text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following: • industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, patch management, email security and firewalls to protect our assets and our ability to maintain operations; • use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response, security information and event management and vulnerability management; • a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center; • regularly monitoring and assessing our cybersecurity programs using external parties including a third-party 24/7 security operations center and by conducting periodic cyber maturity and risk assessments, penetration tests and other targeted controls assessments; • central systems backup processes and associated disaster recovery plans; • membership in an information sharing and analysis center and other industry groups so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and • employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.


text: Our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our Company takes to monitor and mitigate these risks. The board is briefed semi-annually or as needed by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the board, we also have established a security and privacy steering committee comprised of members of senior management, including our CISO and our Chief Technology Officer, to oversee data privacy, information technology, and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in this role for the Company since 2019 and has supported the Company's information security function since 2015.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO

secItem: Item 1C


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: Accordingly, we have developed an informational security program and devoted resources for assessing, identifying and managing risks associated with cybersecurity threats, including: • established a dedicated internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • implemented continuous monitoring tools and a third-party Security Operations Center that can detect and respond to cybersecurity threats in real-time; • perform ongoing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain measures to mitigate their cybersecurity risk; • retain third-party cybersecurity consultants who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; • conduct frequent cybersecurity training and testing for our workforce; • provide our board of directors with regular updates regarding threat levels, including analyses that demonstrate the overall cybersecurity posture and health of the organization; • engage in periodic assessments of our cyber resilience with the Cybersecurity and Infrastructure Security Agency (CISA); • conduct scheduled reviews of our Incident Response Plan to assess the responsiveness during a cybersecurity event or Ransomware attack; and • maintain third party vendor management program, which includes requirements for how our partners transmit, store and use bank information.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer and Chief Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security, integrity and confidentiality of customer records and information, and prohibit unauthorized access to our critical operating systems. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents, including with respect to our commercial customers and vendors, that require us to make changes to our processes and implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that future threats and incidents could have a material adverse effect on our business strategy, results of operations and financial condition, even if the threat or incident is promptly identified and countermeasures are implemented. Such events could lead to direct financial loss or require the expenditure of significant amounts to obtain the release of critical data and/or restore our operating systems or those of our customers and/or vendors if the incident was the result of a security breach for which we are held legally responsible.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Security Officer. Our Chief Information Security Officer has 20 years of information technology and information security experience, and before joining our Company has held the positions of Chief Technology Officer and Director of IT and Information Security Officer at his prior places of employment.


text: In addition, our board of directors, as a whole and through its Risk Policy & Compliance Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team, including from our Chief Risk Officer and our Chief Information Security Officer regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."


text: Accordingly, we have developed an informational security program and devoted resources for assessing, identifying and managing risks associated with cybersecurity threats, including: • established a dedicated internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • implemented continuous monitoring tools and a third-party Security Operations Center that can detect and respond to cybersecurity threats in real-time; • perform ongoing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain measures to mitigate their cybersecurity risk; • retain third-party cybersecurity consultants who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; • conduct frequent cybersecurity training and testing for our workforce; • provide our board of directors with regular updates regarding threat levels, including analyses that demonstrate the overall cybersecurity posture and health of the organization; • engage in periodic assessments of our cyber resilience with the Cybersecurity and Infrastructure Security Agency (CISA); • conduct scheduled reviews of our Incident Response Plan to assess the responsiveness during a cybersecurity event or Ransomware attack; and • maintain third party vendor management program, which includes requirements for how our partners transmit, store and use Bank information.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our residents are necessary for the operation of our business. We use these systems, among others, to manage our resident and vendor relationships, for internal communications, for accounting to operate record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: In recent years, cybersecurity attacks have increased on businesses as cyber criminals seek to gain access to sensitive information and use it for their personal or financial gain. We continuously seek to implement advanced technologies to strengthen our infrastructure, monitor for threats, and evaluate our capability to respond to incidents in order to minimize the potential impact to our systems, data, and operations.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We also work with third parties that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing certain obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Audit Committee oversees risks and exposures associated with financial matters, particularly financial reporting, tax (including compliance with REIT rules), accounting, disclosure, internal control over financial reporting, cybersecurity, financial policies, investment guidelines, development and leasing, and credit and liquidity matters. In addition, the Risk Committee oversees our enterprise risk management practices to ensure that we are equipped to anticipate, identify, prioritize, and manage material risks to the Company. Our Risk Committee assists our Board of Directors in its oversight of our enterprise risk management framework, including cybersecurity, our overall risk-taking tolerance and our management of financial, reputational and operational risk.


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over five years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries as a President and Chief Information Officer at Results Theory, Inc.. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the Chief Financial Officer.


text: We rely on a multidisciplinary team, including our information security personnel, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy by educating, and communicating key priorities such as potential threat awareness, vendor scrutiny and device security to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the President and Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our President and Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over six years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the President and Chief Financial Officer.


text: We maintain a cybersecurity risk assessment program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Trane Technologies plc

ticker: TT


text: Any changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates systems and applications hosted by external parties for cybersecurity risks and assesses the security posture and features of those services. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.


text: Like other comparable-sized companies, our information technology systems, networks and infrastructure and technology embedded in certain of our control products have been and may continue to be vulnerable to cyber-attacks and unauthorized security intrusions. These types of attacks may include computer viruses, malicious code, unauthorized access, phishing attempts, denial-of-service attacks, among others. For more information about these and other cybersecurity risks faced by us, see Part IA, Item 1A, "Risk Factors - Risks Related to Cybersecurity and Technology."


text: Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from our internal cybersecurity team on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess and manage our key cybersecurity programs and risks. We also maintain an Enterprise Risk Intelligence Committee (ERIC), a management-level cross-functional group designed to monitor and mitigate risks, including cybersecurity risks, that pose a threat to our strategic objectives. The ERIC is charged with providing guidance and direction for integrating enterprise risk intelligence with important business processes, such as strategic planning, business forecasting, operational management, and investment allocation to ensure consistent consideration of risks in decision making. Finally, we maintain an Enterprise Cybersecurity Governance Committee that presents updates on cybersecurity initiatives, known and emerging issues and risks, and program updates to a cross-section of our senior management.


text: We maintain a cybersecurity program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; • Maintain an operational technology (OT) security program to address cyber risks that are inherent and unique to our industry and manufacturing environment; • Maintain a centralized product security program that unifies company-wide strategy to ensure our customer-facing products and services are secure by design; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.


text: Any changes or additions to our cybersecurity program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates third parties that either host or have access to our data and/or systems to ensure that they are aligned with our security requirements. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity, and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.

companyName: Otter Tail Corp

ticker: OTTR


text: Our cybersecurity policies and practices, which are based on the Center for Information Security (CIS) Critical Security Controls, are governed by our information and cybersecurity governance program. The CIS Critical Security Controls are a set of 18 cybersecurity-related controls which aid companies in designing an effective control environment and are viewed as best practices by organizations worldwide. A significant number of our cybersecurity policies and practices associated with our electric utility operations are also subject to regulation by multiple governmental and other agencies.


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards, and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.


text: We perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk. As part of our risk assessment process, we incorporate results from procedures performed by third-party consultants. We utilize third-party consultants to complete risk quantification analysis and perform penetration and vulnerability testing and monitoring, as well as overall cybersecurity control testing. Potential risks associated with the use of third-party service providers are monitored and managed through an established service provider management policy. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements, and data disposal commitments.


text: In managing cybersecurity risk, we employ a defense-in-depth strategy and regularly monitor our cyber environment for potential new threats. Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security, and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining, and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating, and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to the Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk review and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks, and a review of any emerging risks. Annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.


text: We perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk. As part of our risk assessment process, we incorporate results from procedures performed by third-party consultants. We utilize third-party consultants to perform penetration and vulnerability testing and monitoring, as well as overall cybersecurity control testing. Potential risks associated with the use of third-party service providers are monitored and managed through an established service provider management policy. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements and data disposal commitments.


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to our Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk reviews and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks and a review of any emerging risks. At least annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.


text: management program, the Board devotes time and attention to cybersecurity and data privacy-related risks, with the Audit Committee of the Board of Directors responsible for overseeing information technology risk exposures, including cybersecurity, data privacy and data security.

companyName: Accenture plc

ticker: ACN


text: The Audit Committee receives reports on cybersecurity and data privacy matters and related risk exposures from management, including our chief information security officer ("CISO"), at least twice a year and more frequently as applicable. In addition, the Audit Committee's quarterly enterprise risk management updates include developments regarding IT security and data protection. Recent topics included evolving generative AI threats, social engineering resistance and deepfake readiness. The Audit Committee regularly updates the Board on such matters and the Board also periodically receives reports from management directly. We have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated within the company and, where appropriate, reported promptly to the Board.


text: Our CISO leads all aspects of Accenture's global cybersecurity program, including security operations, client data protection, cyber risk reduction strategies, incident response, cybersecurity integration of acquisitions and our industry-leading behavioral change program. Our CISO joined Accenture in 1995. Prior to being appointed CISO in 2020, he helped create Accenture's information security capability and led the implementation of information security technology. Previously, he managed large technology transformations for Accenture and for clients in the United States, Japan and Australia. Our CISO reports to our Chief Operating Officer and is supported by a team of over 800 people with expertise in technical architecture and security operations; governance, risk and compliance; client data protection; behavioral change; and cyber incident response, many of whom hold cybersecurity certifications and possess deep technical knowledge and experience.


text: Our information security team maintains an extensive governance network, including formal relationships with other organizations within Accenture through our Situation and Action Committee, which includes representatives from our Markets and Services and the legal, information technology, corporate services and sustainability, data privacy and business resilience services teams. In addition, our cyber incident response efforts are overseen by a cross-functional leadership team including our CISO, our General Counsel and our Chief Marketing Officer.


text: The information set forth under "Legal Contingencies" in Note 15 (Commitments and Contingencies) to our Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," is incorporated herein by reference.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such material risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal red team program, which simulates cyber threats, intended to allow us to address vulnerabilities before threat actors identify them; and (5) a threat intelligence program designed to model and research our adversaries. These processes vary in maturity across the business and are processes we work to continually improve.

companyName: DROPBOX, INC.

ticker: DBX


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct regular tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business could be damaged, and we could be subject to liability, if there is any unauthorized access to our data or our users' content, including through privacy and data security breaches or incidents," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors is actively involved in overseeing cybersecurity risk management. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Dropbox's business strategy. Additionally, our audit committee oversees programs and policies related to cybersecurity risks and initiatives. Our audit committee is comprised entirely of independent directors who evaluate these issues at least quarterly.


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage and mitigate security and privacy risks. Members of this team also report periodically to the board of directors, audit committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Business Foundations, our Head of Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Business Foundations has been with us since 2020, and has worked in the technology industry for over 20 years, working in product development, engineering, and security leadership and risk management roles over that time. Our Head of Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.


text: Members of senior leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Additionally, all employees are required to complete annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education via informational emails, talks and presentations, and resources available on our intranet.


text: Our process for identifying and assessing material risks from cybersecurity threats (our "Cybersecurity Process") operates alongside our broader overall risk assessment process, covering other risks facing the company. As part of our Cybersecurity Process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess the severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Our cybersecurity risk management approach is supplemented by external and internal management audits against commonly accepted frameworks, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program through which security researchers can help identify vulnerabilities in our systems before threat actors do. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We have in the past and may continue to experience privacy and data security breaches or incidents" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors is actively involved in overseeing cybersecurity risk management. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Dropbox's business strategy. Additionally, our Audit Committee oversees programs and policies related to cybersecurity risks and initiatives. Our Audit Committee is comprised entirely of independent directors who evaluate these issues at least quarterly.


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage, and mitigate security and privacy risks. Members of this team also report periodically to the Board of Directors, Audit Committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.


text: As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, the AGM's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.


text: Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise and third-party suppliers and vendors, and monitoring such risks and threats is integrated into the Company's overall risk management program.

companyName: General Motors Co

ticker: GM


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and certain incident information are reviewed by the Company's Chief Cybersecurity Officer (CCO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.


text: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.


text: As cybersecurity incidents occur, the GM Cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the Cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CCO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to GM's Executive Vice President, Legal, Policy, Cybersecurity, and Corporate Secretary as well as to the Risk and Cybersecurity Committee. The CCO has served in this role for four years, and has more than 11 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CCO holds a bachelor's degree in electrical engineering and a master's degree in systems engineering, with over 10 years of previous software and hardware systems engineering experience. The CCO chairs the Automotive – Information Sharing and Analysis Center (ISAC) and serves on the Department of Homeland Security – Cybersecurity and Infrastructure Security Agency (DHS-CISA) Advisory Committee.


text: The CCO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CCO and the Cybersecurity Management Board, as appropriate. As discussed above, the CCO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. We have implemented cybersecurity policies, procedures, technologies and controls to aid in our efforts to access, identify and manage such risks. Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise, service providers such as data processors, third-party suppliers, dealers and vendors, and monitoring such risks and threats are integrated into the Company's overall risk management program.


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and incident information are reviewed by the Company's Chief Information Security Officer (CISO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.


text: The Company maintains administrative, physical, technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.


text: When cybersecurity incidents occur, the GM Cybersecurity team's focus is on responding to and containing the threat and minimizing impact. When we become aware of a cybersecurity incident, we have defined policies and procedures to respond to and recover from such incident as quickly as possible. In the event of a cybersecurity incident, the Cybersecurity team also assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement, as appropriate. Our policies and procedures are reviewed periodically for alignment with regulatory requirements and the threat landscape.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing our cybersecurity program, among other things. The Company's cybersecurity organization is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to the Risk and Cybersecurity Committee. The CISO has served in this role since December 2024 and has more than 20 years of experience in various information technology, cybersecurity and software engineering roles. The CISO's experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software engineering teams responsible for building and operating large-scale software services. The CISO also has expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The CISO holds a master's degree in information security policy and management, has taught information security courses at the graduate level, is an inventor on cybersecurity-related patents and has been a speaker at leading cybersecurity conferences.


text: The CISO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the Risk and Cybersecurity Committee, as appropriate, and simulated exercises.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest information.

companyName: Hyatt Hotels Corp

ticker: H


text: We design and assess our security program using an internally-developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program includes: • a cybersecurity department principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally-managed vendors based on their criticality to our business and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding significant cybersecurity incidents or updates.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. From time to time, board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity department provides reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.


text: Our CISO and cybersecurity department collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third party risk management, threat intelligence, and cloud security areas. Our CISO and cybersecurity department personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest and colleague information.


text: Key elements of our cybersecurity risk management program include: • cybersecurity and information technology governance departments principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally managed vendors based on their criticality to our business and risk profile.


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity and information technology governance departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity and information technology governance departments provide reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.


text: Our CISO and cybersecurity and information technology governance departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third-party risk management, threat intelligence, and cloud security areas. Our CISO and the personnel of our cybersecurity and information technology governance departments are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Rent the Runway, Inc.

ticker: RENT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is managed separately from our other risk management programs.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for certain third-party service providers, suppliers, and vendors based on, among other things, their criticality to our operations, access to RTR data, cybersecurity risk profile, and business requirements.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations." and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our full Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on cybersecurity risks. In addition, management is responsible for updating the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISOs experience includes developing secure products as well as head of security and CISO positions at both public and private companies.


text: Under the supervision of our SVP, Engineering and our VP, IT, Infra & Security, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations. " and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISO's experience includes developing secure products as well as head of security and CISO positions at both public and private companies.


text: Under the supervision of our SVP, Engineering and our VP, Technology & CISO, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery and remediation efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and participants in our vulnerability disclosure program; and alerts and reports produced by security tools deployed in our IT environment. The security team, under the leadership of the SVP, Engineering and VP, Technology & CISO, meet periodically to review the status of the cybersecurity program, including, as applicable, the status of regularly monitored cybersecurity benchmarks, responses to external or internal incidence or intelligence, oversight of third-party vendors, and progress against discrete program goals. Trends in risks, risk mitigations, long-term progress against program goals, and discrete intelligence or incidents discussed in these meetings are then shared in periodic cybersecurity reports to the Board.


text: As a provider of cybersecurity offerings, we understand that threat actors are increasingly becoming more sophisticated and extremely effective at compromising information and operational technologies. As this trend continues, it is vital that we have processes in place to timely and accurately detect, mitigate, respond to, and remediate cybersecurity incidents, threats or vulnerabilities that may create a material risk to our Company, that could, if the risk occurs, materially impact our Company, including, but not limited to, our financial condition and results of operations. For additional information regarding the variety of material risks we may face, including, but not limited to, those that relate to cybersecurity, refer to "Part I – Item 1A – Risk Factors" in this report.

companyName: SecureWorks Corp