text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.

secItem: Item 1C


text: We regularly assess our cybersecurity program's capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer ("CISO"), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.


text: Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.


text: We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.


text: We conduct table-top simulation exercises to regularly test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions. Additionally, we maintain cyber insurance designed to address certain aspects of cyber risks.


text: In the last three fiscal years to date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see Item 1A. "Risk Factors" of this Form 10-K. See "Item 1A. Risk Factors" of our Annual Report on Form 10-K for the year ended May 31, 2021, for information regarding the 2017 NotPetya cyberattack at TNT Express.


text: The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors ("CyTOC") responsibility for overseeing the company's cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company's cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company's business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.


text: The CyTOC receives regular updates from our CISO, Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, risks appropriate for Board-level awareness, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, while significant risks are reported on a quarterly basis.


text: Our CISO, who reports to the Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, leads our information security team and has responsibility for overseeing FedEx's cybersecurity program. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.


text: The FedEx Information Technology Risk Council ("ITRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The ITRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Moreover, our Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer is a member of the FedEx Executive Committee, which oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the ITRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DIH HOLDING US, INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 ("NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition


text: Our Board considers cybersecurity risks as part of its risk oversight function of cybersecurity and other information technology risks.


text: The Chief Financial Officer oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.


text: The Company is in the process of establishing a cybersecurity policy which will implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures.


text: Our cyber-security risk strategy includes policies and procedures for assessing, identifying and managing material cybersecurity threats. Our program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks. Our cybersecurity posture is risk based, focused on the areas of higher risk to the company and associates. Our cybersecurity policies, standards and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by the Board of Directors acting through the Audit Committee of the Board of Directors.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, as necessary including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance to provide coverage in the event a material cybersecurity incident arises.


text: We conduct annual internal audits to ensure compliance with its technology policies, security procedures and controls. Our third-party technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risk and mitigation measures, where applicable.


text: We have significantly increased our cybersecurity investments over the last few years and continue to implement additional cybersecurity safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents still pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Data privacy, cybersecurity, and artificial intelligence considerations could impact our business," in Item 1A of this Form 10-K.


text: While we have experienced data security incidents that have disrupted our operations in the past, to date, no data security incidents have had or are materially likely to have, a material impact on RPM.


text: Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field, including previous roles in security architecture, audit and governance. The Senior Director - Information Security recently completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives regular annual reports on the status of our cybersecurity risk, incidents and mitigation efforts. We utilize a technology-based reporting system to identify and log data-related events.


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on RPM, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.


text: We utilize a combination of manual processes, specialized software and automated tools, and third-party assessments to assist with our cybersecurity efforts. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: HeartSciences Inc.

ticker: HSCS


text: Our third party service provider, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller reporting Company, we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: We rely on several information systems throughout our company, as well as those of our third-party business partners, to provide access to our web-based products and services, keep financial records, analyze results of operations, process customer orders, manage inventory, process shipments to customers, store confidential or proprietary information, and operate other critical functions. Our information systems and our business partners' and suppliers' information systems may be vulnerable to attacks by hackers and other security breaches, including computer viruses and malware, through the internet, email attachments, and persons with access to these information systems, such as our employees or third parties with whom we do business. These risks have increased as information systems and the use of software and related applications become more cloud-based. We have implemented various programs, processes, and systems designed to mitigate these risks.

companyName: NEOGEN CORP

ticker: NEOG


text: We have a comprehensive cybersecurity risk assessment program designed to assess, identify, and manage material risks associated with cybersecurity threats and vulnerabilities and to mitigate the potential impact of any cybersecurity incidents on our operations and financial condition. We routinely review, modify, and update this program as necessary to address emerging risks. Our process for addressing risk is based on industry best practices outlined in CIS Critical Security Controls. Although this program is integrated within the Company's overall risk management system, the implementation of this program requires a unique and specialized level of expertise and experience, which has led us to create a cybersecurity team and various processes designed to address these specific risks, as discussed more below.


text: We regularly engage consultants, auditors, and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.


text: The Governance and Sustainability Committee of our Board of Directors (the "Governance Committee") is responsible for providing oversight and policy direction on our risk management policies and programs, including those relating to cybersecurity. The Charter of the Governance Committee specifically requires the committee to periodically review the Company's enterprise cybersecurity strategy and framework, including the Company's assessment and management of cybersecurity threats and risks, data security programs, applicable laws and regulations, and the Company's management and mitigation of cybersecurity and information technology risks and potential breach incidents, including our incident response plan. The Governance Committee is also tasked with reviewing any significant cybersecurity incident that occurs.


text: The Governance Committee is required by its Charter to consist of not fewer than three independent directors, and the committee currently consists of five independent directors. The Governance Committee typically meets on a quarterly basis. At each meeting, a written cybersecurity brief from IT leadership is provided. These reports include a review of emerging cybersecurity risks and developments and updates to our cybersecurity risk assessment program. The Governance Committee provides regular reports to the full Board of Directors on its oversight of the Company's cybersecurity risks and risk management system.


text: Our management team is primarily responsible for assessing and managing material risks to the Company from cybersecurity threats. We have a cross-functional cybersecurity team led by our cybersecurity manager and comprised of personnel from our information technology group, including the head of IT, and senior leadership. We have established a robust framework for preventing, identifying, evaluating, and mitigating cybersecurity risks.


text: Our cybersecurity manager is designated as the senior executive responsible for cybersecurity and reports directly to the head of IT. Our cybersecurity manager has a comprehensive information technology background and over ten years of service in managing or assisting in managing cybersecurity risks.


text: To support the head of IT and cybersecurity manager in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 30 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: We employ a comprehensive set of processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include: • Continuous monitoring of network traffic and information technology systems for signs of potential threats; • Regular vulnerability assessments and penetration testing to identify and address weaknesses; • Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption; • Employee training and awareness programs to educate all staff about cybersecurity risks and prevention measures; and • Incident response plans to ensure swift, effective, and adequate disclosure of cybersecurity incidents to the appropriate individuals within the Company.


text: These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats and any changes in our systems or business operations.


text: Our head of IT, cybersecurity manager, and other members of our cybersecurity team provide quarterly updates and reports to the Governance Committee of our Board of Directors on cybersecurity risks and our risk management systems. Our cybersecurity team is also required to provide senior management and the Governance Committee with more frequent updates on major developments regarding cybersecurity matters or as otherwise appropriate. As noted above, the Governance Committee provides regular updates to the Board on these matters so that the Board remains adequately informed about this important aspect of the Company's overall risk management.


text: Microsoft plays a central role in the world's digital ecosystem. We have made it the top corporate priority to protect the computing environment used by our customers and employees and to support the resiliency of our cloud infrastructure and services, products, devices, and our internal corporate resources from determined adversaries. In response to the evolving cybersecurity threat landscape, we launched the Secure Future Initiative ("SFI") in November 2023 and expanded the scope of SFI in May 2024. The SFI focuses our business strategy and efforts on continual improvement in cybersecurity protection, and is aligned around three security principles: • Secure by Design: Security comes first when designing any product or service. • Secure by Default: Security protections are enabled and enforced by default, require no extra effort, and are not optional. • Secure Operations: Security controls and monitoring will continuously be improved to meet current and future threats.

companyName: MICROSOFT CORP

ticker: MSFT


text: We operate a cybersecurity program and governance framework designed to protect our computing environments against cybersecurity threats, and we have controls, policies, and procedures to identify, manage, and mitigate cybersecurity threats. Annually, we assess our cybersecurity program's alignment with the National Institute of Standards & Technology's Cyber Security Framework ("NIST") and other applicable industry standards. We also undertake integrated planning and preparedness activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including tabletop simulations and production environment tests, penetration and vulnerability tests, red team exercises, and other related activities. We conduct mandatory cybersecurity training, provide employees with tools to report suspected incidents and assess their own security posture, and conduct real-time simulated employee education exercises, such as phishing email campaigns designed to emulate real-world attacks. We also engage in robust cybersecurity assessments and remediation efforts for acquired companies.


text: Our computing environments, products, and services are reviewed by our internal audit teams as well as independent third-party assessors. We are committed to managing the most significant risks to our strategies and ambitions, including cybersecurity risks. The Enterprise Risk Management ("ERM") organization supports management in this commitment by facilitating the semiannual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on the Committee of Sponsoring Organization ("COSO") guidance on Enterprise Risk Management Integrating Strategy with Performance and it also aligns with the International Organization for Standardization 31000:2018 Risk Management Standard.


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from over 78 trillion signals per day and over 135 million managed devices. We track over 300 unique threat actors, including 160 nation-state actors and 50 ransomware groups. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.


text: When appropriate, we utilize external service providers to assess, test, or otherwise assist our program. We also leverage third parties by working with external researchers, operating bug bounty programs, and managing coordinated vulnerability disclosure programs with security organizations. We maintain a systematic approach to assessing and controlling the cybersecurity risks presented by third-party service providers. We require third-party service providers to manage their cybersecurity risks in defined ways, undergo cybersecurity reviews, notify us of cyber events, and satisfy additional contractual requirements.


text: We seek to improve the entire cybersecurity ecosystem through multistakeholder diplomacy to set and uphold expectations for state behavior, advancement of government policy that strengthens cybersecurity and resiliency, disruption and deterrence of cybercrime, protection of national security interests, and disruption of digital threats to democracies. We also establish processes and innovate solutions for us and our customers to address the growing number and complexity of cybersecurity regulations.


text: When we experience a cybersecurity incident, we utilize our well-established incident response plans that operate both across the company and at the product and services level. Incidents are first triaged for severity, and then more deeply assessed to establish a plan of record and activate internal and external notification, disclosure, and communication plans, as applicable. Engineering and development resources are mobilized to resolve or remediate the incident. After the incident is resolved, a comprehensive post-incident review process is conducted.


text: We describe the risks from cybersecurity threats, including previous cybersecurity incidents, in section "Risk Factors" (Part I, Item 1A of this Form 10-K). As of the date of this Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, are under constant and increasing threat. As discussed above, our business strategy is tied to the SFI and we are committed to continuously monitoring cybersecurity threats, enhancing the security of our products, investing in our cybersecurity infrastructure, and collaborating with peers, customers, service providers, regulators, and governments to advance our and the entire digital ecosystem's cybersecurity defenses and resiliency.


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Microsoft Security. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's infrastructure. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.


text: We have developed a cybersecurity program for identifying and mitigating risks to our information and information systems, including guarding against increased cybersecurity threats. We have a comprehensive cybersecurity program which includes risk management to identify cybersecurity threats that could adversely affect our information systems and compliance.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: The Audit Committee has primary responsibility for oversight of cybersecurity matters. The Audit Committee receives quarterly updates on compliance and cybersecurity from the CIO and CISO. These updates, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and enhancements to our cybersecurity program.


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the Chief Financial Officer. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: We actively maintain an enterprise risk management program that includes information technology and cybersecurity risk management. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to address potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.


text: Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations.


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls (SOC) reports.


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST) and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.


text: To date, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, financial condition, liquidity or results of operations. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

companyName: Worthington Steel, Inc.

ticker: WS


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Transformation and Chief Information Officer ("CIO") who receives reports from our Senior Cybersecurity manager who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The dedicated personnel of information system security professionals are overseen by an information security manager with 15 years of experience in cybersecurity. Management, including the CIO and our cybersecurity manager, regularly update the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk program, vulnerability management, and on-going cybersecurity projects.


text: In fiscal 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors – Risks Related to our Business" in Item 1A of this Form10-K.


text: We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: The Company follows the U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, we maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyber attacks.


text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by a cyber incident response plan (the "IRP"), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.


text: The IRP is executed by an Incident Response Team ("IRT"), led by our Information Systems Director. The exact composition of the IRT varies depending on the severity and potential impact of an incident and will typically include internal IT professionals and stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, forensic accountants, and consultants who are on retainer contracts for expedited availability.


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incidents and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. We do not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that we will not be seriously damaged by the exploitation of our cybersecurity vulnerabilities.

companyName: Peak Bio, Inc.


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: DZS INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the MITRE ATT&CK Framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and the MITRE ATT&CK as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors.


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. To date, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."


text: This risk management approach informs decision-making processes related to the company's strategic priorities, the allocation of resources, and the establishment of oversight mechanisms. Our Board considers cybersecurity risk as part of its risk oversight function, and the governance of this program resides with our Board, which bears the ultimate responsibility for the oversight of cybersecurity risks. Supporting the Board, the Audit Committee plays a pivotal role by engaging in regular reviews of our cybersecurity efforts in collaboration with management and providing periodic updates to the Board. These assessments are conducted regularly, with additional sessions convened as needed to address emerging issues or refine strategies. In addition, management updates the Board, as necessary, regarding any significant cybersecurity incidents.


text: Our Chief Operations Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He/She stays informed about and monitors the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity management team includes our corporate global applications director, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response, and global operations, and our senior vice president of cloud edge and engineering operations, who leads the operational teams responsible for product and cloud security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations, and governance, and hold various IT security industry certifications and have received specialized cybersecurity training.


text: We rely upon information technology networks and systems to process, transmit, and store electronic information, and to manage or support virtually all of our business processes and activities. Accordingly, we maintain a comprehensive Information Security Program, anchored in a multi-tiered, defense-in-depth strategy designed to identify and mitigate risks from cybersecurity threats. We believe that our Information Security Program aligns with industry frameworks and assesses security trends, and facilitates identification and reduction of vulnerabilities. Our cybersecurity strategy considers existing risks to our company and those that we are likely to encounter based on our industry, company profile, and business objectives. Consideration of risks from cybersecurity threats is a key component of our overall enterprise risk management strategy.

companyName: Performance Food Group Co

ticker: PFGC


text: We have implemented a risk management program to identify and track information risks, including cybersecurity threats, from many different sources, including third parties, technology projects, acquisitions, risk assessments, technical assessments, and internal/external audits, and assesses them based on severity. Our annual information technology general control testing, which is conducted in connection with our internal control over financial reporting review process, and periodic reviews of risks and controls related to cybersecurity threats that may impact financial reporting control objectives also serve to identify and track information risks. Additionally, we partner with independent third-party service providers to perform cybersecurity assessments, such as network and application penetration testing.


text: To emphasize the importance of cybersecurity awareness, advise of cybersecurity threats, and provide examples of how to mitigate such threats in their use of PFG systems, we also maintain an information security training program that combines several forms of training, including routine phishing exercises, across our workforce.


text: We acknowledge the potential cybersecurity risks inherent in our relationships with third parties. Accordingly, PFG has implemented a third-party risk management program to identify and oversee such risks. Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third parties. Activities undertaken in relation to third parties may include due diligence inquiries, reviewing security policies and program capabilities, reviewing security certifications and results of independent audits. Review and establishment of contractual requirements is performed in accordance with the level of risk presented by a third party.


text: We maintain a regularly revised Cybersecurity Incident Response Plan and Cybersecurity Incident Notification Policy, which provide protocols for evaluating and responding to cybersecurity incidents, including escalation of information to senior leadership, including the Board of Directors, as appropriate, and meeting external reporting obligations. We periodically perform tabletop exercises where we perform walkthroughs of cybersecurity incident situations to test our response plans. To date, we have not experienced any cybersecurity incidents that materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition, but future incidents cannot be predicted. See "Item 1A. Risk Factors" for additional information regarding cybersecurity-related risks that could impact our business.


text: Our Board of Directors executes its cybersecurity risk oversight function as a whole and by delegating responsibility to the Technology and Cybersecurity Committee of our Board of Directors, which oversees our management of risks relating to information technology security and our cybersecurity policies, controls and procedures. The Audit and Finance Committee of our Board of Directors oversees our enterprise risk management program as a whole and risk management regarding major financial risk exposure, including the potential financial impact of cybersecurity incidents. The Technology and Cybersecurity Committee receives quarterly presentations and reports on cybersecurity and information security risks from management, including our Executive Vice President and Chief Information Officer ("CIO") and Vice President, Chief Information Security Officer ("CISO"). These presentations and reports address a broad range of topics, including progress of security initiatives, strategy, key performance indicators, cybersecurity risks, and notable cybersecurity incidents. In addition, the Technology and Cybersecurity Committee and the Board of Directors receive briefings from time to time from outside experts for an independent view on cybersecurity risks, including best practices and current trends in cybersecurity.


text: Our CIO's experience includes over 25 years of experience in information technology leadership roles, including ProBuild Holdings, the nation's largest supplier of building materials; Gates Corporation, a manufacturer/distributor of automotive parts; and Nupremis Inc., a start-up that provided hosting and managed services. We also have a dedicated CISO, whose team is responsible for management of PFG's Information Security Program, policies, compliance with internal/external mandates, strategy, security incident planning and response. Our CISO reports to our CIO and has more than 20 years of cybersecurity, technology assurance and controls experience, including 17 years as a Certified Information Systems Security Professional (CISSP) and 12 years at PFG in information security and compliance. Our CISO joined PFG following several years of experience working in information security consulting, including Big 4 Accounting and Assurance, as well as working in industries including banking and finance.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program, include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – System security risks, data breaches, and cyberattacks could compromise our proprietary information, disrupt our internal operations, impact services to customers, and harm public perception of our products, which could materially adversely affect our business, financial condition, operating results, and future growth prospects".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from our Chief Information Security Officer ("CISO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Chief Information Officer ("CIO") and CISO periodically report to the full Board regarding cybersecurity risks and our cyber risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO, our CISO, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CIO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and CISO collectively have over five decades of IT and cybersecurity experience in technology companies, including two decades in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications, They are assisted by a cross-functional Information Security Steering Committee.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Overview and Leadership The Company maintains a company-wide risk management system focused on detecting, identifying, defending against and mitigating the impact of cybersecurity risks in order to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors (the "Board") is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 38 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 25 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: The information security team undertakes or engages in the following practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats at each level of the organization; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for the testing of cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to the Company's systems and data; as well as the systems of third parties that could adversely impact our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multifactor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.


text: Use of Third Parties The Company has engaged, and intends to continue to engage, nationally recognized third parties to assist the Company in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: We also have engaged a nationally recognized third party to assist with a tabletop exercise to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: Impact of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material impact on the Company's results of operations and financial condition. As described above under "Item 1A Risk Factors "Technology Disruptions, Failures or Breaches, Hacking Activity, Ransomware Attacks or Other Cybersecurity Events Could Materially and Adversely Affect Our Financial Condition and Results of Operations" a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial damage, in addition to litigation or remediation costs or penalties.


text: Governance Overview The Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from the information security team regarding the Company's cybersecurity environment, cybersecurity risks and threats, cybersecurity projects the Company has implemented and plans to implement and other cybersecurity developments, and such committee reports to the full Board after each meeting. In addition to these quarterly reports to the Audit Committee, the information security team provides a presentation to the Board at least annually regarding the same topics covered with the Audit Committee. In addition, members of the Company's internal audit team have certain responsibilities with respect to projects designed to test the Company's cybersecurity controls and improve the overall cybersecurity environment.


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and the General Counsel discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.


text: The Company's cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: 1. Cybersecurity Risk Management Program – The Company's cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company's cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).


text: The Company's Information Security team is responsible for the Company's cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.


text: 2. Third Party Support – In addition to the internal tests and recurring audits our Information Security team performs on our systems, the Company also engages external consultants and auditors. For example, the Company engages third party auditors to obtain SOC 2 Type II Certification. Furthermore, the Company regularly works with third party consultants to perform penetration tests. These third-party engagements supplement internal tests and audits as detailed in our Information Security policies.


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee's or contractor's level of data and system access.


text: 4. Third Party and Vendor Management – The Company's Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user's access of Company's resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company's Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company's employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company's cybersecurity environment.


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company's business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company's approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company's overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see "Risks Related to our Business and Industry," in Item 1A, "Risk Factors" in this Annual Report.


text: Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company's cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.


text: The Company's Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.


text: As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify, and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data security threats within our environment. In the event we identify a potential cybersecurity or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Board, other stakeholders and law enforcement when responding to such issues.

companyName: UNIFI INC

ticker: UFI


text: The Company's enterprise cybersecurity program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates and proactively scans for vulnerabilities. We regularly engage qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. The Company utilizes industry-standard technologies, processes, and capabilities designed to protect our systems and data and to detect potential suspicious activity. We provide cybersecurity training and user education on a regular basis for users with access to the Company's information technology systems. We conduct monthly social engineering tests to promote phishing awareness and security awareness. The Company monitors servers and endpoint devices across the organization to detect signs of a cyberattack. We maintain and practice a response and recovery plan to restore systems and data. We also maintain cyber liability insurance against cyber-attacks as part of our comprehensive insurance portfolio. Because we are aware of the risks related to third-party service providers, we have implemented processes to oversee, identify, and manage risks from cybersecurity threats associated with our most significant third-party service providers.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material affect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.


text: Day-to-day management of cybersecurity risk is performed by the Company's Information Technology Security Team with direct oversight from the Chief Information Officer (the "CIO"). The Company's incident response plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CIO, who further escalates critical or high severity events to the Company's Cyber Incident Steering Committee (the "CISC"), which consists of the CIO, the Chief Financial Officer, the General Counsel, and the Internal Audit Manager. Additional senior management from relevant business units are included as needed based on the nature of identified cybersecurity incidents. The CISC is responsible for providing support, guidance, and oversight of UNIFI's incident response, including making a determination of materiality to evaluate the need for escalation and disclosure. The materiality evaluation is made using the framework established in the federal securities laws, with a focus on the importance of the information to a reasonable investor.


text: The Board recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee, and vendor information, as well as non-public information about UNIFI. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of the Board has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 29 years.


text: Furthermore, UNIFI management prepares, and the Audit Committee reviews and discusses, a quarterly assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated quarterly and is designed to bring to the Audit Committee's attention our most critical risks for evaluation, including cybersecurity risks.


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the heading "We face risks associated with security breaches or cyberattacks," included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: In the last three fiscal years, we have not experienced a cybersecurity incident which has been determined to be material, and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Information Security Officer ("CISO") and Sr. Director of Internal Audit on a biannual basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer, and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Information Security Management Steering Committee (the "ISMS Committee"), comprised of our CISO, as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, CIRT, and ISMS Committee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO has over 28 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and to protect the confidentiality, integrity, and availability of our and our client's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Intapp, Inc.

ticker: INTA


text: We design our program based on industry standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Also, our cloud services comply with numerous internationally recognized standards, such as ISO 27001, ISO 27017, ISO 27108, SOC 2 and CSA STAR.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: When we experience cybersecurity incidents, we promptly activate incident response protocols and commence investigation of the incident. We may notify law enforcement and engage third-party professionals, as appropriate, as part of our incident response and/or investigation. Based on our assessments, we have not identified any cybersecurity threats that have had a material impact during the last fiscal year, and we do not believe these incidents have materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of the Company's enterprise risks, including cybersecurity and other information security risks. The Committee oversees management's implementation of our cybersecurity risk management program. Also, the Company created a Risk Management Working Group which meets no less than quarterly and which receives updates on the Company's cybersecurity risk management program and cybersecurity risks from the Chief Information Security Officer ("CISO"). The Risk Management Working Group includes two Audit Committee members, certain members of senior management and the CISO.


text: The Committee receives quarterly reports on our cybersecurity risks from the Risk Management Working Group. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports quarterly to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings on our cyber risk management program, including from our CISO.


text: Our team of experienced cybersecurity professionals has primary responsibility for our overall cybersecurity risk management program, including assessing and managing material risks from cybersecurity threats. Our CISO, Mark Schertler, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Schertler has over 40 years of experience in the field of cybersecurity. Mr. Schertler leads a team of experienced cybersecurity professionals who have extensive experience in the field of cybersecurity, including experience in cybersecurity consulting, cloud security, principal security architect, application security and as a chief technology officer.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity risk management program is focused on assessing, identifying, and managing risks arising out of our use of information technology ("IT") including the risk of cybersecurity incidents and threats. The program is informed by recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN