text: • Training: We have a cybersecurity training program in place for employees. Additionally, our engineers regularly undergo secure code training. • Third-Party Risk Management: Our security experts and our legal team work together to assess third-party vendors to confirm that each vendor contract requires adequate technical and organizational measures to protect the systems and data that such vendor operates or processes on behalf of Zuora. Additionally, we maintain a Supplier Code of Conduct that sets forth our vendor expectations and a Vendor Data Access Policy that establishes the limits on what information our vendors may see, access, modify, and control. • Assessments and Testing: We engage in the periodic assessment and testing of our cybersecurity policies, processes, and practices. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We also engage third parties (including auditors and cybersecurity consulting firms) to perform assessments of our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We adjust our cybersecurity policies, processes, and practices based on the information provided by these assessments and testing activities. • Cybersecurity and Privacy Certifications: Zuora has maintained various security certifications, including ISO 27001, ISO 27002, ISO 27018, ISO 27701, PCI, and SOC 2 Type II.


text: As part of its broader risk oversight activities, the Board of Directors regularly oversees business, strategic, operational, and financial risks facing Zuora, including cybersecurity risks and mitigation plans, primarily through delegation to the Audit Committee. As reflected in the Audit Committee Charter, the Audit Committee periodically reviews with management our cybersecurity and other information technology risks, controls, and procedures, including Zuora's plans to mitigate cybersecurity risks and respond to potential data breaches. To ensure the Audit Committee may carry out these responsibilities, our management team provides regular information technology and cybersecurity updates, including metrics regarding cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, the Audit Committee periodically reviews and provides input regarding the level of information security risk insurance coverage we maintain. The full Board of Directors receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. One of our directors who serves on the Audit Committee recently underwent formal cybersecurity training and earned a National Association of Corporate Directors CERT Certificate in Cybersecurity Oversight.

companyName: ZUORA INC

secItem: Item 1C


text: In the fiscal year ended January 31, 2024, Zuora also hired a new CISO principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our CISO has served in various roles in cybersecurity and information technology for over 25 years and has experience building security programs and leading global teams at large enterprises and fast-growing technology companies.


text: Moreover, our GRC Committee meets bimonthly to evaluate, among other things, cybersecurity incident response readiness and results of our quarterly cybersecurity tests and annual risk assessment. The GRC Committee also reviews corporate progress regarding artificial intelligence governance, audits, and various other security and privacy exercises and addresses any identified gaps in Zuora policies to prevent, detect, mitigate, and/or remediate any potential cybersecurity incidents.


text: Finally, as disclosed above, our incident management procedures are designed to notify and actively involve our Audit Committee and Board of Directors whenever there is a reasonable risk of a material cybersecurity incident.


text: As a financial institution, the Company's business depends on the continuous operation of its information and data processing systems and the security of information received from customers, employees and others. The Company has developed and implemented a cybersecurity program intended to protect the reliability of its critical systems and the confidentiality of nonpublic information.

companyName: PCB BANCORP

ticker: PCB


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer, Information Security Officer in conjunction with Chief Information Officer work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.


text: Features of the cybersecurity risk management program include: • Technology solutions designed to prevent, detect and mitigate cybersecurity incidents. • Review, testing and assessments of the Company's cybersecurity systems, both internal and using third party service providers with cybersecurity expertise. • Required cybersecurity training for employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. • Specialized security training for members of the risk management, cybersecurity and technology teams that includes information about evolving cybersecurity threats and new risk mitigation and detection technologies. • Processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including technology providers and cloud-based platforms. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of the Company. • On-going assessment of the adequacy of the cybersecurity program.


text: Like many financial institutions, the Company has experienced cyber-based attacks and other attempts to compromise its information systems and expects that it will continue to experience these attacks and attempts in the future. In 2021, the Bank was the target of a ransomware attack in which an external actor illegally accessed and/or acquired certain data on its network. As a result, the Bank was sued in a purported class action lawsuit. The lawsuit is currently in process of settlement, subject to final court approval. See "Item 3. Legal Proceedings," above. While the Company has not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business -- System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.


text: The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status project to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer and Information Security Officer, in conjunction with Chief Information Officer, work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.


text: Like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business – System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.


text: The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status of projects to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 15 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Western Midstream Operating, LP


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risk Factors under Part I, Item 1A of this Form 10-K.


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 16 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across other legal, strategic, operational, and financial risk areas.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program while our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly, as well as through the Audit Committee of the Board of Directors, and receives regular updates on relevant information regarding cybersecurity.


text: The Audit Committee receives regular reports from management on our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents (as such term is used and defined in Item 106(a) of Regulation S-K, as amended and supplemented, of the Securities Act ("Regulation S-K")); • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our cybersecurity controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: The Audit Committee receives regular reports from management on our Company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats (as such term is used and defined in Item 106(a) of Regulation S-K). The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.


text: We utilize an internal cross-departmental approach to addressing cybersecurity risk, including input from employees, Senior Management, and our Board of Directors. A cross functional Senior Management Cybersecurity Steering Committee devotes resources to cybersecurity and risk management to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is based on the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Our information technology ("IT") team reviews enterprise risk management-level cybersecurity risks annually, and risks are incorporated into the Enterprise Risk Management Committee framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include several IT Security policies as well as other policies that directly or indirectly relate to cybersecurity, which address topics related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and networked devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The Company's Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").


text: We periodically perform simulations to test employees and provide any necessary remedial training. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training online. We may also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We continue to expand investments in IT security, taking a multi-layered security approach, which includes additional end-user training, improving security defenses, network segmentation, identifying and protecting critical assets, strengthening monitoring, and alerting, and leveraging industry experts where available.


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. In collaboration with our Internal Audit team, the internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee's semi-annual cybersecurity review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Cybersecurity Steering Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and may discuss recent threats and how the Company is managing those threats.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including malware, phishing, and other types of cyber-attacks. For more information about the cybersecurity risks we face, see the risk factors described in Part I, Item 1A, Risk Factors in this Annual Report on Form 10-K.


text: Our Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to our internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Board Oversight of Cybersecurity Matters The board of directors of the Partnership's general partner (the "Board") considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Partnership's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: The Board and Audit Committee are supported in their oversight capacity by the Partnership's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Partnership; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Partnership's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Likewise, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are integrated into the day-to-day activities of the Partnership's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Partnership's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Partnership's use of third-party service providers who may have access to sensitive Partnership data and systems.


text: Material Impact on Partnership During 2023, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: Similarly, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership and its Board with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Partnership's information technology function and Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Partnership's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.


text: Material Impact on Partnership During 2024, 2023, and 2022, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.


text: To combat the ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes ongoing employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. We operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems and partner with a third-party hosted provider. Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 36 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.


text: The Board considers cybersecurity risks in business strategy by getting updates on cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including the VP of Information Technology as well as third-party providers. The Company has not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition.


text: In 2023, we upgraded our enterprise resource planning system to enhance operating efficiencies and provide more effective management of our business operations. The upgrade was substantially completed in the third quarter of 2023. The upgrade included training of personnel, migration of data, and maintaining effective internal controls.


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: extensive IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners. We take a strategic, risk-based approach to our cybersecurity program, which emphasizes continual improvement in an effort to protect and enable our business operations. Our enterprise cybersecurity program is designed to assess, identify, and manage cybersecurity threats through continuous monitoring of our information systems for potential vulnerabilities and through various controls and security tools designed to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including any cybersecurity incidents, in a timely manner.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: In the event a security risk is detected, or a breach occurs, we are prepared with response protocols based on National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and guidelines for testing. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model that evaluates our security controls to help protect against attacker tactics, techniques, and procedures. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.


text: We have implemented the Three Lines of Defense Model as the foundation of our risk management approach. Our information security team serves as a First Line, working with our Enterprise Risk Management & Compliance functions as a Second Line, and our Internal Audit function as the Third Line.


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18 (SSAE-18).


text: We regularly engage external and internal assessors and auditors to evaluate and audit our cybersecurity policies, procedures, standards, and practices. Results from these assessments are shared with management for remediation and with the Cybersecurity and Technology Committee of our board of directors on a regular basis. We have obtained, or are working toward obtaining, industry certifications and attestations and have aligned our cybersecurity program with the NIST Cybersecurity Framework and related controls.


text: As part of our Partner Security Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.


text: During the fiscal year ended January 31, 2024, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.


text: The Cybersecurity and Technology Committee of our board of directors provides oversight of the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and potential breach incidents. The Audit and Risk Committee of our board of directors provides an additional layer of cybersecurity oversight, as it provides oversight of the Company's enterprise risk management program, which includes management of cybersecurity risks and the potential fraud and privacy risks that could arise from a cybersecurity incident.


text: The Chief Security Officer (CSO) and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.


text: Our enterprise cybersecurity program is led by the CSO who oversees both information technology and information security functions. Our CSO brings more than 20 years of cybersecurity experience in various leadership positions, both in technology and finance industries. He holds a doctorate degree from the University of Michigan and holds over 100 US and global security-related patents. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Cybersecurity: We follow a defense-in-depth security model with a Joint Security Operations Center (JSOC), Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Privacy and Governance: Our Data Privacy and Governance team helps our technology teams build a lasting roadmap to creating our products, services, and standards with privacy by design, and transparency at the forefront. • People Safety and Crisis Management: Led by federal law enforcement veterans, our People and Partner Safety team is responsible for ensuring the security of our team members across the US. We also conduct regular tabletop exercises to ensure we are ready to respond to crises, including cybersecurity incidents. • Fraud Prevention: Our Fraud Strategy and Prevention team leverages industry best practices of fraud prevention, identity and access management, and cybersecurity monitoring to protect the transactions of our members and Clients.


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners, and our relationships with them. As further described below, we take various steps designed to help ensure that our platforms, data, and other systems remain available, resilient, and secure in the face of risks presented both by inadvertent actions (e.g., software that fails to operate properly) and by malicious activities (e.g., threat actors deliberately seeking to steal data or otherwise cause disruption). In particular, our industry continues to be a target for increasingly sophisticated cyber threats, including those driven by the rapid advancement of AI, adoption of public cloud environments, and reliance on third parties. We take a security-by-design and risk-based approach to our cybersecurity program, which emphasizes continual improvement to safeguard non-public information and enable our business operations.


text: Our cybersecurity program is structured to identify, assess, and mitigate risks through continuous monitoring, proactive threat intelligence, and a multi-layered defense strategy. We implement security controls, tools, and incident response procedures to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including cybersecurity incidents. We emphasize fraud prevention, data protection, and securing our core platforms, while also prioritizing zero trust architecture, third-party risk management, immutable backups, training our staff and others who may have access to our data and systems, and improvement of our security personnel.


text: In the event of a security risk or breach, we are prepared with response protocols aligned with National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and testing guidelines. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model to evaluate our security controls against attacker tactics, techniques, and procedures.


text: This adaptive approach strengthens our ability to anticipate and counter emerging threats. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18.


text: As part of our Third Party Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.


text: During the fiscal year ended January 31, 2025, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.


text: The Chief Security Officer ("CSO") and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.


text: Our enterprise cybersecurity program is led by the CSO, who brings more than two decades of cybersecurity leadership experience and oversees both information technology and information security functions. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Threat & Vulnerability Management: We follow a defense-in-depth security model with a Joint Security Operations Center, Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Governance, Risk, and Compliance: Our Security Governance, Risk, and Compliance team helps drive trust, compliance, and data protection by managing risks, including supply chain risks, to strengthen customer confidence, support innovation, and protect our reputation. • Fraud Prevention: Our Fraud Strategy and Prevention team seeks to employ industry best practices of fraud prevention, identity and access management ("IAM"), and cybersecurity monitoring to protect the transactions of our members and Clients. We continue to invest in people, processes, and technology solutions to enhance our fraud prevention program. • Security Engineering & Architecture: Our Security Engineering & Architecture team designs and implements resilient security solutions, embedding security into cloud and on-premise environments while automating controls and integrating security into development lifecycles. • Identity & Access Management: Our IAM team enforces zero trust principles, least privilege access, and adaptive authentication, managing multi-factor authentication, privileged access management, and just-in-time access to protect critical systems while ensuring seamless and compliant user access.


text: Our enterprise-wide approach to risk management is designed to support the achievement of our organizational and strategic objectives and improve long-term organizational performance. Cybersecurity is a critical component of our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by our Board and the Audit Committee of our Board (the "Audit Committee").

companyName: ROKU, INC

ticker: ROKU


text: Our cybersecurity program is designed to assess, identify, and manage cybersecurity risks and threats. Key components of our cybersecurity program include: • managing cybersecurity threats by deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, which we evaluate and seek to improve, including through vulnerability assessments and cybersecurity threat intelligence; • maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems; • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures; • a third-party cybersecurity risk management process, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors; and • cybersecurity awareness training for all employees and enhanced training for certain employees.


text: As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, primarily through delegation to the Audit Committee. As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns. The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Trust Engineering, who regularly provides presentations to the Audit Committee on our cybersecurity program and cybersecurity risks. These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training. Two additional members of our Board, who have cybersecurity experience but are not members of the Audit Committee, are invited to attend Audit Committee meetings when review of our cybersecurity program is on the agenda. In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.


text: Our Vice President of Trust Engineering is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our Vice President of Trust Engineering has served in various roles in cybersecurity and information technology for over 30 years, including as Vice President and Chief Security Architect of Intertrust Technologies Corporation and Java Security Architect at Sun Microsystems, Inc.


text: In addition, our Executive Incident Management Team ("EIMT") is a cross-functional management committee focused on providing executive guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.


text: Our Trust Engineering team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Trust Engineering regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cybersecurity incidents are escalated to our Vice President of Trust Engineering, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.


text: Notwithstanding our cybersecurity risk management and governance, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption "Significant disruptions of our information technology systems or data security incidents could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability."


text: Our cybersecurity program is designed to assess, identify, and manage cybersecurity risks and threats. Key components of our cybersecurity program include: • managing cybersecurity threats by deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, which we evaluate and seek to improve, including through vulnerability assessments and cybersecurity threat intelligence; • maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems; • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures and manage our bug bounty program; • a cybersecurity risk management process for third-party vendors, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors; and • cybersecurity awareness training is available for all employees and enhanced training is provided for certain employees.


text: As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, primarily through delegation to the Audit Committee. As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns. The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Product and Enterprise Security, who regularly provides presentations to the Audit Committee on our cybersecurity governance and compliance programs. These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training. Two additional members of our Board, who have cybersecurity experience but are not members of the Audit Committee, are invited to attend Audit Committee meetings when review of our cybersecurity program is on the agenda. In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.


text: Our Vice President of Product and Enterprise Security is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our Vice President of Product and Enterprise Security has over 30 years of experience in cybersecurity and information technology roles, including executive leadership positions at public and private companies.


text: In addition, our Executive Incident Management Team ("EIMT") is a cross-functional management committee dedicated to providing executive-level guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.


text: Our Product and Enterprise Security team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Product and Enterprise Security regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cybersecurity incidents are escalated to our Vice President of Product and Enterprise Security, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.


text: Notwithstanding our cybersecurity risk management and governance, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption "Data security incidents, including cybersecurity attacks, or other significant disruptions of our information technology systems could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability."


text: Cybersecurity risk management is a significant part of our overall risk management process. Our cybersecurity risk management program is informed by security frameworks and standards, such as PCI DSS, ISO 27001, and CIS Controls. We have designed and implemented various information security processes that are intended to protect the confidentiality, integrity, security, and availability of our critical systems and information and provide a cross-functional framework for identifying, preventing, and mitigating cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers.

companyName: Olo Inc.


text: Our cybersecurity risk management program includes: • an internal security team, led by our Chief Information Security Officer, or CISO, which is responsible for, among other matters, monitoring our platform through penetration testing and vulnerability scanning, managing our cybersecurity risk assessment processes, and implementing our security controls; • an annual risk assessment performed by our internal security team designed to identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity incident response plan, or IRP, that establishes an organizational framework and guidelines to assist us in identifying, responding to, and recovering from cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with other services, such as performing third-party penetration testing, assisting with incident response, and facilitating adversary simulations; • annual cybersecurity awareness training for our employees and additional training for engineers, technical team members, members of the cybersecurity incident response team, or CSIRT, and our Board of Directors; • a third-party risk management process for service providers and vendors, which includes review by the internal security team at onboarding and, for certain significant vendors, an annual security review; and • an insurance policy to help mitigate, in certain circumstances, potential liabilities resulting from cybersecurity incidents and other cyber issues.


text: To date, risks from cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the audit committee of the Board of Directors. The audit committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The audit committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. The audit committee receives periodic reports from our CISO and General Counsel, or GC, on material cybersecurity risks, developments in cybersecurity, ongoing priorities and work of the governance, risk, and compliance committee, or the GRC Committee, updated risk assessments of our cybersecurity program, and mitigation strategies. The GC is also tasked with reporting on material cybersecurity incidents, if any, to the audit committee.


text: Our cybersecurity risk management processes are implemented, assessed, and managed by certain members of Olo management, including our CISO and GC. Our CISO has 25 years of experience in information technology and risk management at various companies, such as Yum Brands, Inc. and Domino's Pizza, Inc. He is also an ISC2 Certified Information Systems Security Professional. Our GC received a cybersecurity oversight certification from the National Cybersecurity Center. Both act as chairs of our GRC Committee. The GRC Committee provides direction, oversight, and management of our cybersecurity and privacy programs with a focus on business objectives, the protection of customer and employee data, safeguarding our systems, and complying with applicable laws, regulations, and contractual obligations. Cross-functional leaders within Olo, including members from our information technology, data science, finance, legal, and people & culture teams, are part of the committee. Our GRC Committee meets periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.


text: Olo's IRP is also designed to escalate certain cybersecurity incidents to members of management, depending on the circumstances. Our internal security team, among others, works with our CSIRT to help assess, mitigate, and remediate cybersecurity incidents of which they are notified. Our GC, as the CSIRT leader, directs and coordinates CSIRT's activities, in consultation with the CISO and other members of management. In addition, the IRP includes processes for reporting to the audit committee and our Board of Directors certain cybersecurity incidents.


text: To date, risks from cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents. For more information about cybersecurity-related risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the audit committee of the Board of Directors. The audit committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The audit committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. The audit committee receives periodic reports from our CISO and Chief Legal Officer, or CLO, on material cybersecurity risks, developments in cybersecurity, key cybersecurity initiatives, ongoing priorities and work of the governance, risk, and compliance committee, or the GRC Committee, updated risk assessments of our cybersecurity program, and mitigation strategies.


text: Our cybersecurity risk management processes are implemented, assessed, and managed by certain members of Olo management, including our CISO and CLO. Our CISO has 25 years of experience in information technology and risk management at various companies, such as Yum Brands, Inc. and Domino's Pizza, Inc. He is also an ISC2 Certified Information Systems Security Professional. Our CLO has 16 years of experience and received a cybersecurity oversight certification from the National Cybersecurity Center. Both act as chairs of our GRC Committee. The GRC Committee provides direction, oversight, and management of our cybersecurity and privacy programs with a focus on business objectives, the protection of customer and employee data, safeguarding our systems, and complying with applicable laws, regulations, and contractual obligations. Cross-functional leaders within Olo, including members from our information technology, data science, finance, legal, and people & culture teams, are part of the committee. Our GRC Committee meets periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.


text: Olo's IRP is also designed to escalate certain cybersecurity incidents to members of management, depending on the circumstances. Our internal security team, among others, works with our CSIRT to help assess, mitigate, and remediate cybersecurity incidents of which they are notified. Our CLO, as the CSIRT leader, directs and coordinates CSIRT's activities, in consultation with the CISO and other members of management. In addition, the IRP includes processes for reporting to the audit committee and our Board of Directors certain cybersecurity incidents.


text: Kaltura has developed and implemented a cybersecurity risk management program, intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: KALTURA INC

ticker: KLTR


text: We aim to be proactive in our approach to cybersecurity, with our practices informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This approach aids us in identifying and managing cyber risks in a manner that aligns with our business operations. While the NIST CSF serves as a guiding framework to help us identify, assess, and manage cybersecurity risks, this does not imply we adopt a blanket adherence to its standards and requirements in all respects. Our cybersecurity risk management program is further informed by the industry-recognized certifications we have obtained through comprehensive third-party evaluations, including ISO/IEC 27001, ISO 27701, ISO 27799, ISO 22301, SOC 2 Type 2, and SOC 3.


text: Our cybersecurity risk management program is integrated into the broader scope of Kaltura's enterprise risk management framework, including processes for managing risks, from legal and compliance to strategic, operational, and financial threats, through shared methodologies, reporting channels, and governance processes.


text: Key elements of our cybersecurity risk management program encompass: a. Risk Assessments: A risk assessment process to identify and evaluate material cybersecurity threats to our systems, data, products, services, and overall IT environment.


text: a. Security Team Expertise: Our security team, led by our Chief Information Security Officer (CISO), who oversees our cybersecurity risk assessments, the implementation of security controls, and the coordination of our incident response efforts.


text: a. External Collaboration: We engage with external service providers, where appropriate, for assessing and testing our security processes and controls. a. Cybersecurity Awareness Training: Security awareness and training programs for our employees.


text: a. Incident Response Preparedness: Our incident response plan outlines our approach to addressing and responding to cybersecurity incidents and to findings, vulnerabilities and incidents that could lead to or allegedly be suspected as cybersecurity incidents.


text: a. Third-Party Risk Management: A process for evaluating and managing the risks associated with our service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Intellectual Property and Data Privacy and Security" - "A real or perceived bug, defect, security vulnerability, error, or other performance failure involving our platform, products or solutions could cause us to lose revenue, damage our reputation, and expose us to liability." and "If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers' data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities."


text: Cybersecurity risk is a critical aspect of our Board of Directors' risk oversight function. The Board has entrusted the Audit Committee with the oversight of cybersecurity and other IT-related risks. This committee monitors the execution of our cybersecurity risk management program.


text: Regular briefings are provided to the Audit Committee by management, regarding the cybersecurity risk landscape and any significant cybersecurity incidents. These updates are then relayed to the full Board as deemed necessary by the Audit Committee. Our management team also receives regular internal briefings.


text: Board members are regularly educated on cybersecurity issues through presentations from our Chief Information Security Officer (CISO) and internal security team. External experts may also be consulted to provide additional insights or reports when necessary.


text: Our management team, including the CISO, Data Privacy Officer (DPO), CCO (Chief Customer Officer) and Chief Product Officer (CPO), is responsible for the assessment and mitigation of cybersecurity threats and overseeing both our internal security personnel and external cybersecurity consultants. Our management team's cumulative experience includes decades working in cybersecurity and information security, including in the government and public and private companies, and overseeing risk management generally. Among other things, our CISO is a graduate of the Technion's Information Security Program as a Technion Certified CISO and brings vast experience as former Security Specialist in the U.S. Department of State, Senior Lead Information Security Architect at one of the Israeli leading banks, and Head of Cyber Architecture, Engineering & Research Group at one of the leading Israeli Aerospace & Defense companies. The team reporting to our CISO further includes experienced specialists in the area of Cyber Forensics and Counterterrorism and Network Security Engineers holding B.S. Computer Science Degrees and other relevant certifications.


text: We aim to be proactive in our approach to cybersecurity, with our practices informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This approach aids us in identifying and managing cyber risks in a manner that aligns with our business operations. While the NIST CSF serves as a guiding framework to help us identify, assess, and manage cybersecurity risks, this does not imply we adopt a blanket adherence to its standards and requirements in all respects. Our cybersecurity risk management program is further informed by the industry-recognized certifications we have obtained through comprehensive third-party evaluations, including ISO/IEC 27001:2022, ISO 27701, ISO 27799, ISO 22301, SOC 2 Type 2, and SOC 3.


text: b. Security Team Expertise: Our security team, led by our Chief Information Security Officer (CISO), who oversees our cybersecurity risk assessments, the implementation of security controls, and the coordination of our incident response efforts.


text: c. External Collaboration: We engage with external service providers, where appropriate, for assessing and testing our security processes and controls. d. Cybersecurity Awareness Training: Security awareness and training programs for our employees.


text: e. Incident Response Preparedness: Our incident response plan outlines our approach to addressing and responding to cybersecurity incidents and to findings, vulnerabilities and incidents that could lead to or allegedly be suspected as cybersecurity incidents.


text: f. Third-Party Risk Management: A process for evaluating and managing the risks associated with our service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: See "Risk Factors – Risks Related to Information Technology, Intellectual Property and Data Privacy and Security" - "A real or perceived bug, defect, security vulnerability, error, or other performance failure involving our platform, products or solutions could cause us to lose revenue, damage our reputation, and expose us to liability." and "If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers' data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities."


text: Our management team, including the CISO, Data Privacy Officer (DPO), CCO (Chief Customer Officer) and Chief Product Officer (CPO), is responsible for the assessment and mitigation of cybersecurity threats and overseeing both our internal security personnel and external cybersecurity consultants. Our management team's cumulative experience includes decades working in cybersecurity and information security, including in the government and public and private companies, and overseeing risk management generally. Among other things, our CISO is a graduate of the Technion's Information Security Program as a Technion Certified CISO and brings vast experience as former Security Specialist in the U.S. Department of State, Senior Lead Information Security Architect at one of the Israeli leading banks, and Head of Cyber Architecture, Engineering and Research Group at one of the leading Israeli Aerospace and Defense companies. The team reporting to our CISO further includes experienced specialists in the area of Cyber Forensics and Counterterrorism and Network Security Engineers holding B.S. Computer Science Degrees and other relevant certifications.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity, and availability of this highly sensitive information seriously and invest significant time, effort, and resources into protecting such information. Our cybersecurity strategy was designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.

companyName: APPFOLIO INC

ticker: APPF


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, periodically conducting internal penetration tests, and providing our customers with multi-factor authentication options to help them effectively protect their information. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews and, in cases where personal information is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. We engage independent third parties to audit our adherence to our cybersecurity policies and conduct infrastructure and application security assessments and penetration testing. These third parties help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: The Risk and Compliance Oversight Committee of our Board of Directors (the "RCOC") is responsible for overseeing and reviewing AppFolio's cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The RCOC updates the full Board of Directors on cybersecurity matters as appropriate.


text: Our information security team is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2015 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors. The CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. The CISO attends each quarterly meeting of the RCOC to brief members on information security matters and discuss cybersecurity risks generally.


text: In addition, our management team has established an Enterprise Risk Management Program (the "ERM Program"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing AppFolio, including cybersecurity risks. Management is made aware of current and evolving cybersecurity risks through ERM Program reporting. Furthermore, in the event of a material or potentially material cybersecurity event, senior members of management are promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. No security program can entirely eliminate the risk of human error, such as an employee or contractor's failure to follow one or more security protocols. Like many other businesses, we have experienced, and are continually subject to, cyber-attacks. While these past cyber-attacks have not materially affected or, in our belief, are reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors" for additional details regarding cybersecurity risks.


text: Cybersecurity and Risk Management Strategy Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity, and availability of such information seriously and invest significant time, effort, and resources into protecting such information. Our cybersecurity risk management strategy is designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.


text: To implement our cybersecurity risk management strategy, we maintain comprehensive processes and safeguards to secure the data we hold and to assess, identify and manage material risks from cybersecurity threats, including: • encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system; • regularly assessing product features for security vulnerabilities; • periodically conducting internal penetration tests; and • providing our customers with multi-factor authentication options to help them effectively protect their information.


text: We also maintain data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. We have processes in place to assess, identify and manage vendor cybersecurity risks, which include initial and periodic security program reviews and, in cases where personal information is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. Our cybersecurity policies, standards, and processes are informed by a variety of industry standards and best practices, including the NIST Cybersecurity Framework and ISO 27001.


text: We engage independent third parties to audit our adherence to our cybersecurity policies and conduct infrastructure and application security assessments and penetration testing. These third parties help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: Our information security team is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2015 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors. The CISO oversees a team of information security professionals who are devoted full time to assessing, identifying and managing cybersecurity threats on a day-to-day basis. The CISO attends each quarterly meeting of the RCOC to brief members on information security matters and discuss cybersecurity risks generally.


text: In addition, our management team has established an Enterprise Risk Management Program (the "ERM Program"), which includes processes designed to assess, identify, manage, categorize, and monitor key current and evolving risks facing AppFolio, including cybersecurity risks. Management is made aware of current and evolving cybersecurity risks through ERM Program reporting and periodic updates at weekly executive leadership team meetings. In the event of a material or potentially material cybersecurity incident, senior members of management are promptly informed of such incident and oversee response and disclosure efforts pursuant to the terms of a documented incident response plan.


text: Notwithstanding the foregoing efforts, there can be no assurance that our cybersecurity risk management program will entirely eliminate all risks from cybersecurity threats or incidents. Like many other businesses, we have experienced, and expect to continually be subject to, cyber-attacks. While these past cyber-attacks have not materially affected and, in our belief, are not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors " for additional details regarding cybersecurity risks.


text: We maintain a comprehensive cybersecurity program that includes policies and procedures designed to protect our systems, operations and data from unauthorized access, theft and destruction. We utilize a variety of protective measures as part of our cybersecurity program, including: • reviews of our network access rights and controls; • penetration testing; • patch management; • annual security awareness trainings and assessments for all employees and contingent workers; • security information and event management software to identify anomalies; • periodic security review meetings designed to identify vulnerabilities and review remediation efforts; • a vendor risk management program; and • cybersecurity tabletop exercises.

companyName: Hamilton Lane INC

ticker: HLNE


text: We also maintain a comprehensive Security Response Policy designed to inform proper escalation of non-routine cybersecurity events and to coordinate our actions across departments. The policy sets forth, among other things, the following actions in the event of a suspected security breach: incident verification by our cybersecurity team, notification of our ERM committee, notification of an incident response and disclosure team composed of members of our operations, legal, finance and compliance teams, mitigation and remediation actions, and steps to restore business continuity. Our Chief Technology Officer ("CTO") serves as security coordinator and leads our cybersecurity and information technology team. As of March 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect our Company, including our business strategy, cash flows, financial condition or results of operations.


text: We engage diligenced third parties as part of our cybersecurity program. On a periodic basis, we engage third-party auditors to assess our cybersecurity controls and procedures. We also engage reputable third-party security firms to conduct annual penetration tests of our physical and digital security. We then work to remediate critical vulnerabilities identified through these assessments.


text: Our cybersecurity processes are integrated into our Company's overall risk management processes. Our CTO is a member of our ERM committee and any cybersecurity issues are immediately raised to the committee. In addition, our CTO reports to the audit committee of our board of directors bi-annually, regarding our cybersecurity program and material risks, and once annually to our full board of directors, regarding overall cybersecurity strategy.


text: We have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers. Our approach is tailored based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. For critical vendors who will have access to our systems or data, we diligence their cybersecurity practices prior to engagement, including requiring responses to standardized information gathering questionnaires. We may conduct additional reviews of certain vendors depending on criticality or risk. In addition, where we consider it to be appropriate, we seek to include in our contractual arrangements with certain of our third party vendors provisions addressing best practices with respect to data and cybersecurity, including the right to audit and test their compliance with these contractual requirements.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Risk Factors—Failure to maintain the security of our information technology networks, or those of our third-party service providers, or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow" in Part I, Item 1A of this Form 10-K.


text: Our board of directors has delegated oversight of the Company's cybersecurity risks to the audit committee. The audit committee reviews the Company's information technology and data protection strategies, oversees and assesses risk with respect to cyberattacks and data privacy matters and receives bi-annual updates from our CTO. The audit committee then provides updates and recommendations to the full board on cybersecurity matters.