text: Risks that could affect us are an integral part of Board and Audit Committee deliberations throughout the year. The Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee of the Board has been delegated the authority to oversee and periodically review the security of CQP's information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with the management of CQP's general partner its cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates the Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.

companyName: Sabine Pass Liquefaction, LLC

secItem: Item 1C


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.


text: As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: The Company's information security is managed by the Executive Vice President, Finance, Operations and Technology, whose team leads enterprise-wide cybersecurity strategy, policy, education and training, standards, architecture, processes, monitoring and implementation. The status of the Company's cyber risk and threat profile and any proposed plans to strengthen the Company's information security systems or assessments thereof are reported to senior management and the audit committee of our board of directors.

companyName: Townsquare Media, Inc.

ticker: TSQ


text: The Company has implemented and continues to enhance a comprehensive set of cybersecurity measures based on industry best practices that are meant to protect confidential information, minimize vulnerabilities and intrusions, and maximize detection and response and restoration capabilities. Key components of our strategy include employee training, identity management, multi-factor authentication, endpoint security, detection and response SOCs, privileged access and endpoint management, network traffic inspection, email security, local and cloud-based backups, and third party vulnerability testing and remediation.


text: Our strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report.


text: We have developed and implemented a cybersecurity risk management program intended to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a team of employees (as further described below), or our Response Team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of reputable, recognized external service providers that assess, test and otherwise assist with aspects of our cybersecurity controls; • periodic cybersecurity awareness training of our employees, incident response personnel, and senior management; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process with respect to IT-related third-party service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee reviews and approves our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our President and Chief Operating Officer or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer, our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.


text: Our Response Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Director of IT and Legal Department or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer (and current President and Chief Executive Officer effective January 1, 2025), our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.


text: The security of personal data is of the utmost importance to GoPro and our customers, vendors, suppliers, and employees. As such, we have implemented industry-standard administrative, technical, and physical security measures to protect against the unauthorized access, destruction, or alteration of our confidential and proprietary information and customer and employee information.

companyName: GoPro, Inc.

ticker: GPRO


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 30 years of experience in cybersecurity, serving as a Security Officer while in the United States Navy and CISO at Amgen and Warner Bros and in various other Cybersecurity roles at KPMG and Forrester.


text: The Audit Committee of our board of directors (Audit Committee) has oversight responsibility for our cybersecurity program and reviews with management the Company's policies and procedures for identifying, assessing, managing, and monitoring information security and cybersecurity risks.


text: The CISO provides regular updates to the Audit Committee on cybersecurity and other risks relevant to our information technology environment, including developments in the cybersecurity space and evolving standards, the results of periodic exercises and response readiness assessments and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee.


text: Our periodic assessment and testing of policies, standards, processes and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We regularly train all employees on cybersecurity risks, such as phishing attacks, and employees are required to acknowledge our cybersecurity policy annually through our Code of Conduct.


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. Additionally, the Company has implemented numerous information technology policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion.

companyName: enCore Energy Corp.

ticker: EU


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our Interim Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Audit Committee of the Board has the ultimate oversight responsibility relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the Board as a whole oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The full Board receives at least annual reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," We are dependent on information technology systems, which are subject to certain risks, including cybersecurity risks and data leakage risks associated with implementation and integration" above.


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate these risks; and reports results to executive management and the Board; • A third-party MDR service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting; • A dedicated cybersecurity team covering critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence; • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks; • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online; • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: Veritex Holdings, Inc.


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our third-party risk management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Board is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Risk Committee of the Board. The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the CISO and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the Board with a secondary reporting line to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry, as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department, led by the Head of Information Risk, who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the Company. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Our cybersecurity program (the "Cybersecurity Program") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The Cybersecurity Program is informed, in part, by the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. Controls are embedded within our processes and technology, and system activities are measured and monitored by our cybersecurity and information security subject matter specialists and applicable security operations centers at our different business units. We utilize an enterprise-wide "defense-in-depth" risk management strategy to effectively integrate people, processes, and technology.


text: When appropriate, we use external subject matter specialists to provide incident response services and to conduct independent assessments of internal response readiness. We conduct tabletop scenario planning, covering a range of potential cybersecurity threats, as part of our internal response readiness assessment. We also maintain a supply chain cybersecurity compliance and risk mitigation program to assess material cybersecurity risk from third parties.


text: In 2019, our board of directors established a standing Cybersecurity Committee, which is tasked with oversight of the Cybersecurity Program, including: (i) strategy and governance; (ii) operations; and (iii) risk management and regulatory compliance.


text: The Cybersecurity Committee responsibilities include: • reviewing our enterprise cybersecurity strategy and framework, including our assessment of cybersecurity threats and risk, data security programs, and our management and mitigation of cybersecurity and information technology risks and potential breach incidents; • reviewing any significant cybersecurity incident that has occurred, reports to or from regulators with respect thereto, and steps that have been taken to mitigate against reoccurrence; • evaluating the effectiveness of our cyber risk management and data security programs measured against our cybersecurity threat landscape; • assessing the effectiveness of our data breach incident response plan; • reviewing and assessing our information technology disaster recovery capabilities; and • reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.


text: The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and other executives and cybersecurity specialists. Following each committee meeting, the chair of the Cybersecurity Committee briefs the full board of directors on matters covered at the prior Cybersecurity Committee meeting. The board also receives periodic briefings on emerging trends in order to enhance its literacy on cybersecurity issues. At least annually, the Cybersecurity Committee receives updates about the results of the Cybersecurity Program reviews. The Cybersecurity Committee participates with management periodically in "tabletop" exercises to evaluate our data breach incident response plan.


text: Management's Role and Expertise in Assessing and Managing Cybersecurity Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management, with oversight by the Cybersecurity Committee of the board of directors. Our CIO has more than 25 years of experience in the IT industry. Since 2008, he has held senior-level and CIO positions for several companies, each of which included responsibilities or influence for cybersecurity implementation delivery and oversight.


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 30 years of experience in cybersecurity, IT networking and electronic security, and holds a degree in Information Systems (Cybersecurity concentration). He has specific experience in the following cybersecurity areas: global IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure cybersecurity engineering; incident response and remediation; global supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; Cloud security; identity management; disaster recovery; and cybersecurity damage assessment.


text: Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the "IRP"), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. The IRP provides definitions of key terms, stakeholder roles and responsibilities, and a response governance and escalation process.


text: We have an incident response team comprised of our CISO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include: • evaluating and validating the impact of an incident; • approving certain incident response countermeasures and remediation actions; • escalating incidents and response countermeasures for approval; and • acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We also have an executive cybersecurity and information technology steering committee comprised of our Chief Executive Officer, CIO, and other members of our executive leadership team, whose primary responsibilities include: • approving containment and remediation procedures for escalated cyber incidents; • activating, when appropriate, a crisis management team response; and • approving certain incident response measures.


text: We maintain a Crisis Management Plan that addresses our preparation for, management, recovery from, and ultimate resumption of business after a crisis, including emergency response, continued recovery, and business resumption activities such as information systems recovery, when a cybersecurity incident may potentially have a significant impact on our business strategy, results of operations, or financial condition.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our cybersecurity program (the " Cybersecurity Program ") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 33 years of experience in cybersecurity and information technology, over 20 years working with NAVSEA 08Y, approval authority of HII's unclassified Naval Nuclear Propulsion Information networks, and holds a Master's degree in Cybersecurity. He has specific experience in the following cybersecurity areas: Cyber & IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure; cybersecurity engineering; incident response and remediation; supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; cloud security; identity management; disaster recovery; cybersecurity regulation compliance; and cybersecurity damage assessment.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under Item 1A. "Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO "), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have a comprehensive cybersecurity policy in place that includes robust measures to protect our data and systems from cyber threats, ensuring the integrity and confidentiality of our information.

companyName: Quanterix Corp

ticker: QTRX


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.


text: Cybersecurity is complex and subject to constantly evolving threats. Accordingly, we engage a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third-party experts includes regular audits, threat assessments, and consultation on security enhancements.


text: Our CIO is tasked with ensuring that the highest levels of management and our Board of Directors are informed about the cybersecurity posture and potential risks facing the Company. Our CIO regularly briefs our CEO about cybersecurity risk management. The CIO's staff regularly informs the CIO about the latest developments in cybersecurity, including potential threats and risk management techniques. In the event of a cybersecurity incident, the CIO is informed promptly following its detection, and our response is governed by a detailed incident response plan that includes prompt actions to mitigate the impact of the incident and longer-term strategies for remediation and prevention of future incidents. The CIO has also chartered an Information Security Steering Committee made up of cross-functional executive leaders that meets quarterly on topics such as the current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate. We also mandate a rigorous cybersecurity training program for all employees, which includes regular updates and assessments to ensure they are equipped to recognize and respond to potential cyber threats.


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001, or ISO 27001, Framework, although we do not comply with all technical standards, specifications or requirements under NIST or ISO 27001.

companyName: NorthStar Healthcare Income, Inc.


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks. We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including personal information, intellectual property and proprietary information. • Cybersecurity incident responses plan and testing. We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a Managed Security Service Provider, or MSSP, that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training. We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Our third-party assessments. We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.


text: We also consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We have not identified cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial position.


text: The audit committee of the board of directors is responsible for board-level oversight of cybersecurity risk, and the audit committee reports back to the board of directors about this and other areas within its responsibility. As part of its oversight role, the audit committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our CFO and through our MSSP.


text: Our Audit Committee is responsible for board-level oversight of cybersecurity risk and reports back to our Board about this and other areas within its responsibility. As part of its oversight role, our Audit Committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Financial Officer, and through our MSSP. Our Chief Financial Officer is principally responsible for overseeing our cybersecurity risk management program and incident reporting. In the event there is a material cybersecurity breach or incident, our Chief Financial Officer works in coordination with our MSSP to assess and respond, including by reporting the breach or incident to our Board and/or applicable regulatory authorities, as necessary or required. Our Chief Financial Officer has a high level of exposure to cybersecurity oversight through his current work overseeing our cybersecurity risk management and MSSP and has over 10 years of experience with managing risks in environments similar to ours, including risks arising from cybersecurity threats.


text: We are committed to maintaining robust governance, oversight and management of cybersecurity risks. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, access and identity management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.

companyName: BankUnited, Inc.

ticker: BKU


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents or technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. SLAs are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems KRIs in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity attacks and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and we believe with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third party service provider's technology and information security posture.


text: The Company has developed a training program to educate employees about its cybersecurity policies and standards, best practices, and potential threats to instill a culture of cybersecurity awareness and compliance throughout the organization. The training program includes, but is not limited to, ongoing and targeted training on topics such as social engineering, mobile security, data handling and protection, password security and incident reporting. All employees are required to participate in the training.


text: In 2022, Clarium Managed Services, LLC ("Clarium") conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 4.8 on a scale of 0 to 5. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. No specific cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a discussion of our cybersecurity risks.


text: The Risk Committee of the Board of Directors is ultimately responsible for oversight of risks from cybersecurity threats, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information systems security including physical, cyber, and IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CIO, but also provides reporting directly to and has access to the Risk Committee of the Board of Directors. The CIO has over 30 years of experience in financial services information technology.


text: The Company has designated the MAT to assess and oversee the management and reporting of identified potentially material cybersecurity threats or incidents. The MAT convenes when a qualifying cybersecurity threat is identified by the CIO, the CISO, or their designees in accordance with established processes and procedures. The MAT has the responsibility to determine whether a cybersecurity threat or incident is material and oversee appropriate reporting. The MAT is also responsible for communicating to the Risk Committee any material cybersecurity threats or incidents.


text: The CISO, CIO, CRO, CFO, CAO, and General Counsel comprise the MAT. Other SMEs or technical experts may advise, consult with and provide information to the MAT as needed. In addition to the specific subject matter expertise and experience of the CISO and CIO, these executives have broad financial, legal, risk management, industry, regulatory and SEC compliance, and general leadership experience, which enable the MAT to effectively carry out its responsibilities.


text: We are committed to maintaining robust governance, oversight and management of cybersecurity risk. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, identity and access management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents, technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. Response and resolution times (commonly known as SLAs) are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems metrics in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity threats and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third-party service provider's technology and information security posture.


text: In 2022, Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 4.8 on a scale of 0 to 5. The next independent evaluation is planned for 2025. In the last three fiscal years, the Company has not identified any material cybersecurity incidents. No specific identified cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a further discussion of our cybersecurity risks.


text: The Risk Committee of the Board of Directors is ultimately responsible for oversight of cybersecurity risk, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information security including physical, cyber, IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CRO and provides reporting directly to the Risk Committee of the Board of Directors.


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clearwater Paper Corp

ticker: CLW


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall ERM process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board of Directors, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board of Directors. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: During 2024, we did not experience any cybersecurity threats that had a material impact or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. Please see our "Risk Factors" in item 1A in this report for more information.


text: Governance and Strategy Our cybersecurity program is designed to provide logical and physical security protection of our infrastructure, systems and data from theft and destruction that could impact our operations, reputation, and regulatory compliance. To safeguard us from a cyber event, specific mitigating cybersecurity controls, systems and incident procedures exist based upon the United States Department of Commerce National Institute of Standards and Framework ("NIST") Cybersecurity Framework, which is an industry recognized security framework for private and public sectors. Our commitment to cybersecurity is reflected in our extensive program and related technology investments for continual cybersecurity posture enhancements.

companyName: NGL Energy Partners LP

ticker: NGL


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring, detection and response, network protection and segmentation, layered security methods, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.


text: Risk and Threat Management Our Enterprise Cybersecurity Risk Management program is a continuous life cycle approach with a formal annual risk assessment followed by internal and third-party risk assessments throughout the year. Annually, an independent security expert vendor is engaged to conduct a cybersecurity risk assessment based upon industry and technology standards. The assessment results are prioritized then tracked within our Governance, Risk and Control system which derives the specific risk likelihood and impact mitigated risk score. Cybersecurity projects, controls and practices are then developed to mitigate the identified risks. Monthly, the Compliance and Security Steering Committee meets to review risk register, current threat assessments and related mitigation efforts for risk management tracking. Additionally, on a quarterly basis, our Chief Information Officer ("CIO") presents the risk score and mitigation updates to the board of directors of our GP for risk oversight.


text: Event management of a cyber incident follows our Cybersecurity Policy Incident Response Procedure ("Incident Response Policy") which is based upon the NIST framework. The procedure includes incident identification, isolation and containment, investigation, impact analysis, communication, materiality assessment including in aggregate with previous events, and reporting steps and associated ownership. Annually, the Incident Response Policy is tested with the key owners to validate the procedure and for training purposes.


text: Impact of Risks from Cybersecurity Threats While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future due to the increasing global cyberattack volume, frequency, and sophistication. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures even with our various cybersecurity protection and resilience protocols.


text: Management's Cyber Expertise Our cybersecurity program is led by our CIO who is also our Chief Information Security Officer. Our CIO has been with us since 2014 and has over 30 years of information technology and compliance experience. Our CIO has a Bachelor of Science in Management Information Systems and holds the Certified Information Systems Audit security certification as well. Our security members are comprised of various industry technology skilled resources in cybersecurity, business continuity and system recovery, event management, system administration, network engineering, and regulatory compliance with a collective 100 plus years of experience. Security operations partners are also leveraged for 24x7x365 managed detection and response support plus provide expert cybersecurity resources as an extension of our team.


text: Board of Director's Cyber Oversight For cybersecurity oversight, the board of directors of our GP training program is designed to inform members of the current cyber threat tactics and provide relevant, periodic educational security technology information. The cybersecurity training program includes: • An annual presentation overview of our cyber controls and related systems for a comprehensive understanding of our cybersecurity protection and resilience; • Quarterly cybersecurity training on topics such as ransomware, phishing, impersonation, social engineering, third-party security risks, and business email compromise to reinforce general security knowledge; and • Monthly cybersecurity newsletter distribution for current threat tactics and general security awareness.


text: Additionally, the CIO presents a quarterly cyber update to the board of directors of our GP for an overview of cyber program key metrics and trends, cyber event executive summaries (based upon occurrence), fiscal year security goals and tracking progression, risk register scoring, and status updates on cyber related projects.


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring and behavior analytics, detection and response, network protection and segmentation, layered security methods for defense-in-depth, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.


text: Board of Director's Cyber Oversight For cybersecurity oversight, the board of directors of our GP training program is designed to inform members of the current cyber threat tactics and provide relevant, periodic educational security technology information. The cybersecurity training program includes: • An annual presentation overview of our cyber controls and related systems for a comprehensive understanding of our cybersecurity protection and resilience; • Quarterly cybersecurity training on topics such as ransomware, phishing, impersonation, social engineering, third-party security risks, business email compromise, and artificial intelligence to reinforce general security knowledge; and • Monthly cybersecurity newsletter distribution for current threat tactics and general security awareness.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Warby Parker Inc.

ticker: WRBY


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework 1.1 (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security protocols and controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security protocols and controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for assessing and responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Related to Our Business and Industry—We rely heavily on our information technology systems, as well as those of our third-party vendors, business partners, and service providers, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption, or cybersecurity incident could adversely affect our business, financial condition, and operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives reports from management on our cybersecurity risks on at least a quarterly basis, and more frequently as needed. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer and the Senior Director of Information Security.


text: Our management team, including our Chief Technology Officer ("CTO") and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer ("CTO") and the Senior Director of Information Security.


text: Our management team, including our CTO and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company maintains a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our customers expect us to protect their data and the impact of not doing so has financial, reputational, and regulatory implications. Disruptions caused by cyberattacks, data breaches, or system compromises can impact our business operations and financial performance. The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with established plans.

companyName: Upland Software, Inc.

ticker: UPLD


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the "Board") where that oversight and review takes place at a regular cadence. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, the Board, and, if needed, the Company adjusts its cybersecurity policies, standards, processes and practices based on the information provided by the assessments, audits and reviews.


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.


text: In addition, the Company has established a Security Incident Response Team ("SIRT") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.


text: The Company's CSO is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. Our CSO has held leadership positions in information security for over 30 years, including serving as Chief Security Officer of large public and private organizations, with a high focus on data security. Team members that support the CSO and our information security program have relevant educational and industry experience, including holding Certified Information Systems Security Professional certifications.


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the " Board ") where that oversight and review takes place at a regular cadence through quarterly reports. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.


text: In addition, the Company has established a Security Incident Response, Disaster Recover, and Business Continuity Team ("SIRT/DR/BCP") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT/DR/BCP team convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Company's risk management program for cybersecurity is integrated into our risk management and general compliance programs and processes. Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. Our Information Security Officer ("ISO") is responsible for the day-to-day management of the Company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The information security team also develops training for employees to support adherence to the Company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: The Company leverages the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework ("the NIST Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The Company's ISO works with independent, third-party consultants to assess the maturity of the Company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the Company's program commensurate with the Company's business objectives.


text: As part of the Company's information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, we maintain a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to our system, facilities, and/or confidential or proprietary data.


text: Cybersecurity incidents may create risk to the Company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most corporations, the Company is the target of industrial espionage, including cyberattacks, from time to time. The Company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, the Company has not experienced any known cybersecurity incidents that have materially affected the Company, including the Company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that the Company has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that the Company will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.


text: The Audit Committee and Technology Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Technology Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Technology Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.


text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's ISO reports to the Chief Risk and Operations Officer and oversees the Company's information security programs. The Company's ISO possesses over 20 years of Information Security and Technology experience. The ISO holds a Bachelor of Science in Computer Systems Engineering, an MBA, and a Master of Science in Information Security and Assurance, as well as multiple industry certifications including CISSP, CISM, CISA, CRISC, CDPSE, PMP, among others.


text: Our Risk Management Steering Committee, which includes the Company's Chief Risk and Operations Officer (Chair), CIO and ISO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.


text: Both the CIO and ISO regularly report to the Technology Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the Company's cybersecurity program and maturity assessment, while the Technology Committee and Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and ISO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Technology Committee and Audit Committee would be immediately notified and briefed.


text: The Audit Committee and Risk Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Risk Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Risk Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.