text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It aims to provide a common foundation for all employees and officers as well as directors to help understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including a management committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.


text: The Risk Committee of the Board of Directors, including a subcommittee of the Risk Committee, provides oversight of cybersecurity risks and receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Company's Information Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and Information Security Program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Information Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards and regulatory requirements, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Information Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full-time support and additional operational measures to monitor and respond to data breaches and cyber attacks.

companyName: M&T BANK CORP

ticker: MTB

secItem: Item 1C


text: In accordance with the Gramm-Leach-Bliley Act, the Company undertakes periodic assessments to identify and assess risks to customer information and evaluate the effectiveness of security controls. The Company engages third parties in connection with such cybersecurity preparedness efforts. Ongoing audits, including vulnerability and penetration testing of the Company's computing infrastructure, are performed by independent third parties and by our internal cybersecurity personnel.


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Information Security Program. The Company has an established third-party due diligence program designed to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.


text: The Company's Cybersecurity Leadership Team includes the CISO who is responsible for overseeing and reporting on the development and implementation of the Company's Information Security Program. The CISO has over twenty years of experience in information security for large financial institutions and has served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. The CISO currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who is an Executive Officer of M&T and has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. Mr. Wisler holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.


text: The Company's Information Security Awareness Program, a component of the Information Security Program, is designed to ensure that all employees and contingent workers are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees and contingent workers, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.


text: Cyberattacks represent a threat to water, wastewater and electric utility systems. There have also been increasing threats to the information that companies maintain that have resulted in unauthorized disclosure of private customer, employee, director and corporate financial information.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage. Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.


text: As cyberattacks have become more frequent and sophisticated, including against third-party technology providers, Registrant expects to continue to increase its investment in information and operational technology to monitor and address cyber threats and attempted cyberattacks, and to improve its posture in addressing security vulnerabilities. Registrant has implemented robust cybersecurity systems and controls to prevent any unauthorized access to information. Its platform was designed to be consistent with industry best practices such as the U.S. National Institute of Standards and Technology ("NIST")


text: cybersecurity frameworks. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.


text: Registrant has adopted a cybersecurity incident response policy, plan and set of specific instructions, which are annually reviewed by the IT cybersecurity team members. Registrant is also taking actions intended to strengthen its cybersecurity posture and to improve its cybersecurity incident response plans and operating procedures. Despite the actions Registrant has taken and is taking and the fact that, to its knowledge, it has yet to experience a cybersecurity incident, there can be no assurance that Registrant will not experience a cybersecurity incident.


text: Risk management, oversight and response Cyber risk management is an ongoing iterative process that requires continuous identification, assessment and management of possible cyber threats and has become a vital part of Registrant's overall risk management efforts. Registrant's cybersecurity team assesses ongoing cybersecurity threats and vulnerabilities to prioritize and implement mitigation factors and defense to help contain and combat identified risks.


text: To keep threat and vulnerability information up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide rapid alerting for emerging threats and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the NIST cybersecurity frameworks. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors (the "Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams to participate in Registrant's Cybersecurity Incident Response Team ("CIRT") and to be kept current on all aspects related to a cyberattack, if a cybersecurity incident were to occur.


text: Responses to cyberattacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyberattack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyberattack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law and regulation.


text: To ensure that members of Registrant's Board are informed of material cyberattacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyberattack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyberattack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyberattack could be significant depending on the severity of the cyberattack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.


text: The Company has implemented controls based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and the Sarbanes-Oxley Act of 2002. Our Information Technology organization is led by the Chief Information Officer ("CIO") who is responsible for cybersecurity risk management. The Audit Committee of the Board of Directors is tasked with oversight of our overall enterprise risk management program, including cybersecurity, and receives recurring cybersecurity updates throughout the year with at least two cybersecurity reports to the full Board of Directors annually. Directors with experience in cybersecurity and technology play crucial oversight roles for our digital and cybersecurity strategies.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Our cybersecurity program is overseen by the Company's Chief Information Security Officer ("CISO") and is designed to protect and preserve the confidentiality, integrity and availability of our information technology assets. Risks and controls are monitored by the CISO and CIO and their evaluation of our overall program drives the nature and scope of our cybersecurity investments. Our CISO reports directly to the CIO and has 20 years of IT experience including leadership roles at various companies with enterprise responsibility for IT audit, IT infrastructure, and cybersecurity. The CISO reports to the Audit Committee on the effectiveness of the Company's cybersecurity program controls aligned to the NIST CSF framework. We periodically engage external subject matter experts who provide independent qualitative and quantitative assessments of the cybersecurity program maturity and response readiness. We also use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. In addition, the Company leverages a monthly cybersecurity awareness training program for all employees that is further reinforced through frequent phishing simulations.


text: Quarterly updates are provided by the CISO to the Cybersecurity Governance Committee comprised of cross functional senior management regarding the effectiveness of cybersecurity program and its ability to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Cybersecurity Governance Committee is responsible for monitoring and coordinating enterprise cybersecurity policy and strategy, and for providing guidance to key management and oversight bodies. Our cybersecurity program includes a risk-based incident response plan that provides a documented framework for handling incidents including coordination across multiple parts of the Company.


text: As of the date of this report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.


text: We maintain a comprehensive cybersecurity program, including policies and procedures designed to protect our systems, operations, and data. We perform risk assessments on a quarterly basis to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our Information Technology ("IT") team engages in threat modeling, vulnerability scanning and penetration testing. For each identified risk, our IT team will estimate the likelihood of occurrence and potential impact, which will guide the Company in assessing and prioritizing risks. We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. Once a new vendor is onboarded, we monitor their cybersecurity posture utilizing a third-party cybersecurity ratings provider. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties semi-annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), as guidelines. As a mortgage company, we are also associated with the Federal Financial Institutions Examination Council.

companyName: Taylor Morrison Home Corp

ticker: TMHC


text: For material cybersecurity risks, we've developed mitigation plans to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation plans have involved, among other things, implementing additional technology controls or policies, increased training for company personnel or obtaining additional insurance for the identified risk. Our IT team monitors material risks over time and updates the Company's mitigation plans as appropriate. IT also regularly reports to the leadership team on the status of material risks, mitigation plans and incidents related to such risks.


text: We also maintain a data breach response plan, which is intended to be aligned with the NIST framework, and which is reviewed annually and conveyed to our team members through our mandatory cybersecurity training. We also retain experienced cybersecurity consultants that can assist us in the event of a serious breach, and maintain a cyber insurance policy.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Item 1A. Risk Factors – Risk Related to our industry, business and economic conditions– Information technology failures and data security breaches could harm our business" in this Annual Report.


text: Management is responsible for ongoing assessment and oversight of cybersecurity risks that could significantly impact our operations, finances or reputation. This includes identifying information assets and data systems that are critical to business functions, determining the vulnerability of those systems to potential cyberattacks, and developing comprehensive protections and response plans.


text: To fulfill these responsibilities, management relies on IT and cybersecurity leadership who possess specialized expertise in relevant areas. Our cybersecurity team is led by our Chief Information Officer ("CIO"), who has more than 25 years of experience working in information technology, of which more than 20 have been with Taylor Morrison. With over ten years of experience developing cybersecurity programs, the CIO leads security control implementation, risk and compliance monitoring, security tool management, and incident response planning. Reporting to the CIO, the Director of Information Security possesses expert knowledge in threat modeling and vulnerability testing methodologies. The Director of Information Security leads efforts to build security into all IT processes and procedures to protect against risks related to data leakage, broken authentication, injection flaws, improper encryption, and attacks on other application vulnerabilities.


text: Supporting the CIO and Director of Information Security is a team of IT security professionals who collectively hold the following degrees and certifications: Master's degree in cybersecurity; Certified Information Systems Security Professional; Certified Ethical Hacker; Security +; Microsoft Certified Professional; Microsoft Certified Solutions Associate; and Microsoft Certified Systems Engineer.


text: Supported by these skilled leaders, management conducts quarterly cyber risk reviews, maintains a cybersecurity risk register, authorizes risk mitigation budgets and activities, and ensures appropriate resources are devoted to protecting against rapidly evolving cyber threats. The Audit Committee and the Board of Directors are also regularly updated on cybersecurity risk assessments, policy changes, significant incidents, and preparedness levels. This enables management TAYLOR MORRISON HOME CORPORATION 10-K


text: We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework ("CSF") and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: We believe that one of the first lines of defense against cybersecurity threats is our employees. Accordingly, we require all new employees to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. We also require our employees to annually re-affirm adherence to company-wide IT and related policies designed to protect our information and communications systems. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.


text: We also maintain policies, procedures and governance structures designed to help us identify, assess and respond to cybersecurity risks. We have a written cybersecurity framework that closely aligns with the NIST's CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer & Head of IT Infrastructure ("CISO"), the Chief Credit & Risk Officer, the Chief Legal Officer, the Head of Operations, the Chief Compliance Officer of the RIA, the Head of Data Science, and the Associate General Counsel. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plan against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company's assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST's CSF and the SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.


text: We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements. We collaborate with service providers to help assess the sufficiency of their cybersecurity measures and require service providers to notify us promptly of cyber incidents that may affect our systems or data.


text: Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities and promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.


text: In December 2024, we completed the Palisades Acquisition and have aligned all new employees acquired through such acquisition with our cybersecurity training and governance framework, including the Incident Response Team, which now includes legacy Palisades employees. We are conducting comprehensive risk assessments to identify additional steps that may be necessary to fully align the legacy Palisades information systems and cyber security practices with our systems and practices.


text: To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled "We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition" in Item 1A. "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company's cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company's overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2024 Form 10-K for additional information on our enterprise risk management.


text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team also elevate any potential cybersecurity issues, whether internal or at a third party with whom we do business, to the CISO.


text: The Incident Response Team and the non-management employees who support the Incident Response Team identify, assess, respond to and coordinate both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation and regulatory and other government authorities as applicable and as required by law.


text: We have established and maintain policies and processes for assessing, identifying, monitoring, and managing material risks arising from cybersecurity threats which form an important component of our overall risk management program. Our policies and processes underlie and support the integrity and availability of critical data and systems, and are designed to provide a framework for timely, effective responses to cybersecurity threats, such as threats associated with our services and with our use of services or technology products by our strategic vendors, contractors, or other suppliers. ACV also engages independent third parties to help us assess our internal preparedness, audit our adherence to cybersecurity standards, assist us with risk mitigation activities, such as security assessments and penetration testing, and identify areas for continued focus and improvement.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Our efforts are led by ACV's Chief Information Officer ("CIO") with the oversight of our Audit Committee, Chief Legal Officer and Chief Financial Officer, who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.


text: The Cybersecurity Department works with our strategic vendors, contractors, or other suppliers that provide services or technology products to complete information security risk assessments, each consisting of a holistic review using NIST as a standard. For these suppliers, operational security details, including third-party reports on compliance frameworks (such as NIST, SOC2 Type2), are reviewed by the Cybersecurity Department for sufficiency. The Cybersecurity Department uses tools to assist in monitoring cyber activities, benign and otherwise, and creates alerts based on anomalous activities or potential vulnerabilities. ACV personnel also are required to take cybersecurity training, which is designed to prepare our personnel to look out for and report any suspicious or anomalous events they may experience.


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee assists our board of directors in monitoring cybersecurity risks by receiving regular reports from our CIO, as needed, that cover information such as NIST review outcomes, and actions to address findings and vulnerabilities.


text: Our CIO has primary management responsibility for ACV's cybersecurity. He has over twenty- five years of experience working in information technology, with the last fifteen years in senior leadership and delivery roles in large, geographically spread corporate technology settings. Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), which governs ACV's responses to cybersecurity events and is designed to align with industry practices, when a cybersecurity event has been identified, it is assessed by our Cybersecurity Department based on a threat detection and response analysis to determine whether the event is a cybersecurity incident. Events that do not meet the standard of incident are resolved and closed out by the Cybersecurity Department in our cybersecurity event management system.


text: If an event is identified as an incident, the CIRP provides for notification to designated members of the Cybersecurity Department and the legal compliance function who will analyze the incident for potential materiality. Any incident whose impacts are judged to be potentially material is escalated immediately to a senior management team comprised of at least our CIO, Chief Legal Officer, Chief Operations Officer, and Chief Financial Officer. Additionally, certain cybersecurity events, such as a ransomware attack, will be immediately escalated to the designated members set forth above and the CIO. If the threat is found to be credible, it is further escalated on an emergency basis to the Chief Legal Officer and Chief Financial Officer. Once a cybersecurity incident is escalated to senior management, other members of management and senior management may be engaged to oversee the assessment, response, recovery, and disclosure efforts relating to such cybersecurity event.


text: Despite our efforts, we can offer no guarantees that the cybersecurity measures we use will prevent unauthorized or malicious access to ACV systems and information. For more information regarding the risks relating to cybersecurity, see "Risk Factors—Risks Related to Information Technology and Intellectual Property—Security breaches, cyber-attacks or other similar incidents with respect to our information technology systems, or those of our third- party service providers, could result in adverse consequences, including, but not limited to, a disruption of our business operations; reputational harm; loss of revenue or profits; regulatory investigations or actions; litigation; fines and penalties. If we fail to comply with our commitments, assurances or other obligations regarding data privacy and security, our reputation may be harmed and we may be exposed to liability; loss of business; and other adverse business consequences."


text: We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program is based on the U.S. National Institute for Standards and Technology standards and other applicable country-specific and industry frameworks.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our management, with input from our Board of Directors, performs an annual enterprise-wide risk management ("ERM") assessment to identify and manage key existing and emerging risks for our company. Our ERM process assesses the characteristics and circumstances of the evolving business environment at the time and seeks to identify the potential impact, likelihood and velocity of a particular risk. Our senior executive management team has the overall responsibility for, and oversight of, our ERM process, and senior executives are assigned to monitor and manage top identified risks. Cybersecurity is among the top risks identified for oversight as a result of our last annual ERM assessment.


text: Systems and process monitoring are essential components of our cybersecurity risk management and information security programs. Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a framework for materiality determination and a reporting-up process to assist in a disclosure of a material event, if required. In addition, management has defined key roles and responsibilities within our organization to handle material cybersecurity incidents. A comprehensive incident response plan is utilized for any threat activities identified, including timely containment, analysis, remediation, and communication, and is also applicable to third parties with access to our information systems or assets. We have implemented security programs, such as mandatory cybersecurity awareness training for all our employees, simulated phishing emails and tabletop exercises, that are strategically designed and continuously updated to address evolving cybersecurity threats and latest industry trends. These programs, which are held multiple times a year, allow our employees to both identify and address material cybersecurity incidents, utilizing our comprehensive incident response plan.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and monitoring our cybersecurity programs and assets. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity risk management, strategies and processes remain at the forefront of industry best practices.


text: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including security assessments of all third-party providers before engagement. In addition, cybersecurity program maturity of such third parties, including incident response and disclosure, is also evaluated.


text: To date, our business strategy, results of operations or financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. For more information on our cybersecurity related risks, see "Item 1A—Risk Factors—Risks Relating to Our Business" in this Annual Report on Form 10-K.


text: Our Board of Directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit and Risk Committee assists the Board of Directors in its responsibilities of overseeing cybersecurity risk. Our Chief Operating Officer ("COO") and Chief Information Security Officer ("CISO") play a pivotal role in informing the Audit and Risk Committee on cybersecurity risks. They report to the Audit and Risk Committee on a quarterly basis on a broad range of topics, including assessments and scoring of our information security program; incident management, the incident response plan and the status of security tools; the current cybersecurity landscape and emerging threats; and the status of ongoing cybersecurity awareness and training and projects to strengthen our information security systems. Additionally, our Executive Director, Internal Audit presents a quarterly report on our enterprise risk management activities, including cybersecurity risks, to the Audit and Risk Committee. The chair of the Audit and Risk Committee, in turn, periodically reports on its review with the Board of Directors, and our COO and CISO report annually to the Board of Directors regarding our cybersecurity program and risk management.


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy, managing our cybersecurity threat detection and response plan, and assessing and managing material risks from cybersecurity threats. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.


text: Risk Management & Strategy Shentel's Risk Management Program defines the framework for risk identification and assessment, including cybersecurity risks. Our overall Risk Management Program integrates processes for assessing, identifying and managing material risks from cybersecurity threats. Cybersecurity risks are identified through various means including, but not limited to, regularly conducted security assessments, external and internal penetration testing, data privacy assessments, external security evaluations, the testing and implementation, as applicable, of new technologies, and continuing education and awareness of existing and new threat vectors, industry trends, changes in the environment and changes in the overall technology landscape. Pursuant to our Information Security Program, once a cybersecurity risk is identified, the Information Security team, in collaboration with other areas of the organization, will assess the risk and implement an appropriate response. Security risk assessments comprise the reasonably foreseeable impacts to the Company and its stakeholders due to the threats and known vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: To mitigate or address risks, Shentel leverages acceptable and well-known security tools and services allowing Shentel to maintain a robust security posture. Our Information Security Program addresses risks through a wide spectrum of measures, including enhanced monitoring, endpoint protection, multifactor authentication, privileged account security, web and email filtering and comprehensive internal employee training. Our security protocols are rooted in industry standards and guidelines issued by respected bodies such as the National Institute of Standards and Technology, the Department of Homeland Cybersecurity and Infrastructure Security Agency, and the Center for Internet Security. In addition, we regularly consult with external advisors regarding opportunities to enhance and strengthen our policies and practices.


text: With respect to third-party service providers, our Information Security Program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of actual or reasonably suspected information security incidents occurring on their systems that may affect our systems or data, including personal information.


text: Should a security breach or incident occur, the Chief Information Officer (the "CIO") in collaboration with the Company's General Counsel, Chief Accounting Officer (the "CAO") and Chief Operating Officer (the "COO") will evaluate the materiality of any specific incident. The Company's Chief Executive Officer (the "CEO") and Chief Financial Officer (the "CFO") will ultimately decide if an incident is material. Considerations of materiality will include a variety of factors, including, for example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.


text: The Information Security Program is intended to provide effective governance and oversight for assessing cybersecurity risks, recognizing that no program, no matter how well designed and implemented, can prevent all potential cybersecurity risks and that the benefits of any potential controls or mitigations should be considered in relation to their costs. While we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and threats have not materially affected our business strategy, results of operations or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. If applicable, these committees periodically report to the Board of Directors on their risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program and our Board of Directors is involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis. The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management process and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks, including cybersecurity.


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 19 years of experience in the information technology and information security fields and the CIO has over 29 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.


text: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee periodically on cybersecurity and other information technology risks and opportunities. Additionally, the Audit Committee, with guidance from the CIO, General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually. In the case of an information security incident or breach, the Director of Information Security and CIO will follow the Company's Incident Response Plan and follow communication protocols within the plan, which, depending on the severity of the incident, include escalation timelines and responsibilities that involve updating the Audit Committee and the Board of Directors, as applicable.


text: We have developed and implemented a cybersecurity program intended to manage risk, and protect the confidentiality, integrity, and availability of our critical systems and information. We design, assess and benchmark our program based on the National Institute of Standards and Technology Cybersecurity Framework.

companyName: ARDELYX, INC.

ticker: ARDX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, in areas such as legal, compliance, strategic, operational and financial risk.


text: Key elements of our cybersecurity program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors that have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factors— We and our collaborators, CROs and other contractors and consultants depend on information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Compliance Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program, maintains a strategic role in coordinating cyber risk initiatives and policies, and confirming their efficacy.


text: The Committee receives annual reports from management on our cybersecurity posture. In addition, management updates the Committee where it deems appropriate regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives periodic briefings from management on our cybersecurity program. The board members receive presentations on cybersecurity topics from our Chief Information Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our Chief Information Officer has over 20 years of experience in overseeing cybersecurity and risk management. In addition, our Chief Legal and Administrative Officer has over 25 years of risk management experience and our Chief Financial and Operations Officer has over 20 years of experience in overseeing risk management and cybersecurity. This team is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes experience running cybersecurity programs at similarly situated commercial biotechnology organizations and navigating the associated risk landscape.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.


text: We manage risks from cybersecurity threats through our overall enterprise risk management process. Management has created an information security program, which encompasses a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. We "proactively" assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include internal audits, external audits, penetration tests, and engagement of third parties to conduct analyses of our information security program. Through our centralized enterprise risk management function, we also maintain processes for overseeing and identifying risks associated with third party service providers with whom we do business, including risks related to cybersecurity.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: While to date we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "Our business and operations could suffer in the event of cybersecurity breaches and we may incur significant legal and financial exposure." for further discussion of potential risks related to cybersecurity incidents.


text: Our Senior Vice President of Technology and Innovation and Vice President of Network Infrastructure and Cyber Strategy oversee our cybersecurity program. They hold degrees in industrial engineering and computer science and information systems and decision science, respectively. The team responsible with administering our cyber security program has a combined 37 years of experience in cybersecurity, information security and information technology risk management, governance, risk, and compliance. Our board of directors and our audit committee are regularly updated on cyber security as part of their oversight of relevant cybersecurity risks. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents.


text: Our enterprise risk management includes a comprehensive cybersecurity risk management program with policies, standards, processes and practices based on recognized industry standards and frameworks such as the National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls.

companyName: Crane NXT, Co.

ticker: CXT


text: Our cybersecurity program includes regular training for personnel, an incident response protocol tested at least annually as part of our enterprise-wide crisis response program, cybersecurity insurance, and regular assessments through activities such as penetration testing, and compliance audits performed on our information technology networks and systems by both our internal cybersecurity teams and external service providers.


text: Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over external partners with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such external partners remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such external partners. When we do become aware that an external partner has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such external partner's connection to our information technology networks and systems where appropriate. For more information on cybersecurity risks and how they affect our business, operating results and financial condition, refer to Item 1A, Risk Factors. As of the date of the filing of this Current Report on Form 10-K, we have not identified any risks from a cybersecurity threat or incident that we believe has materially affected or is reasonably likely to materially affect the Company.


text: Oversight and Leadership Our Board of Directors has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for enterprise risk identification, assessment and management, and cybersecurity represents an important component of our overall approach to enterprise risk management.


text: The Audit Committee receives regular reports at least twice annually from our Chief Information Security Officers ("CISO") on a wide range of cybersecurity topics, including our cybersecurity program's performance, results of assessments, emerging threats, capability enhancements, and recent developments and trends.


text: Our CISO, who reports to our Chief Financial Officer ("CFO"), leads our cybersecurity program and has more than 20 years of cybersecurity experience. The cybersecurity teams reporting to our CISO are staffed by highly skilled cybersecurity professionals, including both internal staff and external partners, with broad knowledge of cybersecurity issues from experience and through training and certifications. Our cybersecurity teams are responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. Our CISO, in coordination with our cybersecurity teams, and members of our senior leadership team such as our Chief Executive Officer ("CEO"), CFO and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and respond to any cybersecurity incidents in accordance with our incident response and recovery plans in real time.


text: We have established internal reporting processes designed to ensure that our Board of Directors and the Audit Committee receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including external advisors to the extent appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response standard.

companyName: SLM Corp

ticker: SLM


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response standard and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition. See Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Operational and Compliance Risk Committee of the Board. The Operational and Compliance Risk Committee of our Board of Directors oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security Officer ("CSO") reports to our Chief Operational Officer and President of the Bank and leads the Company's overall cybersecurity function. Our CSO provides periodic updates on our cybersecurity risk management program to the management-level Operational and Compliance Risk Committee ("OCRC") and Executive Committee ("EC"). The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CSO is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for leading our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CSO has significant executive experience in managing and leading IT and cybersecurity teams in both government and the private sector and has received industry recognition in the cybersecurity area. Our CSO holds cybersecurity certifications from leading cybersecurity training and research institutes, is a Fellow at the National Security Institute, and is a member of the Board of Directors of the Financial Services Information Sharing and Analysis Center.


text: The proper confidentiality, integrity, and availability of the Company's information systems are critical to the business. Securing the Company's business information, customer, patient and employee data, and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements, and maintaining the trust of its stakeholders. As part of its enterprise risk management program, the Company has processes in place to assess, identify, and manage material business, operational and legal risks from cybersecurity threats. Such risks include business disruption, fraud, extortion, reputational harm, violations of laws and regulations, litigation, and harm to employees, patients, customers and business partners.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. We also assess and identify potential cyber and information security risks relating to third-party technology providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We may also collaborate with third-party suppliers to develop and align incident response plans. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.


text: The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.


text: The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Human Resources, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.


text: Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. The Company has not experienced a cybersecurity breach or information security breach during the past four fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted.


text: All companies that maintain sensitive or confidential data or utilize technology are subject to the threat of unauthorized persons gaining unapproved access to systems or components of systems. In order to mitigate this threat to our business, we take a comprehensive approach to cybersecurity risk management. We have devoted significant resources to implement and maintain cybersecurity measures to meet regulatory requirements and the expectations of our clients, trading partners, and other stakeholders. We intend to continue to evolve our cybersecurity defenses and strategy and to make significant investments to maintain the security of our data and cybersecurity infrastructure.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We face a number of cybersecurity risks in connection with our business. As of the date of this report, we are not aware of any cybersecurity incidents that materially impacted the Company in the last three years. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition to date, we have, from time to time, experienced threats to and unauthorized persons gaining unapproved access to, including breaches of, our data and systems, including insider threats and phishing attacks. For more information about the cybersecurity risks we face, see " Risk Factors – We rely on the efficient, uninterrupted, and secure operation of complex information technology systems and networks to operate our business. Any significant system or network disruption due to a breach in the security of our information technology systems could have a negative impact on our reputation, regulatory compliance status, operations, sales, and operating results " included elsewhere in this Annual Report


text: Risk Management and Strategy Ryan Specialty's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management program, which is overseen by the Audit Committee of the Board (the "Audit Committee"). The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically. We have established comprehensive cybersecurity policies, standards, processes, practices, and controls to mitigate the risk of cyber threats, and we continually invest in prevention and detection technology and employee training to enhance our cybersecurity posture. Our cybersecurity risk management program leverages and strives to align with the U.S. National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, legal, compliance, IT, and business leaders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability of Company, employee, and third-party information provided to us; identifying, preventing, and mitigating cybersecurity threats; and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding legal and regulatory compliance, public disclosure, and reporting of such incidents can be made by management and presented to the Audit Committee and the Board, as necessary, in a timely manner.


text: Risk Assessment and Technical Safeguards Our Information Security Steering Committee (the "Security Committee"), which is led by our Company's Chief Information Security Officer ("CISO"), meets quarterly to prioritize and align actions with business priorities, manage issues, and respond to changes in regulatory requirements. At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants) and includes a tabletop exercise and external and internal penetration testing.


text: The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our preventive and detective security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to members of management, the Audit Committee, which is comprised solely of independent directors, and the Board, when necessary. Throughout the year we do vulnerability testing. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on industry best practices, vulnerability assessments, cybersecurity threat intelligence, input from consultants, and incident response experience.


text: Monitoring and Incident Response Plan Information Security risks are monitored by our security operations center team along with managed services providing 24x7x365 monitoring and response. Ryan Specialty retains third-party resources with a leading cybersecurity company for incident response when needed, including remediation. We apply lessons learned from our defense and monitoring efforts to help manage and prevent future incidents. We have established a comprehensive incident response plan that is regularly tested and evaluated to confirm its effectiveness. In the event our CISO determines a cybersecurity incident needs to be escalated, she engages our critical escalation team who, with the assistance of third-party consultants, will make the determination as to whether the incident is material and whether escalation to senior management, the Audit Committee, and/or the Board is required.


text: Third-Party Risk Assessments We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections and require those vendors and providers, that meet certain risk profiles, to meet appropriate security requirements, controls, and responsibilities.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of properly handling and protecting Company, employee, and third-party data, including through annual privacy and security training to enhance employee awareness of how to recognize, detect, and respond to cybersecurity threats. In addition to the annual training requirements, we regularly send employees mock phishing emails to test their ability to assess incoming email threats.


text: For companies that we acquire, our integration efforts include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.


text: The Audit Committee oversees our overall enterprise risk assessment and risk management policies including risks related to cybersecurity. The Board and Audit Committee set the tone at the top by providing oversight and establishing expectations for the overall effectiveness and efficiency of the information security program. Each quarter, our CISO provides a quarterly update to the Audit Committee about our cybersecurity program, including detection, mitigation, and remediation of significant incidents, if any, that occurred during the quarter. Additionally, on an annual basis, the CISO delivers reports to the Board and Audit Committee with an annual cybersecurity risk assessment that includes information concerning the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any, including material security risks and information security vulnerabilities. The Audit Committee provides a quarterly summary of all important issues to the full Board.


text: In addition, if warranted based on our response plan, cyber security incidents will be escalated to the attention of the Audit Committee while such incidents are ongoing.


text: Primary responsibility for assessing and managing our cybersecurity risks rests with our CISO, who reports to our Executive Vice President, Operations, Technology & Data Analytics ("EVP OP"). Both are members of our Security Committee, which is a governing body that drives alignment on security decisions across the Company. The Security Committee includes management across the departments and functions of the organization to enable transparency and alignment with the business' strategic goals and objectives. The Security Committee responsible for managing and implementing the Company's cybersecurity programs has many years of valuable business experience managing risks and developing and implementing cybersecurity policies and procedures. Our CISO has extensive experience in information security, managing cybersecurity programs and cybersecurity risks, and has served in various roles in information technology and information security for almost 30 years, including serving as the CISO at another large public company.


text: She holds an undergraduate degree in Information and Decision Sciences. Our EVP OP has extensive enterprise risk management experience, developed over more than 25 years while holding senior leadership positions, including group CIO and divisional COO roles, at global brokerage and risk management firms, and serving clients as a management consultant. He holds an undergraduate degree in accounting.


text: We maintain policies, procedures and controls designed to safeguard against cybersecurity incidents by protecting the confidentiality, integrity, availability and reliability of our systems, networks and information. These policies, procedures and controls are subject to monitoring, auditing, and evaluation practices, pursuant to our Enterprise Risk Management program, which is supported by a three-line defense strategy that includes, the business lines, the Enterprise Risk Management Committee, the Risk Management and Information Security Department, the Compliance Department and the Internal Audit Department. Further, we have developed and conduct at least annually cybersecurity and data privacy training programs for our employees and our third-party consultants who have access to our systems. At least annually, we also conduct simulations, tabletop exercises, independent third-party cybersecurity penetration assessments, and response readiness tests. In addition, the information technology systems of our self-regulatory organizations are subject to periodic reviews, audits, and inspections by regulatory authorities. We also conduct diligence on cybersecurity practices in connection with our overall risk assessment when evaluating expansion into new regions, strategic opportunities, and new products.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: We engage assessors, consultants, auditors and other third parties in connection with developing and evaluating our overall risk management framework. Additionally, our internal audit team periodically engages third parties to co-source internal audits of our information security processes. We strive to utilize best practices in our information security management and follow applicable industry standards.


text: In support of our risk management framework, we maintain a vendor management policy and program to manage third-party risk. Embedded in our vendor management policy is a defined process to assess the risks related to new vendors. Vendors deemed to be high risk are re-assessed annually. These assessments include security questionnaires and reviews of Service Organization Controls (SOC) Reports, where applicable. Cboe uses a third-party service to help monitor the security posture of our vendors that process and/or store confidential Cboe information.


text: We have committees, response and management teams, and dedicated positions for managing and assessing cybersecurity risk, including a Chief Information Security Officer, a Chief Risk Officer, an Enterprise Risk Management Committee, Computer Security Incident Response Team, Cyber Crisis Management Team, and a dedicated internal information security team. Our Chief Information Security Officer and Chief Risk Officer have extensive experience in the industry. Our Chief Information Security Officer has over a dozen years of experience leading information security programs including, experience in cybersecurity consulting, leading strategy and the implementation of cyber defenses for several of the top online retailers in the United States, as well as serving as Chief Information Security Officer for Cboe Digital Exchange and Cboe Clear U.S. Our Chief Information Security Officer is currently responsible for developing and executing the Company's global security strategy and roadmap along with its long-range plan to meet industry and regional regulatory compliance requirements. We have an information security department with associates who are located around the globe. Our Chief Risk Officer's tenure with Cboe spans 24 years, during which time he has held senior positions in information security and risk management. He is currently responsible for oversight of the Company's risk function including the enterprise risk management, information security, privacy, vendor management, and IT asset management programs.


text: Our incident response team is responsible for identifying potential cybersecurity incidents and communicating information regarding the nature and severity of the incident to senior management and others as required by the Company's written Incident Response Plan. Cybersecurity incidents are tracked pursuant to our incident monitoring processes defined within the Incident Response Plan. Potential cybersecurity incidents may also be reported to our Disclosure Committee to determine if further action and/or public disclosure is required. We have also put in place a vulnerability management program through which our systems are routinely scanned to help identify vulnerabilities and track remediation activities.


text: The Board recognizes that our business depends on the confidentiality, integrity, availability, performance, security, and reliability of our data and technology systems and devotes time and attention to the oversight of cybersecurity and information security risk. In particular, the Board's Risk Committee receives recurring updates and reports on information security-related topics from senior management, including from the Company's Chief Compliance Officer, Chief Risk Officer, and Chief Information Security Officer. More specifically, the Risk Committee receives recurring presentations from senior management on cybersecurity, including architecture and resiliency, incident management, business continuity and disaster recovery, significant information technology changes, data privacy, insider threats, physical security, information related to third-party cyber assessments and risks associated with the use of third party service providers. The Risk Committee also reviews and approves any changes to the related information security and privacy program charter. Further, summaries of the proceedings from prior Risk Committee meetings are provided to the Board on a routine basis. Additionally, in 2024, the Board, along with senior management and third-party advisors, participated in a cybersecurity ransomware tabletop exercise.


text: We have experienced in the past, and we expect to continue to experience, cybersecurity threats and events of varying degrees. However, we are not aware of any of these threats or events having a material impact on our business or our business strategy, results of operations or financial condition results to date. We cannot assure you that we will not experience future threats or events that may be material. Please also refer to the risk factors above for additional information.


text: Our cybersecurity program is designed from a risk- and compliance-based approach to achieve system-wide resilience and protection across our operations. We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We model our cybersecurity program after the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board of Directors.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with our information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications. We have established processes to help identify and manage cybersecurity risks associated with the use of these third-party consultants and providers, which include the completion of due diligence before engaging with a third-party and assessments and reviews throughout the relationship.


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide monthly cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our third-party service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Refer to "Item 1A. – Risk Factors" in this Annual Report on Form 10-K, including, "We may be subject to interruptions or failures in our information technology systems," for additional discussion on our cybersecurity related risks.


text: Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board of Directors and management. Our Board of Directors has delegated to the Audit Committee oversight of our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security. Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.


text: Our cybersecurity risk management and strategy activities are overseen by executive management, made up of the IT Steering Committee and Chief Information Officer. Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function. The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee quarterly on any appropriate items.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, and monitoring and detection tools to allow our information security team members to assist us in identifying vulnerabilities in our systems before they are exploited by malicious threat actors. Our information security activities are overseen by our Chief Technology Officer, who has over 25 years of experience in information technology, including security, encryption, system design, programming and compliance, and leaders from Information Technology, Legal and Finance teams, who have an average of 20 years of experience in information technology, security, compliance and auditing.

companyName: Proto Labs Inc

ticker: PRLB


text: We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.