text: The Chief Information Officer provides regular updates to the Audit Committee and senior leaders regarding DTE Energy's management of cyber risks, including but not limited to the status of various training metrics to safeguard against phishing, malware, and other cyber threats. The Chief Information Officer also provides an annual cybersecurity update directly to the Board of Directors. If cybersecurity risks arise, the CSDC executes the incident response plan and communicates the appropriate details to executive management, the Board of Directors, or any related committees.


text: A cybersecurity incident may also require various levels of external reporting. The CSDC coordinates with the legal department and controller's organization in reporting incidents externally. Depending on the nature of the incident, reporting may be required to various federal and state government agencies. DTE Energy has forged trusted partnerships with such agencies and with other companies and organizations to share best practices, tools, and threat information. This includes partnering with others in the utilities industry to form the Electricity Subsector Coordination Council (ESCC). The ESCC is the principal liaison between the energy sector and the federal government in coordinating efforts to prepare for and respond to any threats to critical infrastructure.

companyName: DTE Electric Co

secItem: Item 1C


text: Risk Management and Strategy DTE Energy maintains cybersecurity measures designed to protect its physical and digital infrastructure in order to provide safe and reliable delivery of energy to customers. These measures serve to maintain compliance with regulations and protect the confidentiality, integrity and availability of confidential and proprietary information, DTE Energy's computing resources, and the electrical and gas systems.


text: To protect against cybersecurity threats, DTE Energy employs a dedicated cybersecurity team led by the Chief Information Officer. The cybersecurity team is responsible for implementing proper safeguards to mitigate the risk of cyber threats, including but not limited to firewalls, continuous monitoring, and training. DTE Energy also engages with third parties to conduct cybersecurity maturity assessments to provide an independent and objective view of our cybersecurity and assess opportunities for improvement. The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is the basis for these assessments to manage cyber risks, mature and monitor existing security controls, and communicate security posture coherently. The NIST CSF provides a common language to understand, manage, and express cyber risks internally and externally.


text: Another component of DTE Energy's cybersecurity team is the Cybersecurity Defense Center (CSDC), which has the primary responsibility for monitoring and responding to cybersecurity incidents. The CSDC maintains an incident response plan designed to protect against, detect, evaluate, and respond to and recover from a cyber incident. The CSDC may receive incident reports from DTE Energy employees, corporate security, or external sources. The incident response plan is intended to be flexible so it may be adapted to an array of potential scenarios. Depending on the incident, the CSDC may decide to engage external resources for assistance with responding to the incident. DTE Energy regularly conducts exercises to help ensure the plan's effectiveness and overall preparedness.


text: DTE Energy engages third-party service providers to assist with managing various aspects of its business. These service providers are subject to due diligence reviews of their information security programs prior to onboarding. DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law. Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data. DTE Energy collaborates with its service providers to help determine whether their information security protocols are sufficient. If a service provider experiences a cyber incident, DTE Energy monitors their compliance with our security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.


text: The CSDC monitors and responds to actual and potential compromises from third-party service providers. Access from a potentially compromised third-party is restricted until DTE Energy receives confirmation the compromise has been mitigated.


text: DTE Energy has experienced, and expects to continue to be subject to, cybersecurity threats and incidents. As of December 31, 2024, cybersecurity risks have not materially affected the Registrants' business strategy, results of operations, or financial condition. For additional discussion of the risks related to cybersecurity threats and incidents, see Item 1A. "Risk Factors."


text: DTE Energy has an enterprise risk management program to reduce overall risk, including risks related to cybersecurity, through comprehensive risk assessments and execution of corresponding mitigation plans. Risks are reported and managed through various internal committees, which meet regularly and report at least annually to the Board of Directors. These committees include: • The Risk Management Committee (RMC) is chaired by the Chief Executive Officer and comprised of the Chief Financial Officer, Chief Legal Officer, General Auditor, and other senior officers. The RMC directs the development and maintenance of comprehensive risk management policies and procedures. The RMC also sets, reviews, and monitors risk limits for enterprise-level risk and other exposures • The Operational Risk and Resilience (ORR) Committee is chaired by the President and Chief Operating Officer and comprised of operational leaders in DTE Energy's business units. The ORR is responsible for managing operational risks including safety, reliability, and cybersecurity at DTE Energy's generation plants, substations, and other operating sites • The Technology Cybersecurity Committee (TCC) is a sub-committee of the ORR that focuses on information and operational technology risks related to cybersecurity, chaired by operational leaders in DTE Energy's business units and includes the Chief Information Officer Members of the Board of Directors serve roles on various committees responsible for their respective oversight and risk management. The Audit Committee of the Board of Directors, comprised solely of independent directors, is responsible for reviewing DTE Energy's cybersecurity risks, the results of any cybersecurity risk assessments and audits, and reports of investigations into significant events presented by DTE Energy's IT department. The Audit Committee reports to the Board of Directors and may include any significant matters involving cybersecurity within its reporting. All members of the Board of Directors, including the Audit Committee, have either managerial knowledge or working knowledge of technology and cybersecurity matters.


text: DTE Energy's Chief Information Officer leads the cybersecurity team and has responsibility for assessing and managing cybersecurity risks. The Chief Information Officer has held this position for over 10 years and has decades of experience in IT, including oversight of information protection security (IPS). The IPS cybersecurity team is also led by two full-time directors with over 40 combined years of industry experience, including (1) the director of cybersecurity operations responsible for the CSDC, identity and access assurance, and cloud security and (2) the IPS director of cybersecurity strategy, risk, and engagement who is also responsible for engagement and outreach to internal and external stakeholders.


text: We believe cybersecurity is critical to advancing our 21st Century Security vision and enabling our digital transformation efforts. As an aerospace and defense company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we are a leader in the information security field, and we expend considerable resources on cybersecurity.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Classified Business and Security Committee of the Board of Directors is briefed by senior leadership, as appropriate, on the cybersecurity of classified programs and the security of our classified business supply chain. Other than oversight of classified business cybersecurity, the full Board retains oversight of cybersecurity because of its importance to Lockheed Martin and the heightened risk in the aerospace and defense industry. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. The corporate information security organization manages and continually enhances a robust enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our computer incident response team (CIRT), which is responsible for the protection, detection and response capabilities used in the defense of Lockheed Martin's data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: The corporate information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats, and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement (DFARS) related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance. Moreover, we continue to work with the DoD on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. For example, we have worked in collaboration with the other members of the defense industrial base to support DoD's development of the Cybersecurity Maturity Model Certification (CMMC) program, DoD's program to ensure members of the defense industrial base meet cybersecurity requirements for handling CUI and federal contract information. We believe we are well positioned to meet the requirements of the CMMC and are preparing for certification once the requirements are effective. In addition to following DoD guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. For example, we use a proactive risk management strategy that we developed and implemented called the Intelligence Driven Defense model that seeks to identify and prevent cybersecurity incidents by understanding the nature of adversaries and using this information to minimize the impact of an attack.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment is presented to the Board of Directors.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or joint venture partner could materially adversely impact us. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable. We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the DFARS and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. Government. These government contracting regulations may create challenges for our supply chain and increase costs. We also require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified. We also make available cybersecurity education and awareness materials and briefings to our suppliers.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Lockheed Martin maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We believe cybersecurity is critical to advancing our 21st Century Security vision and enabling our digital transformation efforts. As an aerospace and defense company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, some of which target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we strive to be a leader in the information security field, and we expend considerable resources on cybersecurity.


text: Our corporate information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement (DFARS) related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance. Moreover, we continue to work with the DoD on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. For example, we have worked in collaboration with the other members of the defense industrial base to support DoD's development of the Cybersecurity Maturity Model Certification (CMMC) program, DoD's program to ensure members of the defense industrial base meet cybersecurity requirements for handling CUI and federal contract information. We believe we are well positioned to meet the requirements of the CMMC and are preparing for certification. In addition to following DoD guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. For example, we use a proactive risk management strategy that we developed and implemented called the Intelligence Driven Defense model that seeks to identify and prevent cybersecurity incidents by understanding the nature of adversaries and using this information to minimize the impact of an attack.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor, joint venture partner, or service provider could materially adversely impact us. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable. We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the DFARS and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. Government. These government contracting regulations may create challenges for our supply chain and increase costs. We also require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified. We also make available cybersecurity education and awareness materials and briefings to our suppliers.


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Classified Business and Security Committee of the Board of Directors is briefed by senior leadership, as appropriate, on the cybersecurity of classified programs and the security of our classified business supply chain. Other than oversight of classified business cybersecurity, the full Board retains oversight of cybersecurity because of its importance to Lockheed Martin and the heightened risk in the aerospace and defense industry. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the Board, and regulators, as appropriate.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment and relevant mitigations are presented to the Board of Directors.


text: We recognize the value of personal and financial information and are dedicated to protecting the confidentiality, integrity, and availability of our data and systems. From the Board of Directors to our Customer Service Representatives, all individuals at the organization are responsible for handling confidential data with care.

companyName: WAFD INC

ticker: WAFD


text: Our Information Security Program is aligned with applicable federal and state regulations, the Federal Financial Institutions Examination Council (FFIEC) Examination Guidance, and industry-accepted security standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, which are at the forefront of cybersecurity guidelines for federal agencies in the U.S. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including, but not limited to, advanced anti-malware and firewall technologies, anti-phishing and web filtering controls, robust patch management and vulnerability management processes, configuration hardening, participation with FS-ISAC (Financial Services Information Sharing and Analysis Center) for sharing and consuming threat information, and we perform regular security testing to evaluate our defenses against real-world threats. We have an extensive information security training program that aims to regularly educate our colleagues on current best practices on handling sensitive information and expectations for protecting the organization and our clients. All employees complete mandatory cybersecurity training on at least a quarterly basis, including how to identify phishing attacks. Colleagues are tested regularly with simulated social engineering attacks to ensure awareness and preparedness. As an additional risk mitigation measure, the Bank maintains cybersecurity insurance in the event that a material incident does occur.


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks. • Providing input for internal and external auditors and independent third-party engagements, including in relation to third party operated penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. We partner with the Cybersecurity and Infrastructure Security Agency (CISA), under the Department of Homeland Security, to conduct regular vulnerability scanning against our public facing assets, and on a recurring basis we partner with outside firms to conduct thorough security assessments against our external and internal environment. Results of those assessments are further evaluated, and remediation activity is prioritized.


text: Our cybersecurity and IT teams prepare for and respond to cybersecurity attacks and incidents, including defending against unauthorized access to our systems, and crafting response plans intended to significantly reduce impacts on operations and customers. We understand that cyber threats are unwavering and evolving in this digital age, and because of that we continue to increase investments in people and technology to help us mature our practices and maintain confidence in our ability to safeguard our assets. While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors.


text: The Risk Management Committee ("RMC") and the Technology Committee of our Board of Directors oversee the company's approach to managing cybersecurity risks. On a quarterly basis, the Board committees receive a comprehensive update from management on our cybersecurity risk management strategy. This includes information on emerging threats, the company's cybersecurity posture, progress toward risk mitigation goals, significant cybersecurity incidents or developments, and the steps management has taken to address these risks. During these sessions, the Board committees typically review materials detailing current and potential risks, as well as the company's capacity to mitigate those risks. The committee also engages in discussions with our Chief Information Security Officer and Chief Information Officer about these matters. Additionally, Board committee members are encouraged to engage in ongoing, informal conversations with management regarding cybersecurity news and updates to our risk management and strategy initiatives. Material cybersecurity risks are also reviewed during Board discussions on key topics such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and brand management. Three individuals on the Board of Directors have deep technology expertise, while one of those individuals is responsible for leading cloud security at a Fortune 50 technology company.


text: Our cybersecurity risk management and strategy are overseen by our Chief Information Security Officer, who leads a team with decades of combined experience in information security management, cybersecurity strategy development, and the implementation of effective cybersecurity programs. The team holds a variety of relevant degrees and professional certifications.


text: These members of management are responsible for overseeing and monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents as part of their involvement in the cybersecurity risk management and strategy processes, including the execution of our incident response plan.


text: Our Information Security Program is aligned with applicable federal and state regulations, the Federal Financial Institutions Examination Council (FFIEC) Examination Guidance, and industry-accepted security standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, which are at the forefront of cybersecurity guidelines for federal agencies in the U.S. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including, but not limited to, advanced anti-malware and firewall technologies, anti-phishing and web filtering controls, robust patch management and vulnerability management processes, configuration hardening, participation with the Financial Services Information Sharing and Analysis Center (FS-ISAC) for sharing and consuming threat information, and we perform regular security testing to evaluate our defenses against real-world threats. We have an extensive information security training program that aims to regularly educate our colleagues on current best practices on handling sensitive information and expectations for protecting the organization and our customers. All employees complete mandatory cybersecurity training on at least a quarterly basis, including how to identify phishing attacks. Colleagues are tested regularly with simulated social engineering attacks to ensure awareness and preparedness. As an additional risk mitigation measure, the Bank maintains cybersecurity insurance in the event that a material incident does occur.


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. We partner with the Cybersecurity and Infrastructure Security Agency (CISA), under the Department of Homeland Security (DHS), to conduct regular vulnerability scanning against our public facing assets, and on a recurring basis we partner with outside firms to conduct thorough security assessments against our external and internal environment. Results of those assessments are further evaluated, and remediation activity is prioritized.


text: Our cybersecurity and IT teams prepare for and respond to cybersecurity attacks and incidents, including defending against unauthorized access to our systems, and crafting response plans intended to significantly reduce impacts on operations and customers. We understand that cyber threats are unwavering and evolving in this digital age, and because of that we continue to increase investments in people and technology to help us mature our practices and maintain confidence in our ability to safeguard our assets. While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors.


text: The Risk Management Committee ("RMC") and the Technology Committee of our Board of Directors oversee the company's approach to managing cybersecurity risks. On a quarterly basis, the Board committees receive a comprehensive update from management on our cybersecurity risk management program. This includes information on emerging threats, the company's cybersecurity posture, progress toward risk mitigation goals, significant cybersecurity incidents or developments, and the steps management has taken to address these risks. During these sessions, the Board committees typically review materials detailing current and potential risks, as well as the company's capacity to mitigate those risks. The committee members also engage in discussions with our Chief Information Security Officer and Chief Information Officer about these matters. Additionally, Board committee members are encouraged to engage in ongoing, informal conversations with management regarding cybersecurity news and updates to our risk management and strategy initiatives. Material cybersecurity risks are also reviewed during Board discussions on key topics such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and brand management. Four individuals on the Board of Directors have deep technology expertise, while one of those individuals is responsible for leading cloud security at a Fortune 50 technology company.


text: Below is a discussion of our risk management and approach to governance as it relates to cyber risks. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Data Privacy and Security Risks".

companyName: TRINET GROUP, INC.

ticker: TNET


text: Cyber Risk Management and Strategy Our Global Security program aims to safeguard critical assets through a risk-based approach to cybersecurity. The CSO provides leadership for the program. We employ a defense-in-depth strategy and has established a Security Risk Management Program. In that regard, we built a customized IRCF that was developed with the specific intent of keeping information assets secure and preventing technology resources from unauthorized disclosure, modification, deletion, and destruction. We have modeled our IRCF on several leading industry standards including portions of the NIST Cybersecurity Framework. The IRCF serves as an organizational model for governance and reporting and is reviewed annually.


text: Our Global Security Organization is responsible for the day-to-day execution of our cyber risk management strategy. This strategy has been incorporated into our overall ERM program and is thus informed by, and overseen through, our ERM program. Our ERM program facilitates identifying, prioritizing, analyzing and remediating enterprise risks, in which cyber risks are included. Within the broader ERM framework, we established a specific program - the IRM program - organizing the governance of risks associated with information held by us. The IRM Steering Committee, of which our CSO is a member, manages the IRM program, discusses the management of cyber risks on a regular cadence and substantive updates from the IRM Steering Committee are provided to the ERM Steering Committee. Finally, through our ERM program, updates and discussion regarding our cybersecurity risk management are provided to and occur at the Risk Committee of our Board of Directors.


text: To supplement our cyber risk management capabilities, we utilize certain third-party vendors. These vendors support our ability to proactively secure our network and systems, in addition to ongoing monitoring of our cyber environment. With respect to our management of cyber risks arising from third-party vendors, we utilize an internal risk assessment and monitoring program that includes the identification and ongoing review of third-party controls.


text: As part of our cyber risk management strategy, we established a process for identifying and assessing the material risk of cybersecurity incidents. In the event a cybersecurity incident is identified, the CIRT, which is made up of a cross-functional team, including technology, security, finance and legal professionals, acts in accordance with established processes. The CIRT convenes regular meetings to review and analyze relevant cybersecurity indicators and information. Utilizing an IRC, if it is determined that an incident needs to be reviewed for potential materiality, it is referred to our Chief Legal Officer who will engage the necessary or desirable cross functional professionals as needed in order to make a determination of materiality. We also seek to regularly update and upgrade our technology investments in an effort to further support our ability to identify and assess risks from cybersecurity incidents. We have not identified any cyber threats or incidents that have materially affected or are reasonably likely to materially affect us. For additional information on the potential impact of cybersecurity incidents on our business strategy, operations, or financial condition, refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Data Privacy and Security Risks".


text: Cyber Risk Governance Our Cyber Risk Management Strategy described in this Item 1C. is overseen by senior executives with experience in cybersecurity and our business operations and is ultimately overseen by the Risk Committee of the Board. Our Global Security Organization is tasked with executing this strategy through the implementation of cybersecurity policies, procedures, and strategies. In the event that a cybersecurity risk is identified, as and to the extent appropriate, the Global Security Organization manages the day-to-day response to such material risk and provides regular reports to the ERM Steering Committee, or the Risk Committee of the Board, or the Board, as appropriate. The CSO is also an advisor to the Company's Disclosure Committee, which meets quarterly.


text: On a quarterly basis, a meeting of the Risk Committee is convened to discuss and evaluate our management of enterprise-wide risks. Each meeting of the Risk Committee is facilitated by our Executive Director for ERM and includes programmatic updates from the CSO. The Risk Committee provides updates to the full Board of Directors regarding the state of the Company's ERM program.


text: Cyber risks are an enterprise risk that the ERM Program monitors and thus such risks are an ongoing area of focus of the ERM Steering Committee and, as a result, the Risk Committee. On a monthly basis, the ERM Steering Committee is convened and receives pertinent updates regarding our management of cyber risks.


text: Our Global Security Organization is responsible for the day-to-day execution of our cyber risk management strategy. This strategy has been incorporated into our overall ERM program and is thus informed by, and overseen through, our ERM program. Our ERM program facilitates identifying, prioritizing, analyzing and remediating enterprise risks, in which cyber risks are included. Within the broader ERM framework, we established a specific program - the IRM program - organizing the governance of risks associated with information held by us. The IRM Steering Committee, of which our CSO is a member, manages the IRM program, discusses the management of cyber risks on a regular cadence and substantive updates from the IRM Steering Committee are provided to the ERM Steering Committee. Finally, through our ERM program, updates and discussion regarding our cybersecurity risk management are provided to and occur at the Risk Committee.


text: We provide on at least an annual basis cybersecurity awareness training to our employees. For example, our employees with network access participate in required training, covering topics such as spear phishing, social engineering and other cybersecurity threat awareness training.


text: As part of our cyber risk management strategy, we established a process for identifying and assessing the material risk of cybersecurity incidents. In the event a cybersecurity incident is identified, the CIRT, which is made up of a cross-functional team, including technology, security, finance and legal professionals, acts in accordance with established processes. The CIRT convenes regular meetings to review and analyze relevant cybersecurity indicators and information. Utilizing an IRC, if it is determined that an incident needs to be reviewed for potential materiality, it is referred to our Chief Legal Officer who will engage the necessary or desirable cross functional professionals as needed in order to make a determination of materiality. We also seek to regularly update and upgrade our technology investments in an effort to further support our ability to identify and assess risks from cybersecurity incidents.


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Cyber Risk Governance Our Cyber Risk Management Strategy described in this Item 1C. is overseen by senior executives with experience in cybersecurity and our business operations and is ultimately overseen by the Risk Committee. Our Global Security Organization is tasked with executing this strategy through the implementation of cybersecurity policies, procedures, and strategies. In the event that a cybersecurity risk is identified, as and to the extent appropriate, the Global Security Organization manages the day-to-day response to such material risk and provides regular reports to the ERM Steering Committee, or the Risk Committee, or the Board, as appropriate. The CSO is also an advisor to the Company's Disclosure Committee, which meets quarterly.


text: On a quarterly basis, a meeting of the Risk Committee is convened to discuss and evaluate our management of enterprise-wide risks. Each meeting of the Risk Committee is facilitated by our Executive Director for ERM and


text: Risk Management & Strategy Cybersecurity is a critical component of risk management. We rely on information technology and any failure, inadequacy, interruption or security lapse of such technology, including any cybersecurity incidents, could harm our ability to operate our business effectively.

companyName: MASIMO CORP

ticker: MASI


text: Management regularly performs risk assessments relating to cybersecurity risks. We have a risk-based cybersecurity program, dedicated to protecting our data and data that may be collected from patient monitoring devices. We utilize a defense-in-depth strategy with multiple layers of security controls to protect our data and systems. We mitigate cybersecurity risks by employing a number of measures, including employee training, systems monitoring and testing and maintenance of protective systems and contingency plans. As part of our cybersecurity risk management processes, management engages external auditors and consultants to assess our program and controls. We evaluate ourselves for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests. We also install and regularly update antivirus software on all of our Company-managed systems to detect malicious code and prevent it from impacting our systems. We require cybersecurity awareness training for all staff members with access to our network. We also maintain cyber liability insurance coverage to further reduce our risk profile. Security of our financial data and other sensitive information remains a high priority for us, led by our global information security team. We employ an appropriate encryption and tokenization platform for all online and direct-to-consumer sales from our websites, ensuring no credit card data is stored in our internal systems. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors - Risks Related to Our Regulatory Environment" and "Risk Factors - General Risk Factors". Except as disclosed therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity program is focused on the following: • Cybersecurity Awareness: We identify and assess cyber risks through the dissemination of information from industry groups and third-party experts. • Training: We provide annual cybersecurity training for company personnel with network access and conduct periodic simulated phishing exercises. • Technical Safeguards: We deploy measures to protect our network perimeter and internal information technology platforms, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, anti-malware and access controls. • Vendor Management: We maintain data protection agreements with our vendors that contain contractual provisions requiring safeguards for the protection of personal information. In addition, vendors are screened for data security measures as part of our vendor due diligence process. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber incident (i.e., detection, response and recovery), as well as data breach response plans, and test those plans annually with tabletop exercises. • Mobile Security: We deploy controls to prevent loss of data through mobile devices. • Security Standards: Our program leverages security standards such as HIPAA, HITRUST, NIST CSF, ISO 27001, and PCI DSS. • Insurance: We maintain a cybersecurity insurance program with established and respected insurance companies.


text: Our Nominating, Compliance, and Corporate Governance Committee is responsible for overseeing the Company's information security risk management, including cybersecurity, data privacy, and other information technology risks, controls and procedures, and the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The Company's Senior Director of Information Security, who has more than a decade of experience in IT and cybersecurity-related roles, assists in assessing the Company's cybersecurity risks and has the relevant expertise necessary for such assessment. Pursuant to the Company's internal policies, executive management team members, which may include the General Counsel, Chief Financial Officer, and Chief Information Officer, are briefed on cybersecurity trends, potential risks, ways to improve the Company's risk posture, as well as changes to the legal and regulatory landscape relative to cybersecurity and data privacy. Consistent with our internal policies, our executive team is responsible for apprising the Nominating, Compliance, and Corporate Governance Committee of cybersecurity incidents consistent with our incident response plan.


text: Risk Management & Strategy Cybersecurity is integral to our risk management approach. We are reliant on information technology, and any interruption, failure, or security breach-including cybersecurity incidents-could adversely impact our operations and business continuity.


text: To address these risks, we maintain a comprehensive, risk-based cybersecurity program focused on protecting sensitive data and systems. Our approach includes: • Layered Security (defense-in-Depth): Implementing multiple levels of controls to safeguard against cyber threats. • Employee Awareness: Delivering mandatory cybersecurity training, conducting phishing simulations, and fostering a culture of vigilance. • Proactive Monitoring and Testing: Leveraging real-time monitoring, regular vulnerability assessments, and external audits to continuously evaluate and enhance defenses. • Preparedness: Maintaining and testing business continuity and disaster recovery plans with scenarios such as simulated cyberattacks. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors - Risks Related to Our Regulatory Environment" and "Risk Factors - General Risk Factors". To date, no cybersecurity incidents or risks from cybersecurity threats have materially impacted our business strategy, results of operations, or financial condition.


text: Our cybersecurity program emphasizes: • Threat Awareness and Risk Identification: Engaging with industry groups and third-party experts to stay ahead of emerging threats. • Employee Training: Conducting annual training and phishing simulations to reinforce best practices. • Advanced Safeguards: Deploying comprehensive technical measures, including firewalls, intrusion detection systems, penetration tests, anti-malware, encryption, and access controls to secure our systems and data. • Vendor Management: Requiring contractual data protection safeguards and screening vendors for compliance during onboarding. • Incident Response: Maintaining up-to-date response and recovery plans, validated through regular tabletop exercises. • Compliance Standards: Adhering to recognized standards such as HITRUST, NIST CSF, ISO 27001, and PCI DSS. • Insurance: Partnering with leading insurers to maintain cyber liability coverage.


text: Our Audit Committee oversees our cybersecurity program and its alignment with overall risk management. This includes monitoring cybersecurity, data privacy and IT risks.


text: Leadership of our cybersecurity efforts is provided by our VP, Global Information Security, a seasoned expert with over a decade of experience. This role ensures continuous program improvement and alignments with evolving threats and standards.


text: Our executive team, including our Chief Financial Officer and Chief Information Officer, receive regular briefings on: • Cybersecurity trends and evolving threats; • Program effectiveness and risk mitigation strategies; and • Updates to regulatory and legal requirements related to data security and privacy.


text: These briefings ensure cybersecurity considerations are integrated into strategic decisions, resource allocation, and risk mitigation planning. In accordance with our incident response plan, any material cybersecurity incidents are promptly reported to the Audit Committee to maintain transparency and oversight.


text: Management & Strategy MetLife manages information security risk through, and as part of, MetLife's Information Security Program (the "Program"), which institutes and maintains controls for the systems, applications, and databases of MetLife and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology, and is managed by MetLife's CISO, in collaboration across lines of business and corporate functions. The Board of Directors of MetLife, Inc. (the "Board" or "Board of Directors") oversees the Program.

companyName: METROPOLITAN LIFE INSURANCE CO


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and MetLife's Privacy Office and tested through cross-functional annual exercises in various geographical regions of MetLife, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: We exercise risk-based due diligence in selecting our third-party service providers, including, as appropriate, review of vendor applications, general IT controls and the IT facilities used to service MetLife's business. Third parties are governed by the MetLife Third-Party Risk Management program, which includes risk assessment prior to onboarding. Based on the assessment of risk, certain third-party service providers must periodically update relevant assessment documentation and be reevaluated by MetLife relative to their internal controls. Vendors deemed critical and high risk are continuously monitored by various industry solutions and services designed to identify cybersecurity risks.


text: MetLife also works with third parties, such as independent assessors (for example, for industry maturity assessments, penetration testing, application security reviews, and independent audits), external legal counsel and other consultants as part of the design and implementation of the Program. The Program is periodically evaluated by external experts, and the results of those reviews are reported to the Board of Directors.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For further discussion of our risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality and Integrity of Our Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: The CISO is a senior-level executive responsible for establishing and executing MetLife's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee of MetLife, Inc. (the "Audit Committee") quarterly and, as necessary, to the full Board of Directors. These regular reports include updates on MetLife's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of MetLife's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to MetLife.


text: The Program is subject to MetLife's risk management framework and operates under the "Three Lines of Defense" model MetLife uses. The CISO regularly reports about information security risk to the Enterprise Risk Committee ("ERC"), including the Chief Risk Officer ("CRO"), and other members of the senior management team. See "Management's Discussion and Analysis of Financial Condition and Results of Operations — Risk Management."


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity, having more than twenty years of professional IT experience in financial services. Prior to his current role, the CISO previously served as MetLife's Global Chief Technology Officer with accountability for MetLife's global infrastructure, engineering, service operations, quality assurance, application maintenance, and production management functions; he also served variously as the chief technology officer, CISO, chief information officer and global head of telecommunications engineering at other financial institutions prior to joining MetLife in 2012.


text: Pursuant to the Trust Agreement and other operational agreements among the parties, the Custodian is responsible for implementing and maintaining measures to protect the systems on which the Trust's operational data is stored and processed, including third party systems, and the information security risks associated with the same. There are no directors, executive officers or other employees of the Trust.

companyName: METLIFE POLICYHOLDER TRUST


text: The Custodian is required by contract to ensure it has implemented, and requires its critical vendors to implement, cybersecurity and data protection measures that are reasonable and appropriate for the operation of, and enterprise risks facing, the Custodian, which measures also include processes to assess, identify and manage risks from cybersecurity threats that may materially affect the Trust. Such contract requires the Custodian to inform MetLife, Inc., of any actual or reasonably suspected data security incident, including any loss, compromise, unauthorized use, access, or disclosure of information provided to it as contemplated thereunder.


text: During the period covered by this report, the Trust has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its results of operations or financial condition. For further discussion of risks related to cybersecurity, see "Risk Factors —The Custodian or any of its vendors may fail to protect the confidentiality and integrity of data, including Beneficiary confidential information, as a result of a failure in any of their respective cybersecurity or other information security systems, or disaster recovery plans, and any such failure may also adversely affect the Trust's operations."


text: Management & Strategy MetLife manages information security risk through, and as part of, MetLife's Information Security Program (the "Program"), instituted to maintain controls for the systems, applications, and databases of MetLife and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures across business units and at the enterprise level for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology along with the sensitivity of the systems and the potential severity of the associated risks to MetLife and its relevant lines of business, and is managed by MetLife's CISO, collaborating with lines of business and corporate functions. The Board of Directors of MetLife, Inc. (the "Board" or "Board of Directors") oversees the Program.


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and MetLife's Chief Privacy Officer and tested through cross-functional annual exercises in various geographical regions of MetLife, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For further discussion of our risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality, Integrity or Availability of Our Systems or Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity and has more than 30 years of experience leading information and physical security operations, with the emphasis on threat and vulnerability management, malware protection and cyber forensics. Prior to joining MetLife in 2024, the CISO was a chief security officer and a cybersecurity leader at other financial institutions, where he oversaw global cybersecurity programs for physical security, executive protection, risk management, critical incident response and management, disaster preparedness, third-party risk, insider threat, and security background investigations. He holds multiple patents for systems and methods related to information security risk assessment, including three information security patents from his prior employment with another large U.S. financial institution.


text: During the period covered by this report, the Trust has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its results of operations or financial condition. For further discussion of risks related to cybersecurity, see "Risk Factors —The Custodian or any of its vendors may fail to protect the confidentiality, integrity or availability of systems or data, including Beneficiary confidential information, as a result of a failure in any of their respective cybersecurity or other information security systems, or disaster recovery plans, and any such failure may also adversely affect the Trust's operations."


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management (ERM) program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is identified as a key risk area for the Company, and utilizes a combination of manual and automated methods as well as internal and external resources to monitor, measure and mitigate cybersecurity risks.

companyName: First Financial Northwest, Inc.


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements:


text: 1.Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. 2.Assessment of the likelihood and potential damage of these threats, taking into consideration the sensitivity of confidential information. 3.Assessment of the sufficiency of policies, procedures, information systems, and other arrangements in place to control risks.


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists.


text: In designing our Information Security Program, we refer to established industry frameworks - in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance and best practices from the National Institute of Standards and Technology (NIST). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges. The Company utilizes these frameworks to assist with the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item I A. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that summarizes the steps the Company will take to respond to a cybersecurity incident. The plan includes an Incident Response Team (IRT), which is responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The IRT is supported by operating procedures and guidelines designed to outline the expectations and processes to be followed when responding to incidents of unauthorized access to confidential information maintained by the Company or its service providers. The IRT may consult legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other resources and appropriate reporting protocols at both the management and Board of Directors levels.


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes risk tolerances for each. Associated risk metrics are monitored quarterly by Management and reported to the Audit/Compliance/Risk (ACR) Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system security. It is tailored to align with the Company's risk assessment results, and the size, complexity, nature and scope of our activities.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Information Security Officer ("ISO") reports directly to the Chief Risk Officer ("CRO") and provides direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities. The ISO has more than 20 years of information security experience at financial institutions as well as information security consulting firms, and maintains various cybersecurity and IT audit professional certifications. The ISO works in partnership with the Company's Information Technology department and is supported by both internal and external information technology and information security tools, resources and staff.


text: Both the CRO and ISO provide routine reports to various management committees and at the Board level—namely the ACR Committee and the Board of Directors—regarding the overall status of the Information Security Program. Such reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is identified as a key risk area for the Company, and utilizes a combination of manual and automated methods as well as internal and external resources to monitor, measure and mitigate cybersecurity risks.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. Assessment of the likelihood and potential damage of these threats, taking into consideration the sensitivity of confidential information. Assessment of the sufficiency of policies, procedures, information systems, and other arrangements in place to control risks.


text: In designing our Information Security Program, we refer to established industry frameworks - in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance and best practices from the National Institute of Standards and Technology (NIST). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges. The Company utilizes these frameworks to assist with the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that summarizes the steps the Company will take to respond to a cybersecurity incident. The plan includes an Information Security Incident Response Team (ISIRT), which is responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The ISIRT is supported by operating procedures and guidelines designed to outline the expectations and processes to be followed when responding to incidents of unauthorized access to confidential information maintained by the Company or its service providers. The ISIRT may consult legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other resources and appropriate reporting protocols at both the management and Board of Directors levels.


text: Our Board of Directors articulates the Company's attitude towards risk. Associated risk metrics are monitored quarterly by Management and reported to the Audit Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Board has appointed a Chief Information Security Officer. Together with the Risk and Audit Manager, they provide direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities.


text: Our Information Security Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Technology Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Corporation's risk management framework and processes. The Corporation employs a variety of processes, risk assessments, and controls to assess, identify, and manage these risks. This includes estimating the likelihood and potential impact of cybersecurity incidents. To manage these risks, the Corporation designs, documents, and implements controls, which are then tested through compliance assessments and internal and external audits. In some cases, the Corporation also transfers risk, either wholly or partially, through insurance and other methods. When an incident occurs, the Corporation responds by remediating the incident while complying with regulatory obligations, and then evaluates the remediation's effectiveness. Communication about risk management matters is conducted through documented policies and procedures, management and Board committee reporting, and employee training and communications. For a detailed description of how cybersecurity risks may materially affect the Corporation's business strategy or results, see "Item 1A. Risk Factors."

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: The Corporation's information technology risk management department consists of professionals with experience and expertise in cybersecurity, including specialists in identity and access management, cyber defense operations, security engineering, and information technology governance, risk, and compliance. This department is led by the Chief Information Officer ("CIO"), who has over 27 years of experience in technology risk management, and the Information Security Officer ("ISO"), who has a bachelor in computer science and has over 18 years of experience in cybersecurity risk management. The ISO reports to the CIO, and the CIO reports directly to the President and Chief Executive Officer. Additionally, the Corporation engages third-party experts as needed to assess, manage, and respond to cybersecurity risks through various methods, including risk assessments, IT audits based on different frameworks, penetration and vulnerability testing, social engineering, incident response, threat intelligence, education, and managed security services.


text: The Corporation also monitors risks from third parties, such as service providers, through efforts like monitoring, information sharing, risk assessments, audits, contractual due diligence, and adherence to third-party security standards. Senior management governs risk management and is informed about and monitors the prevention, detection, mitigation, and mediation of cybersecurity incidents. This is facilitated through working review committees, on which the ISO and/or CIO serve. These committees receive risk management reports appropriate to their scope of review, covering assessment results, risk ratings, and critical issues. They report significant matters to enterprise-wide risk committees, which oversee the broader scope of risk management for the enterprise. Through these efforts, senior management makes decisions and sets priorities for allocating resources to address risk management issues.


text: The Corporation's Board of Directors, including the Audit Committee, oversees all risk management policies, procedures, and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more frequently as necessary, to the Enterprise Risk Committee on technology risks, including those from cybersecurity threats. The Board's Audit Committee and the Board of Directors receive these reports as part of their risk management oversight responsibilities. Board members have direct access to senior management and other relevant personnel and may direct questions and request further information as needed to fulfill their oversight responsibilities.


text: Cyber Risk Management and Strategy Safeguarding the confidentiality, integrity and availability of customer and sensitive financial data, records and transactions is essential to Timberland and Timberland Bank. Our risk management program is designed to identify, assess and mitigate risks across various aspects of the Bank, including financial, operational, regulatory, reputational and legal.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Cybersecurity is a critical component of our risk management program; thus we have implemented a Cyber and Information Security Program to protect the confidentiality, integrity and availability of our information and information technology environment. Our program aligns with applicable federal and state regulations, industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC") and best practices from the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity and availability of sensitive information. NIST is part of the U.S. Department of Commerce, which develops cybersecurity standards, guidelines and other resources.


text: We have employed a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. The Bank conducts a variety of information security risk assessments throughout the year. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including but not limited to, configuration hardening, robust patch management and vulnerability scanning, advanced anti-malware firewall technologies, anti-phishing and web filtering controls. These controls are tested annually by an independent third-party audit firm. Quarterly employee training is performed on cybersecurity, information security, identify theft prevention and data privacy. The Bank has not experienced any material losses relating to cybersecurity threats or incidents to date.


text: Response to cyber incidents is guided by the Bank's Incident Response Policy. The Bank's plan is based on the National Infrastructure Protection Center ("NIPC") guidelines, with the addition of specific reporting and notification requirements required by regulation. The Incident Response Policy prescribes points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors, government agencies and regulatory bodies.


text: Third Party Service Provider Monitoring The Bank maintains a robust Vendor Management Program to appropriately measure, monitor and control risks associated with outsourcing products and services, including cybersecurity risks. Under the program, vendors are assigned a risk rating based on an assessment of the vendor and its access to network, systems and confidential information. The Bank's Information Security Officer conducts regular periodic reviews of the adequacy of its oversight of controls over third party relationships.


text: Cybersecurity Governance Timberland Bank's Board of Directors ("Board") recognizes the significance of cybersecurity risks and provides oversight of the Bank's Cyber and Information Security Program. The Bank's Board of Directors is currently comprised of the Chief Executive Officer and seven non-employee directors; one of which has completed and received Cybersecurity Oversight Certification from the National Association of Corporate Directors ("NACD"). The Bank's primary responsibility for managing cyber risk is vested in the Bank's Information Security Analyst ("ISA"). The ISA reports to the Chief Risk Officer and serves as the primary custodian of the Bank's Cyber Security and Information Security Program.


text: The Technology Steering Committee meets on a regular basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Bank. The Technology Steering Committee is comprised of numerous members of the management team, Chief Technology Officer ("CTO") and ISA. The Technology Steering committee reports to the Board of Directors through Committee minutes.


text: The Board Technology Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to the overall role of technology in executing the business strategy of the institution, including but not limited to major technology investments, technology strategy, operational performance and technology trends that may affect customers. The Board Technology Committee meets regularly and receives reports from the CTO and ISA on cybersecurity and information technology risks. The Board Technology Committee reports to the Board of Directors through Committee minutes. The Board's Audit Committee also has oversight responsibility for audits related to information technology, security and information technology governance.


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management ("ERM") program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is a key focus for the Company. We use a combination of manual and automated methods along with internal and external resources, to monitor, measure and mitigate cybersecurity risks.


text: Effective risk mitigation dependents on a robust risk assessment process that identifies, measures, controls, and monitors cybersecurity threats. These threats include any unauthorized activities within the Company's information systems that could compromise the confidentiality, integrity, or availability of data. The Company's Information Security Program incorporates a comprehensive information security risk assessment, which includes: • Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. • Evaluation of the likelihood and potential damage of these threats, considering data sensitivity. • Assessment of the sufficiency of existing policies, procedures, information systems, and other controls in mitigating risks.


text: The risk assessment process helps identify assets requiring additional risk reduction strategies and involves regular internal and third-party security assessments.


text: In designing our Information Security Program, we refer to established industry frameworks, particularly those of the Federal Financial Institutions Examination Council ("FFIEC") and the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges.


text: These frameworks inform the design of our security controls and risk mitigation strategies. While we believe our Information Security Program is well-designed, cyber threats continue to evolve. Consequently, despite our efforts, the Company's cybersecurity strategy may not be sufficient to prevent all incidents. No system is entirely secure, and the Company may not be able to anticipate or prevent every security breach. For additional information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item IA. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established controls and procedures for the timely escalation of cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our Cybersecurity Incident Response Plan outlines the steps the Company will take to respond to a cybersecurity incident, and includes an Incident Response Team ("IRT") responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The IRT follows established procedures for addressing unauthorized access to confidential information and may consult external experts, including legal counsel. An escalation process helps ensure appropriate reporting at both the management and Board of Directors levels.


text: Our Board of Directors annually reviews the Company's Risk Management Statement, which defines key risk categories and associated metrics monitored quarterly by Management and reported to the Audit/Compliance/Risk ("ACR") Committee of the Board and the Board of Directors. Management regularly assesses inherent risk, mitigating controls, residual risk and emerging risk for each key risk category, inclusive of cybersecurity threats.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards to protect confidential client information in accordance with FDIC and FFEIC regulations. The program is tailored to align with the Company's risk profile, operational complexity, and strategic objectives.


text: We maintain relevant in-house cybersecurity expertise, led by the Bank's Information Security Officer ("ISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"). The ISO oversees cybersecurity-related activities, including risk assessments, service provider oversight, incident response, business continuity, staff training, and security program adjustments based on evolving threats. The ISO has more than 20 years of information security experience at financial institutions as well as information security consulting firms, and maintains various cybersecurity and IT audit professional certifications. The ISO works in partnership with the Company's Information Technology department and is supported by both internal and external information technology and information security tools, resources and staff.


text: Both the CRO and ISO provide routine reports to various management committees and at the Board level—namely the ACR Committee and the Board of Directors—regarding the overall status of the Information Security Program. Such reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates to enhance the Board of Directors' ability to oversee these critical areas.


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is identified as a key risk area for the Company, and utilizes a combination of manual and automated methods as well as internal and external resources to monitor, measure and mitigate cybersecurity risks.