text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are also continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.


text: In the event of an incident, we leverage a multi-layered set of plans that include, Endpoint Detection and Response software, Security Information and Event Management tools for detection, and a Cybersecurity Incident Response Plan and Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, reputational impacts on the Company to determine the materiality of the incident and the appropriate response..

companyName: BROWN FORMAN CORP

ticker: BF-A

secItem: Item 1C


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.


text: We rely on third party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, system, or business during the past reporting period. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee regularly reports on its activities and findings with respect to risks from cybersecurity threats to the full Board of Directors.


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee on a quarterly basis regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner, and report them to senior leadership, the Board of Directors, and appropriate regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM work is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.


text: Strategy and Processes Our Chief Information Security Officer (CISO) leads our Global Information Security team, reports to the Chief Information Officer (CIO), and meets regularly with other members of senior management. Our CISO holds advanced degrees in Computer Science and Business Administration, in addition to relevant IT and cybersecurity certifications from organizations such as the EC Council, ISACA, and CSA. She has served in various IT roles for over 20 years, including leading the IT Security function.


text: Our Global Information Security team is responsible for the information security strategy, policy, security engineering, operations, and cyberthreat detection and response. Our Global Information Security team, which includes a security operations center, seeks to protect the company against reasonably foreseeable cyberthreats and risks. The cybersecurity team members have the qualifications and certifications required for their roles. In addition, they have relevant industry experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes globally. In order to stay ahead of potential threats and enhance our overall security posture, we rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants that we engage.


text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. We temper this architecture with a business-risk-based approach that ensures we protect our digital assets while aligning our security measures with our overall organizational goals and priorities. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.


text: In the event of an incident, we leverage a multi-layered set of plans that include Endpoint Detection and Response software, Security Information and Event Management tools for detection, a Cybersecurity Incident Response Plan, and a Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, and reputational impacts on the Company to determine the materiality of the incident and the appropriate response.


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third-party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability tests, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.


text: We rely on third-party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third-party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire, and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, systems, or business. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee quarterly regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner and report them to senior leadership, the Board of Directors, and regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision-making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM update is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.


text: Our information technology, communication networks, enterprise applications, accounting and financial reporting platforms and related systems are integral to our operations. We use these systems, among others, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our operations rely on securing, collecting, storing, transmitting, and processing of proprietary and confidential data.

companyName: BRT Apartments Corp.

ticker: BRT


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the shared services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Senior Vice President-Finance and Senior Vice President. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).


text: Our internal auditor perform certain procedures to test the integrity and functionality of our IT systems (which includes a high-level review of our cybersecurity defenses). In addition, we have retained a third-party cybersecurity consulting firm that (i) advises us as to cybersecurity matters (including prevailing cybersecurity threats), (ii) performs, on a periodic basis, assessments of our cybersecurity defenses and (iii) on a continuous basis, monitors our IT systems for cybersecurity threats and intrusions.


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report for additional discussion about cybersecurity-related risks.


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we generally rely on such providers to maintain appropriate cybersecurity practices.


text: At the Board level, our cybersecurity practices are overseen by the audit committee as part of its oversight of our risk management activities. The committee meets periodically with, among others, our internal auditor and network administrator to review and discuss cybersecurity matters.


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the shared services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Senior Vice President-Finance and Senior Vice President. These officers do not have IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we rely on such providers to maintain appropriate internal and external cybersecurity practices.


text: Brunswick's leadership recognizes the importance of information security and managing cybersecurity risks across the enterprise. We manage our global business operations through a variety of systems for commercial transactions, customer interactions, manufacturing, branding, employee tracking, and other applications. Systems based on legacy technology, sometimes added through acquisitions or hosted by third parties, and/or that contain personal information of customers or employees, present risks of erroneous or fraudulent transactions, disclosure of personal, sensitive, and confidential information, loss of reputation and confidence, potential impacts on our operations, and may result in legal claims or proceedings, penalties, and remediation costs. Our mature cybersecurity program has been strategically designed to assess, identify, and manage these cyber risks, protect the organization, respond to, and recover from cybersecurity incidents.

companyName: BRUNSWICK CORP

ticker: BC


text: Brunswick's Board of Directors (the Board) and its committees are actively engaged in managing cybersecurity risk and overseeing our information security programs. The Audit and Finance Committee (the Committee) is primarily responsible for oversight of Brunswick's information technology and information security/cybersecurity programs. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. The Chief Information Officer (CIO) and/or Chief Information Security Officer (CISO) update the Committee at each of its regularly scheduled meetings. These reports include updates on the Company's cybersecurity programs and key performance indicators; assessment of the program; emerging risks; policies, procedures, and training; and risk mitigation strategies. The CIO and CISO also provide the full Board with information technology and cybersecurity reports on at least an annual basis and with greater frequency as necessary. In addition, the Board oversees Brunswick's long-standing enterprise risk management (ERM) process, which regularly identifies, assesses, and mitigates enterprise and emerging risks, including cyber risks.


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). A dedicated Office of the CISO, which reports to the CIO, is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program. Our cybersecurity team members have extensive information technology and program management experience. The CIO and/or CISO personnel regularly inform the Chief Executive Officer (CEO) and other members of senior management about the program, best practices, current cybersecurity threats, the risk landscape, and mitigation approaches.


text: We use various tools and methodologies to identify, manage, and test for cybersecurity risk on a regular cadence both at the enterprise level and using third party service providers. These third parties include cybersecurity managed security service providers (MSSPs), consultants, advisors, and auditors, who we engage to evaluate our controls, whether through penetration testing, independent audits, or consulting on best practices to address new threats or challenges. We also actively engage with key vendors, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and improve our program. Internally, our employees are a key part of our program. All employees are required to complete cybersecurity training at least once every year, and employees in certain roles must complete additional, specialized cybersecurity training on a regular basis.


text: Our regular interactions with third party vendors and suppliers also pose a cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding and upon detection of an increase in risk profile. In addition, we require providers to meet appropriate security requirements, controls and responsibilities and include additional security and privacy addenda to our contracts where applicable. We also make available cybersecurity education and awareness materials to our suppliers.


text: The Office of the CISO continually works to enhance our robust enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We have an established playbook to promptly detect, assess, and respond to cyber incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to functional leaders, senior management, our CEO, and the Board.


text: On June 13, 2023, Brunswick disclosed an IT security incident that impacted some systems and global facilities. We activated our response protocols, including pausing operations in some locations, engaging leading security experts, and coordinating with relevant law enforcement agencies. Normal global business operations resumed over the course of nine days following the incident. We estimate the incident resulted in lost revenue of approximately $ 80 million to $ 85 million and operating earnings of $ 35 million to $ 40 million. To date, Brunswick has not identified any other cyber event or risks from cybersecurity threats that could be considered material, individually or in the aggregate.


text: Notwithstanding our vigilant cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology.


text: Brunswick's leadership recognizes the importance of information security and managing cybersecurity risks across the enterprise. We manage our global business operations through a variety of systems for commercial transactions, customer interactions, manufacturing, branding, employee tracking, and other applications. Systems based on legacy technology, sometimes added through acquisitions or hosted by third parties, and/or that contain personal information of customers or employees, present risks of erroneous or fraudulent transactions, disclosure of personal, sensitive, and confidential information, loss of reputation and confidence, potential impacts on our operations, and may result in legal claims or proceedings, penalties, and remediation costs.


text: Brunswick's cybersecurity risk management program is managed by a dedicated cybersecurity team. The team is led by the Chief Information Security Officer (CISO), who reports directly to the Chief Executive Officer (CEO) and the Chief Information Officer (CIO), and has over 20 years of experience in information security, cybersecurity, and IT risk management. Brunswick's CISO holds a BBA, majoring in Accounting and Management Information Systems, and an MBA in Strategy and General Management. The CISO is supported by a leadership team with backgrounds in cybersecurity, risk management, and other related capabilities.


text: Brunswick's cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework as guidance for the program. The team regularly assesses the threat landscape to manage risks through a layered cybersecurity strategy based on prevention, detection, and containment, including processes for escalating information about threats or cyber incidents to management and the Board of Directors. We have other policies and procedures that directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption, antivirus protection, multifactor authentication, confidential information, and the use of the internet, email, and wireless devices. The Company also engages third parties in connection with the assessment of our cybersecurity risk management processes against the NIST framework. We actively engage with key vendors, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and improve our program. Internally, our employees are a key part of our program: Brunswick enables a culture in which security is everyone's responsibility. Employees are trained through various methods throughout the year, including annual security training.


text: Our regular interactions with third party vendors and suppliers pose a potential cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding. In addition, we require providers to meet appropriate security requirements, controls, and responsibilities, and include additional security and privacy addenda to our contracts where applicable. We also make cybersecurity education and awareness materials available to our suppliers.


text: Brunswick's Board of Directors (the Board) and its committees are actively engaged in managing cybersecurity risk and overseeing our information security programs. The Audit and Finance Committee (the Committee) is primarily responsible for oversight of our information technology and information security/cybersecurity programs. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. The CISO updates the Committee at each of its regularly scheduled meetings. These reports include updates on our information security/cybersecurity programs and key performance indicators, assessment of the program, emerging risks, policies, procedures, training, and risk mitigation strategies. The CIO and CISO also provide the full Board with information technology and cybersecurity reports on at least an annual basis and with greater frequency as necessary. In addition, the Board oversees Brunswick's long-standing enterprise risk management (ERM) process, which regularly identifies, assesses, and mitigates enterprise and emerging risks, including cyber risks.


text: In 2024, Brunswick did not identify any cyber events or risks from cybersecurity threats that could be considered material, individually or in the aggregate.


text: Notwithstanding our program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors for a discussion of risks related to cybersecurity and technology.


text: Cybersecurity risk management is an important part of MasTec's overall risk management efforts. We maintain a comprehensive enterprise-wide information security program that comprises policies and controls designed to identify, safeguard against, detect, respond to, mitigate and manage reasonably foreseeable cybersecurity risks and threats. Our approach utilizes diverse security tools to prevent, identify, investigate, resolve and recover from vulnerabilities and security incidents. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: MASTEC INC

ticker: MTZ


text: We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework and is organized into five key functions: identification, protection, detection, response and recovery. We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who report to our executive management team, are responsible for identifying, assessing and managing material cybersecurity risks, establishing processes to monitor such risks, putting appropriate mitigation measures in place, maintaining appropriate policies and procedures for our cybersecurity program and providing periodic updates to the Audit Committee of our Board of Directors. To this end, our cybersecurity team conducts annual reviews of enterprise-level cybersecurity risks. Additionally, we maintain company-wide policies and procedures concerning cybersecurity matters, which are subject to annual internal review, or more frequent, as warranted. MasTec's CISO oversees the development and implementation of our information security program and reports on cybersecurity matters to the Audit Committee. Our CIO and CISO each has over 15 years of experience in cybersecurity oversight, and our cybersecurity team is composed of personnel with a broad range of professional cybersecurity experience and expertise, and includes members with cybersecurity certifications, such as the Certified Information Systems Security Professional (CISSP) certification.


text: Our cybersecurity risk management program encompasses such items as simulations and tabletop exercises with management's participation and incorporates external resources and advisors as necessary. All employees undergo security awareness training, with regular testing through simulated phishing emails. Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable. We maintain a security operations center, which is staffed 24/7, to strengthen our monitoring and alerting efforts. Regular simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective.


text: Our CIO and CISO routinely inform our Chief Financial Officer and other members of management, as appropriate, about threats, including assessments of threat levels, trends, incidents and related remediation plans, including matters related to the prevention, detection and remediation of any incidents in accordance with our cybersecurity program. We regularly collect data on cybersecurity threats and risk areas and conduct periodic external penetration and other tests to assess the effectiveness of our processes and procedures. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.


text: Our Board of Directors has oversight of our enterprise risk assessment and risk management processes, as well as the steps taken to mitigate these risks, including for cybersecurity matters. The Audit Committee of our Board of Directors has oversight of cybersecurity risk assessment and risk management policies as part of its risk management oversight responsibilities, and is responsible for ensuring that the Company has processes in place to identify, evaluate and manage cybersecurity risks, as well as appropriate processes and programs to mitigate cybersecurity incidents if they occur. The Audit Committee actively engages in cybersecurity risk discussions and receives periodic updates on the Company's cybersecurity program from our CISO, including updates on various cybersecurity matters such as risk assessments, threats, incidents, prevention, detection and remediation of incidents, mitigation strategies, areas of emerging risk and industry trends, among other topics. Significant cybersecurity matters, including those related to incidents, are escalated to the Board of Directors.


text: We face cybersecurity threats in the ordinary course of our business and have faced cybersecurity threats and breach attempts in the past. Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "We rely on information, communications and data systems in our operations. Systems and information technology interruptions and/or data security breaches could adversely affect our ability to operate, our operating results, our data security or our reputation." in Item 1A. "Risk Factors."


text: We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology framework and is organized into five key functions: identification, protection, detection, response and recovery. We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.


text: We regularly collect data on cybersecurity threats and risk areas and conduct periodic external penetration and other tests to assess the effectiveness of our processes and procedures. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.


text: We engage third-party industry cybersecurity experts to evaluate and review our cybersecurity programs. Our cybersecurity risk management program encompasses such items as simulations, drills, assessments, and tabletop exercises with management's participation and incorporates third-party industry cybersecurity experts and advisors as appropriate. These simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective. In addition, all employees undergo security awareness training, with regular testing through simulated phishing emails. Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable. We also maintain a security operations center, which is staffed 24/7, to strengthen our monitoring and alerting efforts.


text: We face cybersecurity threats in the ordinary course of our business and have experienced cybersecurity threats and breach attempts in the past. Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "We rely on information, communications and data systems in our operations. Systems and information technology interruptions and/or data security breaches could adversely affect our ability to operate, our operating results, our data security or our reputation." in Item 1A. "Risk Factors."


text: Our CIO and CISO routinely inform our Chief Financial Officer and other members of management, as appropriate, about threats, including assessments of threat levels, trends, incidents and related remediation plans, including matters related to the prevention, detection and remediation of any incidents in accordance with our cybersecurity program.


text: Risk Management and Strategy CACI is committed to maintaining a robust cybersecurity management and oversight program to mitigate cybersecurity risks to our systems and to protect both our and our customer's confidential and sensitive information. We employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: CACI's cybersecurity program is integrated into our overall risk management program and is primarily managed by our Chief Information Security Officer ("CISO") who is responsible for coordinating cross-functional internal and external resources to establish processes and procedures to monitor potential cybersecurity risks, identify cybersecurity incidents, implement appropriate mitigation measures, report cybersecurity breaches and maintain our cybersecurity program. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from experienced cybersecurity professionals in the information security team, and with technological tools and software. We continuously monitor cybersecurity threats and assess the robustness of our mitigation and prevention measures through routine internal and independent audits, threat simulations, vulnerability and penetration testing and employee cybersecurity training. Our cybersecurity program is designed to be aligned with applicable industry standards and we continue to invest in capabilities to protect all information assets in our possession.


text: As a government contractor, we have designed our cybersecurity risk management program to align with the National Institute of Standards and Technology ("NIST") standards and comply with extensive regulations, including but not limited to U.S. government cybersecurity regulations. Additionally, our cybersecurity program is routinely assessed by the government and our network is penetration tested biannually by a third-party independent assessor. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations, including implementing certain security controls and complying with certain reporting obligations. Although we perform due diligence on all service providers to identify potential cybersecurity risks and establish controls through onboarding procedures and contractual requirements, our ability to monitor the cybersecurity practices of our service providers and ensure that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors is limited.


text: In the event of a cybersecurity incident, the Company has established an incident response plan to address the matter promptly and effectively. Our CISO leads our Cybersecurity Incident Response Team ("CIRT") that is responsible for leading and coordinating CACI's response to cybersecurity incidents in accordance with CACI's established cybersecurity incident response plan and response processes. In accordance with these policies, cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for escalation to CACI's Executive Incident Assessment Committee. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.


text: The Audit and Risk Committee ("Audit Committee") has oversight responsibility for risks and incidents relating to cybersecurity, including compliance with regulatory requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee receives regular briefings on our cybersecurity posture, cybersecurity trends and cybersecurity risks from management and, if they occur, is briefed regarding any material cybersecurity incidents. The Audit Committee reports any findings or recommendations to the Board, as appropriate.


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: CPKC's cybersecurity risk management program is an integrated and essential component of the Company's overall risk management strategy. Through its Security Management Plan, CPKC maintains a comprehensive, risk-based plan that is modelled on and was developed in conjunction with the security plan prepared by the Association of American Railroads post-September 11, 2001. This plan also covers regulatory requirements such as TSA Cyber Security Directives and auditing requirements. Under this plan, the Company routinely examines and prioritizes cyber vulnerabilities and threats while also testing and revising protective measures for its assets and operations, both physical or cyber. Likewise, the Company's cybersecurity risk management program entails real-time review and monitoring of CPKC's cyber-risk exposures and implements strategic processes to manage those risks.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: The Company's cybersecurity program utilizes the National Institute of Standards and Technology Cybersecurity Framework as its foundation. Accordingly, CPKC's program includes periodic risk assessments, penetration testing by a third-party, audit participation, employee and contractor training, and the implementation of technologies to assist in mitigating cybersecurity risks and harms. Incident response procedures, including escalation procedures, are designed, implemented, and periodically tested to assist the Company in detecting, responding to, and recovering from a potential cybersecurity incident, and making any timely notification or disclosure that may be required under the circumstances. The Company scopes the third-party penetration tests as real-world attacks against perimeter defenses and internal processes such as social engineering and phishing.


text: The Company's cybersecurity risk management program also includes ongoing threat research and analysis conducted with the assistance of third parties, including on emerging threat attack vectors, tactics, actors and motivations. The Company also engages in ongoing network monitoring and has implemented a vulnerability management and patching program. Further, CPKC employs structured vetting and ongoing risk management processes to identify and mitigate cyber risks associated with the use of third-party service providers, including specifically in the area of technology.


text: To date, risks arising from cybersecurity threats have not materially affected the Company, its results of its operations, or its financial condition. However, the Company also recognizes the reality of the ever-evolving cyber risk landscape faced by industries and businesses across the world. Depending on their source and nature, cyber incidents could in the future materially affect CPKC and its operations, and financial condition.


text: See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.


text: The Board of Directors oversees the work of all of its committees, including the Risk and Sustainability Committee. The Risk and Sustainability Committee is responsible for overseeing the Company's strategic and integrated risk practices, including its approach to management and assessment of cybersecurity risks. The Chief Information Officer (CIO) provides annual and periodic updates to the Risk and Sustainability Committee and the Board of Directors on cybersecurity risks and the Company's implementation of its strategy for mitigating such risks. In addition, the Company's Chief Information Security Officer (CISO) also briefs the Risk and Sustainability Committee. The Audit and Finance Committee receives updates on information systems and cybersecurity audit and advisory engagements from the Chief Internal Auditor.


text: The CISO reports directly to the CIO and is responsible for: • Overseeing and implementing CPKC's cybersecurity strategy; • Aligning cybersecurity objectives with the overall business objectives; • Ensuring compliance with regulatory directives related to cybersecurity; • Promoting a cybersecurity culture through comprehensive awareness and training programs; and • Managing and coordinating incident response activities.


text: The Company's cybersecurity risk management program is supervised by the Managing Director of Enterprise Security who reports directly to the CISO. The Chief Information Officer and CISO regularly update senior leadership and the executive committee on cybersecurity risks.


text: The CISO, CIO, and certain members of their management team who are involved in implementing the Company's cybersecurity program possess expertise in cybersecurity risk management. Our CISO and CIO each have many years of experience in designing and implementing cybersecurity frameworks and working to mitigate cyber threats. Among other qualifications, certain members of the CISO's and CIO's management team also have certifications as a CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).


text: The Board of Directors oversees the work of all its committees, including the Audit and Finance Committee. The Audit and Finance Committee is responsible for, among other things, overseeing the Company's financial disclosures and its internal and external audit functions, maintaining the integrity of financial reporting and internal controls, and providing stewardship and guidance to management in its approach to the assessment and mitigation of cybersecurity risks. The Chief Information Officer ("CIO") provides annual and periodic updates to the Audit and Finance Committee and the Board of Directors on cybersecurity risks and the Company's strategy for mitigating such risks. Additionally, the Chief Information Security Officer ("CISO") briefs the Audit and Finance Committee periodically. The Audit and Finance Committee also receives updates on information systems and cybersecurity audit and advisory engagements from the Chief Internal Auditor.


text: The Company's cybersecurity risk management program is supervised by the Managing Director of Enterprise Security who reports directly to the CISO. The CIO and CISO regularly update senior leadership and the executive committee on cybersecurity risks.


text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. This program is a component of our ERM function. Our ERM function manages enterprise-wide risk and has established a governance structure in charge of continuous risk management. It has defined risk management processes related specifically to cybersecurity, which include targeted cyber risk reviews and annual cyber risk assessments over our IT and operations. We also have a Cyber and Privacy Risk Committee, led by our CISO, which provides strategic and actionable recommendations on cybersecurity topics, issues, and controls to our executive management team, and a Crisis Management Committee, led by our head of ERM, which manages significant cybersecurity events.


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. At least annually, our information security and internal audit teams conduct comprehensive internal and external penetration testing, supplemented by more frequent Purple-team Tests that are designed to identify critical areas of our technical environment and potential vulnerabilities that may need to be addressed. Our information security team also retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We conduct tabletop exercises to prepare for potential cyber incidents and assess our cybersecurity preparedness and processes. We also require annual cybersecurity training by our employees, conduct regular exercises to help our employees recognize phishing emails and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.


text: In response to the growing risks associated with third-party service providers, we have established review processes for assessing the technological and information security controls of our third-party suppliers to attempt to identify material cybersecurity risks associated with such providers, their IT systems, and their access to our IT systems that could significantly disrupt our operations. These processes encompass a range of measures, such as pre-engagement cybersecurity due diligence for providers who access our IT systems or information before their engagement, ongoing monitoring and evaluation of our providers, detailed examination of available System and Organization Controls attestation reports, and inclusion of relevant contractual provisions in our agreements with third-party service providers with respect to areas including cyber protections, notifications, auditing, and risk allocation.


text: We maintain an IRP, which provides a set of core practices and procedures when responding to certain high-risk information security threats and incidents, and a CMP, which is designed to ensure appropriate resources are utilized to provide an effective, timely, and coordinated response in managing crises, including significant cyber threats and incidents. Among other things, the IRP sets forth roles and responsibilities in connection with detecting, assessing, and mitigating cybersecurity incidents and outlines applicable communication and escalation protocols. Under the CMP, our Crisis Management Committee will assume overall responsibility in an effort to ensure that the appropriate functions and work streams are mobilized and coordinated to effectively manage any significant cyber events.


text: As with all large IT systems, we have been a target of cyberattackers and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impact of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal control over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of this Form 10-K.


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CDIO and CISO meet with the Audit Committee on a quarterly basis and provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of ERM also meets with our executive management team and the Audit Committee on a quarterly basis and with the Board of Directors on an annual basis and reports on applicable cyber risk management processes and activities pertinent to the ERM function.


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, including our Cyber and Privacy Risk Committee described above, led by our CISO. Our CISO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and CPG industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CISO has a Master of Business Administration in management and operations and a Bachelor's Degree in technology management, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CISO reports to our CDIO, who meets regularly with other members of our executive team and provides relevant updates on our cybersecurity program.


text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of confidential, personal, or sensitive information; cyber threat detection, assessment, and response; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. This program is integrated into our ERM processes. Our ERM function manages enterprise-wide risk and has established a governance structure in charge of continuous risk management. It has defined risk management processes related specifically to cybersecurity, which include targeted cyber risk reviews, annual cyber risk assessments over our IT and operations, and integration with our information security function. We also have a Cyber and Privacy Risk Committee, led by our CISO, which provides strategic and actionable recommendations on cybersecurity topics, issues, and controls to our executive management team, and a Crisis Management Committee, led by our head of ERM, which manages significant cybersecurity events.


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. At least annually, our information security and internal audit teams conduct extensive internal and external penetration testing, supplemented by more frequent Purple-team Tests that are designed to identify critical areas of our technical environment and potential vulnerabilities that may need to be addressed. Our information security team also retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We conduct a range of activities to assess our cybersecurity preparedness and processes and to prepare for potential cyber incidents, including tabletop exercises, simulations, and practical application drills with internal teams and external entities. We also require annual cybersecurity training by our employees, conduct regular exercises to help our employees recognize phishing attempts and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.


text: As with all large IT systems, we have been a target of cyberattackers and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impacts of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal control over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of this Form 10-K.


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CIO and CISO meet with the Audit Committee on a quarterly basis and provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of ERM also meets with our executive management team and the Audit Committee on a quarterly basis and with the Board of Directors on an annual basis and reports on applicable cyber risk management processes and activities pertinent to the ERM function. The Audit Committee has also periodically participated in certain of our cyber tabletop exercises.


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, including our Cyber and Privacy Risk Committee described above, led by our CISO. Our CISO has more than 25 years of technology experience across various disciplines, including 15 years of experience as a CISO in the financial, manufacturing, and CPG industries. He has led our global information security organization for more than five years. In addition to his employment experience in the cybersecurity field, our CISO has a Master of Business Administration in management and operations and a Bachelor's Degree in technology management, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CISO reports to our CIO, who meets regularly with other members of our executive team and provides relevant updates on our cybersecurity program.


text: The Company maintains and, at least annually, reviews its information technology ("IT") and cybersecurity policies and procedures (the "Cybersecurity Program"). The Cybersecurity Program is aligned to the National Institute of Standards of Technology Cybersecurity Framework. The Cybersecurity Program includes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Management has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: As part of our overall cybersecurity risk management process, our management engages at least annually in the review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security controls. Any failure in our key service providers' cybersecurity systems could have a material impact on our operating results. See "Risk Factors - Risks Related to our Business and Structure - A failure of cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Additionally, the Cybersecurity Program includes quarterly general cybersecurity awareness and data protection training for employees as well as regular phishing simulations. The Company also has annual certification requirements for employees with respect to certain policies supporting the cybersecurity program including the IT, Cybersecurity and Physical Security Policies and Procedures, the Disaster Recovery Business Continuity Plan, the Electronic Communications Policy and the Privacy Policy.


text: Our Cybersecurity Program is administered by our Corporate Controller and our Chief Compliance Officer. These individuals, along with our external legal counsel and third party IT providers serve as the crisis response team in connection with any material cybersecurity incident under our Incident Response Plan. The Incident Response Plan provides guidelines for responding to a cybersecurity incident and facilitates coordination between the necessary parties. This includes notification to our senior management, and if material, reported to Board of Directors. We also utilize the services of IT and cybersecurity consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems to recommend improvements to our Cybersecurity Program. The Company maintains a cybersecurity insurance policy, which includes services of additional third party experts in the event of a cyber incident. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk management, including cybersecurity. The Board receives quarterly updates to the Cybersecurity Program from the Company's management. These updates include the results of the cybersecurity risk assessments, the planning and results of the periodic testing by our third party IT and cybersecurity consultants, updates and enhancements to the Cybersecurity Program and the Incident Response Plan, and reporting of additional cybersecurity data metrics.


text: Additionally, the Cybersecurity Program includes quarterly general cybersecurity awareness and data protection training for employees as well as regular phishing simulations. The Company also has annual certification requirements for employees with respect to certain policies supporting the cybersecurity program including the IT, Cybersecurity and Physical Security Policies and Procedures, the Disaster Recovery Business Continuity Plan, the Social Media and Electronic Communications Policy and the Privacy Policy.


text: Our Cybersecurity Program is administered by our Executive Vice President of Accounting and our Chief Compliance Officer. These individuals, along with our external legal counsel and third-party IT providers serve as the incident response handlers in connection with any material cybersecurity incident under our Incident Response Plan. The Incident Response Plan provides guidelines for responding to a cybersecurity incident and facilitates coordination between the necessary parties. This includes notification to our senior management, and if material, reported to Board of Directors. We also utilize the services of IT and cybersecurity consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems to recommend improvements to our Cybersecurity Program. The Company maintains a cybersecurity insurance policy, which includes services of additional third party experts in the event of a cyber incident. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk management, including cybersecurity. The Board receives quarterly updates to the Cybersecurity Program from the Company's management. These updates include the results of the cybersecurity risk assessments, the planning and results of the periodic testing by our third-party IT and cybersecurity consultants, updates and enhancements to the Cybersecurity Program and the Incident Response Plan, and reporting of additional cybersecurity data metrics.


text: Carpenter Technology's cybersecurity team and organizational partnerships are designed to protect our employees, intellectual property and customers from various cyber threats. Our cybersecurity team strives to achieve these protections through obtaining leading certifications and regular engagement with third parties and federal organizations to further protect our information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: As cybersecurity risks continue to evolve and potentially affect businesses globally, Carpenter Technology understands that protecting business, employee, and customer information, data, and systems is of critical importance. Through a series of cybersecurity imperatives aligned with the National Institute of Standards and Technology (NIST), Carpenter Technology assesses, identifies and manages potential cyber risks. Imperatives include: • Increasing Visibility: Improve understanding of what to protect • Rapid Response: Mitigate the amount of damage that could occur • Shrink Surface of Attack: Reduce the total resources exposed to cyber threat • Identity Management: Ensure the right people have correct access • Supply Chain Risk Management: Manage security risks introduced by vendors and third parties • Data-Centric Security: Protect data throughout the lifecycle Carpenter Technology's multi-faceted cybersecurity program includes implementation of leading technologies to detect evolving cyber threats, recurring regular cybersecurity training to keep employees situationally aware, mock security exercises to prepare for rapid response, penetration tests to continuously improve operations, and internal audits to confirm controls are operating effectively. Carpenter Technology also maintains strong partnerships with law enforcement, leading academic institutions and peers in the manufacturing industry to stay informed of the latest cybersecurity developments and trends in the ever-evolving threat landscape. Employees annually review and acknowledge an information systems Acceptable Use Policy. Information Technology associates participate in comprehensive annual training including DFARS and Sarbanes-Oxley compliance training.


text: Carpenter Technology maintains a Cybersecurity Incident Response Plan ("CIRP") which provides specific guidance and documentation for proper incident handling and communication. The CIRP applies to all locations and situations where Carpenter Technology business is conducted. All cybersecurity incidents, regardless of severity, are to be promptly handled according to this plan. The CIRP will invoke Carpenter Technology's business continuity and crisis management processes for the most severe incidents.


text: Additionally, Carpenter Technology leverages third party security firms in various capacities to assist with various aspects of Carpenter Technology's cybersecurity program, including risk assessments, vulnerability scans, and penetration testing. Carpenter Technology uses a variety of processes to address cybersecurity threats related to the use of third party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of Carpenter Technology's process to continuously improve its cyber and information security programs, Carpenter Technology also engages third party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from the cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: The Board of Directors is provided regular updates on the Company's cybersecurity program. The Audit/Finance Committee of the Board of Directors oversees the Company's risk management program, including cyber and information security. The Board of Directors is also regularly briefed on Carpenter Technology's cybersecurity risks and mitigation efforts. The oversight of our cybersecurity risk is integrated into our Enterprise Risk Management ("ERM") process owned by management and facilitated by Carpenter Technology's Internal Audit department. The ERM program includes an annual risk prioritization process designed to identify key enterprise risks. Each key enterprise risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The annual risk assessment is presented to the full Board of Directors at least once per year, with regular updates presented quarterly to the Audit/Finance Committee.


text: Management's Role in Cybersecurity Risk Management We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. The current CISO has 15+ years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training and incident response. The CISO's credentials include a Master of Science Degree in Information Security Management from SANS Technology Institute and a CISO Certificate from Carnegie Mellon University. The CISO holds multiple certifications including CISSP, CISA, GCIH, GCIA and PMP. Pursuant to our formal CIRP, suspected cybersecurity incidents are first evaluated by the Carpenter Technology Cybersecurity Team Leader who follows the guidance as outlined in the CIRP to respond to cybersecurity incidents and escalate as necessary based on a defined severity matrix. Based on the nature and severity of the incident, the response team may be comprised of representatives from our Information Technology, Human Resources, Safety, Legal, Finance and Communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to the executive crisis response team, which includes Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.


text: Additionally, Carpenter Technology leverages third party security firms in various capacities to assist with various aspects of Carpenter Technology's cybersecurity program, including risk assessments, vulnerability scans and penetration testing. Carpenter Technology uses a variety of processes to address cybersecurity threats related to the use of third party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of Carpenter Technology's process to continuously improve its cyber and information security programs, Carpenter Technology also engages third party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs.


text: Management's Role in Cybersecurity Risk Management We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. The current CISO has 15+ years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training and incident response. The CISO's credentials include a Master of Science Degree in Information Security Management from SANS Technology Institute and a CISO Certificate from Carnegie Mellon University. The CISO holds multiple certifications including CISSP, GCIH, GCIA and PMP. Pursuant to our formal CIRP, suspected cybersecurity incidents are first evaluated by the Carpenter Technology Cybersecurity Team Leader who follows the guidance as outlined in the CIRP to respond to cybersecurity incidents and escalate as necessary based on a defined severity matrix. Based on the nature and severity of the incident, the response team may be comprised of representatives from our Information Technology, Human Resources, Safety, Legal, Finance and Communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to the executive crisis response team, which includes Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance.

companyName: CATERPILLAR INC

ticker: CAT


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a global company, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to attacks from more advanced adversaries. Our customers, suppliers, and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systemic risks.


text: We maintain a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, and others. We also consume threat intelligence from several paid and non-paid sources.


text: We maintain a 24 x 7 operations center which serves as a central location for the reporting of cybersecurity matters, provides monitoring of our global cybersecurity environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development, and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.


text: We operate a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience, and supporting the integrity of components and systems used in its products and services. We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or joint venture partner could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity third-party risk assessment process. Identified deficiencies are addressed through a risk remediation process. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.


text: As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Item 1A. "Risk Factors—Operational Risks— Increased information technology security threats and more sophisticated computer crime pose a risk to our systems, networks, products and services" of this Form 10-K, these threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in our products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.


text: Caterpillar's board has oversight for risk management with a focus on the most significant risks facing the Company, including strategic, operational, financial and legal compliance risks. The board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which our cybersecurity processes are an integral component.


text: The board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the board. The board has delegated the oversight of specific risks to board committees that align with their functional responsibilities. The Audit Committee (the "AC") assists the board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, the Company's information security program. The AC assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. The Company's Chief Information Officer & Senior Vice President, Caterpillar IT (the "CIO") attends all bimonthly AC meetings and provides cybersecurity updates to the AC and board.


text: Our cybersecurity program is overseen by our CIO, who has been a Caterpillar employee for nearly twenty-five years. Prior to her current appointment as our CIO in September 2020, she was the Chief Information Officer for the Company's Financial Products Division. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. Our CIO leads a cross-functional cybersecurity team comprised of professionals from our product, cybersecurity, legal and compliance organizations who focus on managing the security of our connected solutions. This team manages the Company's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Our cybersecurity program is overseen by our CIO, who has been a Caterpillar employee for over twenty-five years. Prior to her current appointment as our CIO in September 2020, she was the Chief Information Officer for the Company's Financial Products Division. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. Our CIO leads a cross-functional cybersecurity team comprised of professionals from our product, cybersecurity, legal and compliance organizations who focus on managing the security of our connected solutions. This team manages the Company's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Cybersecurity is a critical component of Synovus' business and the advancement of our strategies, including our growth initiatives. As a financial institution, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries that target the financial services industry specifically. Our clients, vendors, and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these stakeholders could materially adversely affect our operations, performance, and results of operations. As such, we maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to these cybersecurity threats and risks. Our program is fully integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and client-facing products and services.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: We believe each of Synovus' employees has a role in the Company's cybersecurity defenses. Employees at various levels and in various lines of business and support functions participate in training programs on cybersecurity and social engineering to mitigate risk, including required annual training, quarterly training on critical topics, and bimonthly security awareness communications. We conduct exercises to test their effectiveness on a monthly basis.


text: We employ a formal risk management process for the identification, assessment, monitoring, acceptance, communication, consultation, and review of cyber-related risks which is designed in accordance with industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework and International Organization Standard 27005. The Company's information security standards are externally audited on an annual basis against the System and Organizational Controls (SOC) and compliance with Payment Card Industry Data Security Standard (PCI DSS). Our program is reviewed on a periodic basis against the Federal Financial Institutions Examination Council's (FFIEC) Cybersecurity Assessment Tool and the National Institute of Standards and Technology Cybersecurity Framework in order to measure our cybersecurity preparedness, evaluate whether our cybersecurity preparedness is aligned with risks, determine potential areas of improvement or enhancement for the Company's risk management practices and controls, and inform our risk management strategies.


text: Our information security program employs a wide variety of technologies that are intended to secure our operations and proprietary information. We have a Business Continuity/Disaster Recovery program in place, which is updated and tested on a regular basis, focused on protecting our networks, systems, data, and facilities from attacks or unauthorized access. We maintain an Incident Response program which describes Synovus' processes, procedures, and responsibilities for responding to cybersecurity incidents. This program is tested regularly through tabletop exercises, including through independent third-party review and assessments at least annually. Each exercise results in lessons learned and subsequent improvements to the Incident Response program. In addition, we have a dedicated Cybersecurity Fusion Center for monitoring and responding to cyber events in real-time.


text: We also continue to invest in developing and enhancing our security processes and controls and in maintaining our technology infrastructure. These programs provide for an intentional and deliberate plan for notifying, informing, consulting, analyzing, and communicating any risks or incidents as necessary and appropriate under the circumstances to various internal stakeholders (such as executive management and the Board) and external stakeholders (such as our regulators, impacted individuals, and the investment community) as necessary and appropriate.


text: Cyber advisors are a key part of Synovus' cybersecurity infrastructure, and we partner with leading cybersecurity companies and organizations to leverage third-party technology and expertise as appropriate. We engage and retain independent third-parties to review and assess our information security program on a regular basis and to perform annual penetration tests against our network. We maintain computer forensics, legal, and security firms on retainer in case of a cyber security incident. In addition, we are members of financial sector organizations, including the Financial Services Information Sharing and Analysis Center (FS-ISAC), which facilitates the sharing of cyber and physical threat, vulnerability, and incident information for the good of the membership and for improvement in industry best practices. We also perform comprehensive cybersecurity due diligence and ongoing oversight of third-party relationships, including vendors, and require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: Synovus' business depends on the availability, reliability, confidentiality, and security of our information systems, networks, and data. Any disruption, compromise, or breach of our systems or data due to a cybersecurity incident or threat could have a material adverse effect on our business strategy, financial condition, or results of operation. While the Company has experienced, and will continue to experience, cyber incidents in the normal course of business, to date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our efforts to continually enhance our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, financial condition, or results of operation. See "Part I - Item 1A. Risk Factors – Operational Risk" of this Report.


text: Cybersecurity Governance Synovus' Chief Information Security Officer ("CISO"), reports to Synovus' Executive Vice President, Technology, Security, and Operations and is the head of Synovus' cybersecurity team. The CISO is responsible for assessing and managing Synovus' cyber risk management program and strategy, informing executive management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervising such enterprise-wide efforts. Synovus' current CISO has extensive information technology and program management experience with over 25 years of corporate information security experience. The CISO leads a cybersecurity team with decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants retained by Synovus.


text: Our Board is actively engaged in the oversight of Synovus' information security risk management and cybersecurity programs and has delegated primary oversight of cybersecurity to our Risk Committee. The Risk Committee receives quarterly updates from the Company's CISO on the Company's information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness, and cybersecurity risk assessments. As a part of these quarterly updates, the CISO updates the Risk Committee on the development of any new or emerging cyber risks or threats and the appropriate mitigation actions. In addition, the Risk Committee annually approves the Company's information security program as part of its oversight of information risk, aligning our cyber risk exposure with our strategic objectives.


text: The CISO also reports to the full Board on the Company's information security program at least annually, facilitates Board tabletop exercises on cybersecurity, discusses any changes in the Company's cyber risk profile, and provides Board training on a periodic basis with third-party cybersecurity experts. Moreover, consistent with our Incident Response plan, the Risk Committee and the Board are to be apprised of significant cybersecurity incidents.


text: We believe each of Synovus' employees has a role in the Company's cybersecurity defenses. Employees at various levels and in various lines of business and support functions participate in training programs on cybersecurity and social engineering to mitigate risk, including required annual training, quarterly training on critical topics, and bi-monthly security awareness communications. We conduct exercises to test their effectiveness on a monthly basis.


text: We employ a formal risk management process for the identification, assessment, monitoring, acceptance, communication, consultation, and review of cyber-related risks which is designed in accordance with industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework and International Organization Standard 27005. The Company's information security standards are externally audited on an annual basis against the System and Organizational Controls (SOC) and compliance with Payment Card Industry Data Security Standard (PCI DSS). Our program is reviewed on a periodic basis against the National Institute of Standards and Technology Cybersecurity Framework in order to measure our cybersecurity preparedness, evaluate whether our cybersecurity preparedness is aligned with risks, determine potential areas of improvement or enhancement for the Company's risk management practices and controls, and inform our risk management strategies.


text: Cyber advisors are a key part of Synovus' cybersecurity infrastructure, and we partner with leading cybersecurity companies and organizations to leverage third-party technology and expertise as appropriate. We engage and retain independent third parties to review and assess our information security program on a regular basis and to perform annual penetration tests against our network. We maintain computer forensics, legal, and security firms on retainer in case of a cyber security incident. In addition, we are members of financial sector organizations, including the Financial Services Information Sharing and Analysis Center (FS-ISAC), which facilitates the sharing of cyber and physical threat, vulnerability, and incident information for the good of the membership and for improvement in industry best practices. We also perform comprehensive cybersecurity due diligence and ongoing oversight of third-party relationships, including vendors, and require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.