer Privacy Act (the "CCPA"), in the countries in which we operate, and meet our contractual commitments to our clients. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use, and storage of data.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported, as appropriate, to the Risk Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."


text: The Board's Oversight of Cybersecurity Risk The Board recognizes the critical importance of maintaining the trust and confidence of our clients, business partners and employees. The Board is actively involved in oversight of the Company's ERRF, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Board is responsible for overseeing the Company's risk management processes over the short-, medium- and long-term by staying informed of the Company's material risks and evaluating whether management has reasonable controls in place to address such material risks. As part of its oversight responsibilities, the Board dedicates meaningful time and attention to oversight of cybersecurity risk. The Board is not responsible, however, for defining or managing the Company's various risks. See "Management's Involvement in Cybersecurity Risk Oversight" below.


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional reports as needed, on cybersecurity risks. Such reports address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Management System Committee, which includes our Chief Executive Officer and Interim Chief Financial Officer ("CEO"), CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Management System Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.


text: The CISO has served in various roles in information technology and information security for over 30 years, including previously serving as the Deputy Chief Information Security Officer of a large European banking group. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP). The CIO holds undergraduate and masters degrees in computer science and has served in various roles in information technology for over 25 years. The Company's CRO holds an undergraduate degree and has over 25 years of experience managing risks, including risks arising from cybersecurity threats.


text: The Company is ISO/IEC 27001:2013 certified, which is a global standard that specifies the requirements for establishing, implementing, maintaining, and continually improving information security management systems. Additionally, we have received an independent examination regarding our compliance with SOC 2 Type 1 and Type 2.


text: We employ information systems to support our business. As is the case for other manufacturing companies of comparable size and scope, we, from time to time, experience attempted cyber-attacks on our information system. We also face risks associated with other potential significant failures or disruptions of our information technology networks. We utilize a risk-based, multi-layered information security approach that incorporates some of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have adopted and implemented this approach to identify and mitigate information security risks in a manner that we believe is commercially reasonable for manufacturing companies of our size and scope.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"). Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, employee reports, law enforcement reports, or other third-party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a cybersecurity operations team with round-the-clock monitoring, and the CIO and Director of Cybersecurity receive regular reports on industry activity. Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CIO along with the Director of Cybersecurity will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, Chief Administrative Officer and General Counsel and Executive Vice President - Manufacturing. The Company may engage third-party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, our Executive Vice President, Chief Administrative Officer and General Counsel, in consultation with the CIO and Director of Cybersecurity, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U.S. securities laws. Following a cybersecurity incident, the Executive Vice President and Chief Financial Officer will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds Bachelor's and Master's degrees in Business Administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO maintains over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with 3rd party security partners surrounding monitoring and incident response services.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Fund has no directors, principal officers or employees, the Managing Owner is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Managing Owner's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Invesco's information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has over 25 years of experience, specializing in information security and risk management. Our manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect our information assets. The program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is Invesco's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this committee include Invesco's Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Fund's business strategy, results of operations or financial condition as of December 31, 2023, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see "Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks" in Item 1A. Risk Factors.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco CurrencyShares Japanese Yen Trust

ticker: FXY


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.'s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2023, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.


companyName: Invesco DB US Dollar Index Trust


companyName: Invesco CurrencyShares Swiss Franc Trust

ticker: FXF


companyName: Invesco CurrencyShares Canadian Dollar Trust

ticker: FXC


companyName: Invesco DB Commodity Index Tracking Fund

ticker: DBC


companyName: Invesco CurrencyShares Euro Trust

ticker: FXE


companyName: Invesco CurrencyShares British Pound Sterling Trust

ticker: FXB


companyName: Invesco CurrencyShares Australian Dollar Trust

ticker: FXA


text: As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: Through a combination of governance, risk, and compliance (GRC) resources, we • proactively monitor IT controls to ensure compliance with legal and regulatory requirements, • perform third-party risk management assessments, • implement processes designed to ensure essential business functions remain available during business disruptions, • develop and update incident response plans to address potential weaknesses, and • maintain cyber incident management and reporting procedures.


text: Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date, we are not aware of any incident or cybersecurity risks having a material impact on our business, results of operations or financial condition.


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches.


text: In an effort to reduce the likelihood and severity of cyber intrusions, the Companies have a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of data and systems. Consideration of cybersecurity risks is a key component of the Companies' overall risk management and integrated into processes such as evaluation of potential new vendors or suppliers. The Companies are subject to mandatory cybersecurity regulatory requirements, interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The Companies' corporate intelligence and security program includes both cybersecurity and threat intelligence components as part of its evaluation and mitigation of risks. The evaluation of risks includes consideration of cybersecurity and privacy risk, including potential impact on the Companies' employees, customers, supply chain and other stakeholders, intelligence briefings on notable cyber events impacting the industry and evaluation of insider threats. The Companies utilize a robust set of internal and third-party assessment tools to test its cyber risk management policies, practices and procedures as well as challenge assumptions upon which its defenses are built. These assessments provide opportunities for self-critical analysis and constructive feedback needed to build cyber resilience. Trainings are routinely provided to employees to help identify, avoid and mitigate cybersecurity threats and to ensure an understanding of the Companies' cyber risk management policies. In addition, risk assessments are conducted as a component of the evaluation of vendors and suppliers.


text: The Companies' current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, the Companies have not experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. The Companies have identified the risk that a hostile cyber intrusion could severely impair the Companies' operations, lead to disclosure of confidential information, damage the Companies' reputation or otherwise have an adverse effect on the Companies' business as disclosed under the Operational Risks header within Item 1A. Risk Factors.


text: Dominion Energy's Board of Directors, including its finance and risk oversight committee, provides oversight of the Companies' risks from cybersecurity threats. Dominion Energy's Board of Directors as well as its finance and risk oversight committee receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity and chief information officer. These presentations and reports address a broad range of topics, including the Companies' cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2023 of its second practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including an assessment by an independent consulting firm of management's response in a ransomware tabletop drill.


text: The Companies utilize an organization structure known as a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the chief security officer. The chief security officer joined Dominion Energy in this role in 2018 and has an extensive background in security having retired from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. The chief security officer belongs to the Federal Bureau of Investigation's Domestic Security Alliance Council, the Department of Homeland Security's Classified Intelligence Forum and is a member of the national Government/Business Executive Forum. In addition to serving on multiple university advisory boards, the chief security officer also serves on the Commonwealth of Virginia's Informational Technology Advisory Council.


text: The director of cybersecurity has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity has been involved in designing and evolving the Companies' cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.


text: In addition, management of cybersecurity threats is shared with the chief information officer who is responsible for the Companies' technology assets including hardware, software, networks, servers and telecommunications. The chief information officer has over 25 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management. In addition, the chief information officer previously served on the board of the Virginia Cybersecurity Partnership, a collaboration between private industry and the Federal Bureau of Investigation.


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as the Companies' operations, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to the Companies' executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.


text: The Companies maintain a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities, and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on the Companies' business operations, results of operations or financial condition.


text: In an effort to reduce the likelihood and severity of cyber intrusions, Dominion Energy has a comprehensive cybersecurity program covering its operations, including DESC, designed to protect and preserve the confidentiality, integrity and availability of data and systems. Consideration of cybersecurity risks is a key component of Dominion Energy's overall risk management and integrated into processes such as evaluation of potential new vendors or suppliers. Dominion Energy is subject to mandatory cybersecurity regulatory requirements, interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Dominion Energy's corporate intelligence and security program includes both cybersecurity and threat intelligence components as part of its evaluation and mitigation of risks. The evaluation of risks includes consideration of cybersecurity and privacy risk, including potential impact on Dominion Energy's employees, customers, supply chain and other stakeholders, intelligence briefings on notable cyber events impacting the industry and evaluation of insider threats. Dominion Energy utilizes a robust set of internal and third-party assessment tools to test its cyber risk management policies, practices and procedures as well as challenge assumptions upon which its defenses are built. These assessments provide opportunities for self-critical analysis and constructive feedback needed to build cyber resilience. Trainings are routinely provided to employees to help identify, avoid and mitigate cybersecurity threats and to ensure an understanding of Dominion Energy's cyber risk management policies. In addition, risk assessments are conducted as a component of the evaluation of vendors and suppliers.


text: Dominion Energy's current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, DESC has not experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. DESC has identified the risk that a hostile cyber intrusion could severely impair DESC's operations, lead to disclosure of confidential information, damage Dominion Energy's reputation or otherwise have an adverse effect on DESC's business as disclosed under the Operational Risks header within Item 1A. Risk Factors.


text: Dominion Energy's Board of Directors, including its finance and risk oversight committee, provides oversight of risks from cybersecurity threats to all Dominion Energy operations, including DESC. Dominion Energy's Board of Directors as well as its finance and risk oversight committee receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity and chief information officer. These presentations and reports address a broad range of topics, including Dominion Energy's cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2023 of its second practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including an assessment by an independent consulting firm of management's response in a ransomware tabletop drill.


text: Dominion Energy utilizes an organization structure known as a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the chief security officer. The chief security officer joined Dominion Energy in this role in 2018 and has an extensive background in security having retired from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. The chief security officer belongs to the Federal Bureau of Investigation's Domestic Security Alliance Council, the Department of Homeland Security's Classified Intelligence Forum and is a member of the national Government/Business Executive Forum. In addition to serving on multiple university advisory boards, the chief security officer also serves on the Commonwealth of Virginia's Informational Technology Advisory Council.


text: The director of cybersecurity has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity has been involved in designing and evolving Dominion Energy's cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.


text: In addition, management of cybersecurity threats is shared with the chief information officer who is responsible for Dominion Energy's technology assets including hardware, software, networks, servers and telecommunications. The chief information officer has over 25 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management. In addition, the chief information officer previously served on the board of the Virginia Cybersecurity Partnership, a collaboration between private industry and the Federal Bureau of Investigation.


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as Dominion Energy's operations, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to Dominion Energy's executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.


text: Dominion Energy maintains a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities, and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on Dominion Energy's business operations, results of operations or financial condition.


text: Governance and Responsibilities The Board recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management, or ERM. The Company seeks to mitigate cybersecurity risks through a cross-functional approach, including its Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by assessing, identifying, and managing risks from cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our Head of Information Technology (IT) oversees overall cybersecurity management, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic, but at least annually, reports to our Board or the Audit Committee of the Board of Directors, or the Audit Committee. The IT security team has over 40 years of combined technology experience, and over 20 years of experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The Company's Cybersecurity Committee is comprised of information technology, finance, legal, human resources, and data privacy employees, including the Head of IT. It meets regularly, but at least annually, to review and provide oversight of the Company's cybersecurity risks and data security programs, policies, and strategies. Pursuant to internal policies, the Head of IT will notify the Cybersecurity Committee of significant cybersecurity incidents and breaches. The Cybersecurity Committee (along with the Chief Financial Officer and General Counsel) reviews, analyzes, and responds to cybersecurity incidents and breaches. Additional responsibilities and risk mitigation strategies relate to business continuity and business resiliency capabilities.


text: The Company's Audit Committee has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and ERM, including with respect to cybersecurity, and to report to the Board annually. The Audit Committee is also responsible for overseeing the integrity and effectiveness of the Company's disclosure controls and procedures, which are designed to ensure that information related to cybersecurity risks and incidents is recorded, processed, summarized, and reported accurately and on a timely basis, to allow for timely decisions regarding disclosure of any such incidents. Our Audit Committee receives regular presentations and reports on cybersecurity risks from the executive management leadership team, which address recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee is also made aware of any potential material cybersecurity incident as well as ongoing updates regarding any such incident until it has been addressed by the executive management leadership team. On an annual basis, the Board discusses the Company's approach to cybersecurity risk management with the Audit Committee members and management (including members of the Cybersecurity Committee). Throughout the year, the Board and its committees engage with management to discuss a wide range of enterprise risks related to the Company's businesses, including cybersecurity, and they confirm the alignment of risk assessment and mitigation with business strategy.


text: The Company regularly assesses and tests its cybersecurity policies, standards, processes, and practices, including but not limited to audits, tabletop exercises, threat modeling, and penetration and vulnerability testing. The Company regularly engages outside advisors and experts to anticipate future threats and trends and to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Cybersecurity Committee, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Cybersecurity Technical Safeguards The Company invests in new information and cybersecurity services and technologies. Technical safeguards designed to protect the Company's information systems from cybersecurity threats include firewalls, continuous intrusion detection and response system(s), data leak prevention, enhanced email protection, antimalware functionality, and access controls, which are evaluated and improved through periodic assessments and cybersecurity threat intelligence.


text: Cybersecurity Incident Response and Recovery Planning The Company has established and maintains incident response and data recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis by the Cybersecurity Committee and members of the IT department.


text: The Company maintains a risk-based approach to identifying and overseeing risks from cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Current Cybersecurity Risk Posture To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see "Item 1A. Risk Factors - Our business and operations would suffer in the event of system failures."


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended December 31, 2023. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Ethereum Staking ETF

ticker: ETHE


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Zcash Trust (ZEC)

ticker: ZCSH


text: We recognize the importance of maintaining the trust and confidence of our customers, business partners and employees and we believe that security of our information systems and data is important to our business. We focus on preserving the confidentiality, security and availability of the information that we collect and store and have designed and implemented processes to assess, identify and manage material risks from cybersecurity threats. Our information security policies, processes and practices are integrated into our overall risk management programs and processes as a public company. As part of our risk management programs, we have developed and implemented several technical and organizational measures to help protect the security of our information systems and data. These measures include physical access controls, logical access controls, and other measures.

companyName: MARIN SOFTWARE INC


text: In terms of physical controls, we co-locate our servers and hosting equipment at a secure third-party data center in Las Vegas, Nevada, which enforces strict employee identification measures and restrictions on unauthorized personnel. In terms of logical and technical access controls, we have designed and implemented information security policies, system access policies, technical monitoring systems, and a variety of other policies and technical security measures. We require all employees to take training courses on an annual basis to review and better understand potential cybersecurity threats. We use third parties to conduct testing of our information systems on a periodic basis to test for potential vulnerabilities.


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. For third parties that we rely upon for certain IT systems, we seek to use only reputable providers, to use the most recently reliable versions of such systems, and monitor and address alerts for potential vulnerabilities to any such systems.


text: We engage in the periodic assessment and testing of policies, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, assessments and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures. We revise our policies or practices as appropriate based on the results of such assessments or testing.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition. We do not believe risks from cybersecurity threats are reasonably likely to materially affect us, but no assurances can be provided that, despite the implementation of security measures, our information systems and data, or those of our current and any future third parties on which we rely, will not be vulnerable to cybersecurity risks. Refer to Item 1A. Risk Factors – "If our security measures are breached or unauthorized access to customer data or our data is otherwise obtained, our solutions may be perceived as not being secure, customers may reduce the use or stop using our solutions and we may incur significant liabilities".


text: The Audit Committee of our Board of Directors (the "Audit Committee") is responsible for the oversight of risks from cybersecurity threats. Our management team, including our EVP Product and Technology, reviews and discusses a summary of our cybersecurity posture with the Audit Committee on a periodic basis. When covered during an Audit Committee meeting, the chairman of the Audit Committee reports on its discussion to the full Board of Directors.


text: Our management team, including our Chief Executive Officer, EVP Product & Technology, Chief Financial Officer and General Counsel, work collaboratively to design, implement and review our cybersecurity policies and processes and to respond to any cybersecurity incidents in accordance with our plans. Among our management team, our App Ops and Engineering teams are most responsible for assessing and managing cybersecurity risks. These teams have several years of experience in the IT industry, including experience managing cybersecurity risks. Our CEO, EVP Product & Technology, CFO and General Counsel each have degrees in their respective fields and each have more than 20 years of business experience. Our teams use the technical systems that we have implemented to monitor for cybersecurity threats and they coordinate responses to any perceived risks or vulnerabilities with our senior management team. Through ongoing communications among these teams, our EVP Product & Technology and other key team leaders monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and, when appropriate, report risks, threats or incidents to our Audit Committee.


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management is included within our overall enterprise risk management program.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: We have implemented a risk-based cybersecurity program to identify, assess, prioritize and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity and availability of our information and operational technology systems and data stored on those systems. In general, we seek to address cybersecurity risks through a risk-based, cross-functional approach that is focused on preserving the confidentiality, security and availability of our information and information systems, and to mitigate and respond effectively to cybersecurity incidents and threats. As appropriate, the Company engages external parties, including consultants, legal counsel and audit firms to enhance its cybersecurity oversight and assist with incident response. Our cybersecurity program includes:


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and endpoint detection and response systems, regular monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Security Policy and Requirements We have an Information Security Policy that details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources, including third parties we engage.


text: Roadmap and Risk Assessment We have a cybersecurity roadmap, which was first implemented in 2020, that provides a framework for prioritizing and managing our ongoing cybersecurity program. We conduct periodic risk assessments based on the National Institute of Standards and Technology ("NIST") cybersecurity framework to identify and assess our cybersecurity risks, vulnerabilities and information security maturity assessments to evaluate the maturity stage of the overall cybersecurity program. The results of these assessments are reported to the Audit Committee of the Board and we adjust our cybersecurity roadmap, policies, processes and practices as necessary based on the information provided by these assessments as well as the monitoring, testing and auditing noted below.


text: We have an established incident response and recovery plan based on the NIST cybersecurity framework. The plan specifies the process for identifying, classifying, documenting and responding to cybersecurity incidents, including escalation protocols to ensure the involvement of our executive leadership, including our CEO, CFO, CIO and General Counsel so that decisions regarding the public disclosure and reporting of any incident can be made by executive management in a timely manner.


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Monitoring Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, table-top exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually.


text: Education and Awareness The Company also regularly conducts mandatory cybersecurity training for its employees and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate.


text: The Company maintains cybersecurity insurance coverage in an amount that management believes to be appropriate for the Company's risk profile.


text: Audit Committee Oversight Our Audit Committee oversees the Company's cybersecurity risks. Ms. Dvorak has a certificate in Cybersecurity Oversight from the National Association of Corporate Directors and Mr. Burton is a technology expert with experience in online fraud and cybersecurity. Both Ms. Dvorak and Mr. Burton are members of our Audit Committee.


text: Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. Annually, they also present information regarding management's annual cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This annual briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. The Audit Committee is notified and briefed regularly in the event of a cybersecurity incident, regardless of the ultimate severity of the situation. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis.


text: Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge and expertise. He is a Certified Information Security Professional and has over 20 years of cybersecurity experience and reports to our Chief Information Officer, who reports to our Chief Executive Officer. Our Vice President, Global Cybersecurity also chairs our Cybersecurity Management Committee which consists of senior business and functional leaders, including our Chief Information Officer and General Counsel. The Cybersecurity Management Committee is intended to provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.


text: Cyber Risks, Threats and Incidents As a global company servicing customers in over 100 countries, we experience a variety of cybersecurity events and incidents. However, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; though there can be no assurance that a cybersecurity incident that could have a material impact on us will not occur in the future. For further details regarding the cybersecurity risks and uncertainties we face see Item 1A. "Risk Factors-Technology and Cybersecurity Risks" of this report.


text: Cybersecurity Risk Management and Strategy BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of the Company's approach to enterprise risk management ("ERM"). The Company leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams across the firm and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. The Company's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.

companyName: BlackRock Finance, Inc.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of the Company's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Cybersecurity Governance" below, the Board's oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with the Company's risk management function, the Company's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: The Company has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Company deploys a range of people, process and technical controls that are designed to protect the Company's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises; ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, and restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which the Company does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by the Company's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.