text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements:


text: Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. Assessment of the likelihood and potential damage of these threats, taking into consideration the sensitivity of confidential information. Assessment of the sufficiency of policies, procedures, information systems, and other arrangements in place to control risks.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB

secItem: Item 1C


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. These assessments include regular penetration testing and periodic third-party audits to validate the effectiveness of our controls.


text: In designing our Information Security Program, we refer to established industry frameworks - in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance and best practices from the National Institute of Standards and Technology (NIST). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges. The Company utilizes these frameworks to assist with the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that summarizes the steps the Company will take to respond to a cybersecurity incident. The plan includes an Information Security Incident Response Team (ISIRT), which is responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The ISIRT is supported by operating procedures and guidelines designed to outline the expectations and processes to be followed when responding to incidents of unauthorized access to confidential information maintained by the Company or its service providers. The ISIRT may consult legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other resources and appropriate reporting protocols at both the management and Board of Directors levels.


text: Our Board of Directors articulates the Company's attitude towards risk. Associated risk metrics are monitored quarterly by Management and reported to the Audit Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks, on at least a quarterly basis.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system security. It is tailored to align with the Company's risk assessment results, and the size, complexity, nature and scope of our activities.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Board has appointed a Chief Information Security Officer (CISO). Together with the Director of Risk Management, they provide direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities. In this role, the CISO leverages 24 years of information technology experience and has maintained various applicable cybersecurity and IT audit certifications.


text: Our Information Security Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, and managing risks associated with third-party service providers by conducting due diligence prior to engagement and ongoing monitoring of vendors' security practices, including their ability to prevent, detect, and respond to cybersecurity threats. They also establish risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on program effectiveness. Additionally, the Board of Directors' Technology Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee management's activities in these areas.


text: The Board receives regular updates from the CISO and Director of Risk Management regarding cybersecurity threats and program enhancements. In evaluating its oversight capabilities, the Board considers relevant cybersecurity expertise among its members and provides ongoing training where appropriate.


text: As of the date of this report, the Company has not experienced any cybersecurity incidents that have had a material impact on its business strategy, financial condition, or results of operations.


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Corporation's risk management framework and processes. The Corporation employs a variety of processes, risk assessments, and controls to assess, identify, and manage these risks. This includes estimating the likelihood and potential impact of cybersecurity incidents. To manage these risks, the Corporation designs, documents, and implements controls, which are then tested through compliance assessments and internal and external audits. In some cases, the Corporation also transfers risk, either wholly or partially, through insurance and other methods. When an incident occurs, the Corporation responds by remediating the incident while complying with regulatory obligations, and then evaluates the remediation's effectiveness. Communication about risk management matters is conducted through documented policies and procedures, management and Board committee reporting, and employee training and communications. For a detailed description of how cybersecurity risks may materially affect the Corporation's business strategy or results, see "Item 1A. Risk Factors."

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: The Corporation's information technology risk management department consists of professionals with experience and expertise in cybersecurity, including specialists in identity and access management, cyber defense operations, security engineering, and information technology governance, risk, and compliance. This department is led by the Chief Information Officer ("CIO"), who has a bachelor of science in information technology and many certifications such as Certified Information Systems Security Professional, Certified Cloud Security Professional and Certified Information Privacy Professional, and the Information Security Officer ("ISO"), who has a bachelor of science in computer science and has over 19 years of experience in cybersecurity risk management. The ISO reports to the CIO, and the CIO reports directly to the President and Chief Executive Officer. Additionally, the Corporation engages third-party experts as needed to assess, manage, and respond to cybersecurity risks through various methods, including risk assessments, IT audits based on different frameworks, penetration and vulnerability testing, social engineering, incident response, threat intelligence, education, and managed security services.


text: The Corporation also monitors risks from third parties, such as service providers, through efforts like monitoring, information sharing, risk assessments, audits, contractual due diligence, and adherence to third-party security standards. Senior management governs risk management and is informed about and monitors the prevention, detection, mitigation, and mediation of cybersecurity incidents. This is facilitated through working review committees, on which the ISO and/or CIO serve. These committees receive risk management reports appropriate to their scope of review, covering assessment results, risk ratings, and critical issues. They report significant matters to enterprise-wide risk committees, which oversee the broader scope of risk management for the enterprise. Through these efforts, senior management makes decisions and sets priorities for allocating resources to address risk management issues.


text: The Corporation's Board of Directors, including the Audit Committee, oversees all risk management policies, procedures, and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more frequently as necessary, to the Enterprise Risk Committee on technology risks, including those from cybersecurity threats. The Board's Audit Committee and the Board of Directors receive these reports as part of their risk management oversight responsibilities. Board members have direct access to senior management and other relevant personnel and may direct questions and request further information as needed to fulfill their oversight responsibilities.


text: Cyber Risk Management and Strategy Safeguarding the confidentiality, integrity and availability of customer and sensitive financial data, records and transactions is essential to Timberland and Timberland Bank. Our risk management program is designed to identify, assess and mitigate risks across various aspects of the Bank, including financial, operational, regulatory, reputational and legal.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Cybersecurity is a critical component of our risk management program; thus, we have implemented a Cyber and Information Security Program to protect the confidentiality, integrity and availability of our information and information technology environment. Our program aligns with applicable federal and state regulations, industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC") and best practices from the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity and availability of sensitive information. NIST is part of the U.S. Department of Commerce, which develops cybersecurity standards, guidelines and other resources.


text: We have employed a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. The Bank conducts a variety of information security risk assessments throughout the year. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including but not limited to, configuration hardening, robust patch management and vulnerability scanning, advanced anti-malware firewall technologies, anti-phishing and web filtering controls. These controls are tested annually by an independent third-party audit firm. Quarterly employee training is performed on cybersecurity, information security, identify theft prevention and data privacy.


text: The Bank has not experienced any material losses relating to cybersecurity threats or incidents as of September 30, 2025. Material cybersecurity incidents are escalated to the Board and evaluated for disclosure in accordance with SEC reporting requirements.


text: Response to cyber incidents is guided by the Bank's Incident Response Policy. The Bank's plan is based on the National Infrastructure Protection Center ("NIPC") guidelines, with the addition of specific reporting and notification requirements required by regulation. The Incident Response Policy prescribes points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors, government agencies and regulatory bodies. The Incident Response Policy also specifies that material incidents are promptly reported to the Board and considered for disclosure under applicable SEC rules.


text: Third Party Service Provider Monitoring The Bank maintains a robust Vendor Management Program to appropriately measure, monitor and control risks associated with outsourcing products and services, including cybersecurity risks. Under the program, vendors are assigned a risk rating based on an assessment of the vendor and its access to network, systems and confidential information. Critical and high-risk vendors are reassessed at least annually, and remediation plans are implemented for identified deficiencies. The Bank's Information Security Officer ("ISO")conducts regular periodic reviews of the adequacy of its oversight of controls over third party relationships.


text: Cybersecurity Governance Timberland Bank's Board of Directors ("Board") recognizes the significance of cybersecurity risks and provides oversight of the Bank's Cyber and Information Security Program. The Bank's Board of Directors is currently comprised of the Chief Executive Officer and seven non-employee directors; one of which has completed and received Cybersecurity Oversight Certification from the National Association of Corporate Directors ("NACD"). The Board receives cybersecurity updates at least quarterly, including risk metrics, incident reports, and progress on mitigation strategies.


text: The Bank's primary responsibility for managing cyber risk is vested in the Bank's Information Security Officer ("ISO"). The Bank's ISO, who reports to the Chief Risk Officer, has four years of experience in information security and risk management. The ISO is responsible for the day-to-day management of the Cyber and Information Security Program, including oversight of risk assessments, incident response, employee training, and third-party vendor cybersecurity controls.


text: The Chief Technology Officer ("CTO") has over 13 years of experience in IT and cybersecurity leadership, including managing enterprise IT operations and technology risk. The CTO also holds a Certified Community Bank Information Technology Officer designation from the ICBA, and a CompTIA Security+ certification and has completed the Graduate School of Banking at the University of Wisconsin's Bank Technology Management program. Members of the Technology Steering Committee bring substantial experience in IT operations, cybersecurity, and risk management, providing guidance on technology strategy, operational performance, and cybersecurity oversight.


text: The Technology Steering Committee meets on a regular basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Bank. The Technology Steering Committee is comprised of numerous members of the management team, the CTO and the ISO. The Technology Steering committee reports to the Board of Directors through Committee minutes.


text: The Board Technology Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to the overall role of technology in executing the business strategy of the institution, including but not limited to major technology investments, technology strategy, operational performance and technology trends that may affect customers. The Board Technology Committee meets regularly and receives reports from the CTO and the ISO on cybersecurity and information technology risks. The Board Technology Committee reports to the Board of Directors through Committee minutes. The Board's Audit Committee also has oversight responsibility for audits related to information technology, security and information technology governance.


text: We maintain a cybersecurity and information security program, which leverages best practices and standards. Risks from cybersecurity threats are regularly evaluated as part of our broader risk management activities and as a fundamental component of our internal control system. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers.

companyName: EXELIXIS, INC.

ticker: EXEL


text: All employees receive cybersecurity training upon hire with annual or more frequent training thereafter with job-specific topic considerations. Our IT team engages third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. The employees within our broader IT team who specialize in cybersecurity operations (Security Ops Team) are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Our Information Security Incident Response Plan (Response Plan) sets forth our response protocol for cybersecurity threats and cybersecurity incidents and is maintained by the Information Security Governance Committee (InfoSec Committee), which reviews the Response Plan on an annual basis. The InfoSec Committee is comprised of IT department leaders and members of our senior management team and is a subcommittee of our Ethics Committee, which provides reports to the Risk Committee of our Board of Directors. Our Response Plan is designed to provide a framework for how we identify, escalate and respond in the event of a data security breach and designates personnel who are responsible for these functions. Our Security Ops Team evaluates security alerts received from various sources, and any alert or threat that the Security Ops Team identifies as a cybersecurity incident (such as a data security breach) is promptly escalated to the InfoSec Committee for further assessment. Upon confirmation that a cybersecurity incident has occurred, our InfoSec Committee will establish an incident response team, which may include representatives from our internal departments, as well as outside legal counsel or other external cybersecurity consultants or service providers. The Incident Response Team aims to develop a coordinated response strategy, entailing risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.


text: The InfoSec Committee evaluates the implications of cybersecurity incidents to determine whether such incidents have had or are reasonably likely to have a material effect on our business strategy, financial condition, and results of operations. If a cybersecurity incident is deemed material by our InfoSec Committee, our Chief Financial Officer or General Counsel will notify the other members of our senior management team and the Chair of the Risk Committee of our Board of Directors as needed.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect us, including our business strategy, results of operations or financial condition. We and our third-party service providers have frequently been the target of cybersecurity threats and expect them to continue, and for an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Board of Directors and Board Committees. In accordance with our Corporate Governance Guidelines, the Board of Directors, both directly and through its committees (including the Risk Committee) oversees the proper functioning of our risk management process. In particular, the Risk Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with the Company's business and operational activities and to administer the Company's various compliance programs, in each case including data privacy and cybersecurity concerns. The Board and the Risk Committee each meet at regularly scheduled and special meetings throughout the year at which meetings management reports to the Board concerning the results of its risk management activities, as well as external factors that may change the levels of business risk to which we are exposed. Specifically, the Risk Committee receives regular updates from members of the InfoSec Committee or Ethics Committee, as often as necessary but at least once per year, with respect to our cybersecurity threats and responses to any cybersecurity incidents.


text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the SecOps Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Vice President of Information Technology (who has 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We and our third-party service providers have frequently been the target of cybersecurity threats and expect them to continue, and for an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the Security Ops Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Senior Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Senior Vice President of Information Technology (who has over 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Senior Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") - Global Business & Information Services, Vice President ("VP") Information Services, and Senior Director of Information Technology Operations and Governance. We take a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats; • network perimeter firewalls, including malware prevention; • e-mail scanning to prevent spam and phishing campaigns; • vulnerability scanning and remediation of vulnerabilities based on priority; • logical access controls, including multi-factor authentication; • incident response procedures; and • disaster recovery protocols.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The Company educates its workforce as part of our security awareness program to understand the risks and potential impacts cybersecurity threats pose to our business, and ways employees can remain vigilant to prevent cybersecurity incidents from occurring. The program includes annual employee acknowledgement of security related policies, ongoing communication about prevalent vulnerabilities, security awareness training, and simulated phishing campaigns.


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our information systems environment, identify suspicious activity, and perform actions to prevent or stop attacks.


text: The Company maintains a cybersecurity insurance policy that provides coverage for potential losses arising from a cybersecurity incident. Although we maintain cybersecurity insurance, there can be no guarantee that our policy will cover all losses or all types of claims that may arise from such incidents.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Company's Board of Directors receive updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 35 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, the internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks are discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") – Global Business & Information Services, Vice President ("VP") – Global Business Systems, VP – Global Information Technology Operations and Governance, and Senior Director – Data Insights and Innovation. We utilize a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats, • network perimeter firewalls, including malware prevention, • e-mail scanning to prevent spam and phishing campaigns, • vulnerability scanning and remediation of vulnerabilities based on priority, • logical access controls, including multi-factor authentication, • incident response procedures, and • disaster recovery protocols.


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our end points, identify suspicious activity, and perform actions to prevent or stop attacks.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Board of Directors receives updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 36 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, an internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks is discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.


text: We have implemented policies and procedures intended to manage and reduce cybersecurity risk that are integrated with the Enterprise Risk Management ("ERM") framework utilized by management and the Audit Committee to oversee our various top enterprise risks. We maintain an incident response plan that is designed to protect against, identify, evaluate, respond to and recover from a cybersecurity related incident. The plan provides for the creation of an incident response team in the event of an incident and it is designed to be flexible enough to accommodate a broad array of potential scenarios. The incident response team is a cross-functional group that may be composed of both Company personnel and external service providers, and that is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We conduct regular exercises to help ensure the plan's effectiveness and our overall response preparedness.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We periodically engage third parties to perform cybersecurity audits to measure the maturity of our cybersecurity program against the National Institute of Standards and Technology (NIST) Framework. We also engage third parties to conduct security reviews of our network, processes and systems on a regular basis to identify opportunities and enhancements to strengthen our policies and practices.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding and we continue to reassess vendors using a risk-based approach. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of information security incidents occurring on their systems that may affect our systems or data, including personal information.


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Information Technology and Cybersecurity" in our Risk Factors in Item 1A of this Form 10-K.


text: Our Board of Directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the Board of Directors on its specific risk oversight activities. The Audit Committee, comprised solely of independent directors, oversees our overall ERM program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), all of which are fully integrated into our ERM program. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports out to the full Board of Directors on our relevant strengths and opportunities.


text: Our cybersecurity program is led by our Chief Information Officer (CIO), who is responsible for identifying, assessing and managing our collective information security and technology risks. Our current CIO has served in that role since 2016 and has more than 20 years of experience in the information security and technology fields. Our CIO holds both bachelor's and master's degrees in Electrical Engineering from the Massachusetts Institute of Technology.


text: The CIO meets regularly with leaders of our various information technology management teams to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit Committee receives periodic updates from the CIO, the director of our cybersecurity team and a senior attorney, the three most senior leaders with responsibility for oversight of our key cybersecurity program components. These updates include matters such as ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness. Our CIO also provides updates to the full Board of Directors on such topics at least annually.


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks, including maintaining insurance coverage to mitigate the potential financial consequences of cybersecurity incidents, and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Relating to Information Technology, Cybersecurity and Privacy" in our Risk Factors in Item 1A of this Form 10-K.


text: We seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption,

companyName: RESMED INC

ticker: RMD


text: We seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Our management team has adopted policies, standards, processes, and practices and implemented controls and procedures that allow us to assess, identify and manage material risks from cybersecurity threats enabling our board of directors to actively oversee the strategic direction, objectives, and effectiveness of our cybersecurity risk management framework. Our processes are integrated into our overall enterprise risk management program, as implemented by management and as overseen by our board of directors. Our board of directors has an important role in risk oversight.


text: To identify and assess material risks from cybersecurity threats, we use a risk assessment process aligned with standard industry frameworks such as the National Institute of Standards and Technology, or NIST, International Organization for Standardization, or ISO, 27001 and other industry standards. We engage in regular network and endpoint monitoring, vulnerability assessments, and penetration testing, among other exercises. We continuously monitor threats and unauthorized access to our network through both internal and external third-party resources. We have developed incident response plans which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We provide annual privacy and security training for all employees which incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We have also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of critical third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. Additionally, we require those third parties that could introduce significant cybersecurity risk to us to provide ISO certifications or Service Organization Controls, or SOC, 2 reports as evidence of a cybersecurity audit and these reports are reviewed and assessed for risk.


text: We review our cybersecurity risk framework and related policies both internally and externally by third parties at least annually. Our risk management program is also reviewed annually as part of SOC 2 and Health Information Trust Alliance, or HITRUST, Common Security Framework audits.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: Our cybersecurity program is led by our Chief Technology Officer ("CTO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CTO has extensive information technology and program management experience and many years of experience with our organization. Our CTO reports to our president and CEO.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts in evaluating and testing our risk management systems. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with the third-party includes threat assessments and consultation on security enhancements. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.


text: While acknowledging the existence of various cybersecurity risks, to date, they have not materially affected our business strategy, results of operations or financial condition. Although we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor.


text: Our cybersecurity program is led by our Chief Information Officer ("CIO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology and program management experience and many years of experience with our organization. Our CIO reports to our president and CEO.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.


text: Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.


text: We maintain a comprehensive cybersecurity program designed to protect both customer data and our proprietary information. Our cybersecurity framework is governed by our Board of Managers and driven by a dedicated Information Security Officer, ensuring that all processes comply with regulatory requirements and industry best practices. This framework is documented in our Cybersecurity Policy and Information Security Program Policy, which outlines the risk management, preventive, detective, and corrective controls we have implemented across the organization.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: Our approach begins with regular, in-depth risk assessments that identify both inherent and residual cybersecurity risks. Utilizing standards such as the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institutions Examinations Council guidance, and the foundational safeguards outlined in CIS Controls v8, we continuously monitor, evaluate, and update our security controls. These assessments allow us to effectively manage vulnerabilities across our Company assets and software, ensuring that only authorized and securely configured systems are connected to our network. In addition to proactive risk identification, our cybersecurity process includes a robust incident response capability. We maintain detailed procedures for detecting, containing, and remediating cyber threats, which are regularly tested through internal audits and third-party assessments. This ensures that should an incident occur; our team can swiftly activate the Incident Response Plan to minimize potential impacts and restore secure operations.


text: We extend our cybersecurity diligence to third-party service providers and require periodic employee training. All external partners are required to adhere to our cybersecurity standards, and our employees receive ongoing training to stay current with emerging threats and best practices. This comprehensive, layered approach not only safeguards critical data but also reinforces our commitment to continuous improvement and compliance with statutory and regulatory requirements.


text: Our Board of Managers retains supervisory oversight responsibility for enterprise risk management and cybersecurity risks. The primary responsibility for maintaining an information security has been assigned to an Information Security Officer (" ISO "). The ISO works with the Audit Committee to address information security risks found by each business segment. Our ISO conducts an annual risk assessment report and submits the report to the Audit Committee for its review. The Audit Committee meets with Company management, the ISO and external auditors to review the Company's risk management processes and enterprise-wide risks found by the Company. The scope of this review is intended to address cybersecurity governance risks and related controls and identify any deficiencies that could adversely affect the Company's ability to record, process and report financial data. As of the date of this Report on Form 10-K, there have been no cybersecurity incidents we believe have had a material effect on our operations, business, results of operations or financial condition.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the standardized framework established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. The NIST Cybersecurity Framework ("NIST CSF") helps the Company prioritize its cybersecurity activities and take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. We rely on a cybersecurity team that works to identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents through risk management and strategy. Our cybersecurity team has adopted procedures to promptly address material risks to the Company's cybersecurity environment, with a triage and remediation protocol in place. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: As part of our cybersecurity defense structure, our internal cybersecurity team performs the following actions, without exclusion: (i) tracking cybersecurity risks, threats and incidents to help identify and analyze them; (ii) promptly reporting significant cybersecurity risks, threats and incidents to our CIO; and (iii) utilizing third-party vendors and software for review, testing, preemption and monitoring of cybersecurity risks, threats and incidents.


text: In addition, our CIO closely monitors the cybersecurity team's approach with regular reviews of security risks and vulnerabilities, security strategy and the implementation of mitigation plans and technology, and reports quarterly to our Audit Committee and Board of Directors on, among other things, threats, mitigation measures, and preventative procedures and software.


text: We have a robust cybersecurity training and awareness program that requires all employees to complete mandatory cybersecurity awareness, information handling, and privacy training at the time of onboarding and on an annual basis thereafter. In addition, we regularly test our employees compliance with best practices using various techniques, such as simulated phishing campaigns, to validate the efficacy of our cybersecurity training.


text: We have implemented solutions, processes, and procedures to help mitigate the risk of cyberattacks, such as conducting annual vulnerability testing, and periodically engaging third-party experts to assist us with tasks such as implementing our incident response plan and conducting tabletop exercises.


text: The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Furthermore, the Company's cybersecurity program is periodically reviewed and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: As are other businesses, from time to time, we have experienced efforts by unknown persons, including "bots", to access or breach our information systems, which have been prevented based on measures put in place by the Company. However, there can be no assurance we will be able to protect sensitive data and/or the integrity of the Company's information systems and to defend against such efforts in the future. See Item 1A. "Risk Factors" of this Form 10-K.


text: As the head of our cybersecurity team, our CIO reports quarterly on cybersecurity to our Audit Committee, which has primary responsibility for cybersecurity oversight, and also to our full Board and regularly reports to the Chief Executive Officer on such cybersecurity matters. Cybersecurity risk is assessed and tracked as a significant risk faced by the Company and is closely managed along key risk indicators covering security maturity, risk exposure, and security operations. Performance against these indicators is regularly measured and discussed, among other things, in our Board reporting.


text: The members of our cybersecurity team have risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team maintains expertise on cyber risk management through certified security professionals on staff, external training and affiliations with relevant organizations. Additionally, we regularly engage with third party assessors, consultants, and advisors as needed for reviews and testing of our cybersecurity risk management systems.


text: We have established a comprehensive incident response and recovery plan to identify, protect, respond to and recover from cybersecurity threats and incidents. The plan includes processes for the activation of the crisis management team (comprised of the Company's Chief Executive Officer, Chief Financial Officer and General Counsel), incident handling, and prompt and fulsome reporting to the Board upon discovery of a breach that could reasonably be material upon further investigation. Our procedures require reporting up the chain of command, even while materiality assessments are still being determined. In addition, we have pre-negotiated contracts with external third-party incident response providers to guide and assist the internal crisis management team as needed.


text: We rely on the information technology and systems maintained by our managers, including RMR, and rely on our managers to identify and manage material risks from cybersecurity threats. RMR and our hotel managers take various actions and incur significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Service Properties Trust

ticker: SVC


text: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.

companyName: POOL CORP

ticker: POOL


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and quarterly cybersecurity training of our employees. In an effort to mitigate cyber risks for customer-facing software, we incorporate the protocols described above along with software specific programs such as a bug bounty system and partnerships with external experts.


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We incorporate the lessons learned from these engagements into our cybersecurity program. Our cybersecurity program also includes controls to manage risks associated with our use of third-party service providers; however, we cannot ensure in all circumstances that their defensive efforts will be successful.


text: Like most large organizations, we face constant and dynamic risks related to cybersecurity. In recent years we have faced, and expect to continue to face, various attempted cyber-attacks of increasing sophistication. To date, we are not aware of any cybersecurity incident or threat that materially impacted or could reasonably be anticipated to materially affect our business, results of operations or financial condition. However, we cannot guarantee that we will not experience such an incident in the future. For a further description of these risks, see "Risk Factors – Risks Relating to Technology, Cybersecurity and Data Privacy," included in Item 1A of this Form 10-K, which should be read in conjunction with this Item 1C.


text: Our Board of Directors (Board) is responsible for oversight of our risk management programs and assisting management in addressing specific risks, including cybersecurity risks. The Audit Committee assists our Board in reviewing cybersecurity and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee also helps in reviewing with management any specific cybersecurity issues that could have a material impact on us. Our Chief Information Officer (CIO) provides the Board with updates on cybersecurity risks at regularly scheduled board meetings at least twice a year. These updates include the results of any third-party reviews and related remediation items.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: At the day-to-day operational level, our CIO manages an information security team tasked with executing our cybersecurity program. This team includes a director of network security, technical director of enterprise architecture, system architects and network security staff. Members of our information technology (IT) management group, led by our CIO, have extensive years of combined experience in defending large, complex corporate environments. Our CIO, IT management group, architects and network security team members receive briefings and annual training on cybersecurity threats and response methods that provide real world threat scenarios to measure the effectiveness of our programs and technologies in protecting our systems. Our team of professionals also monitors our compliance with laws governing privacy rights, data protection and cybersecurity.


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, includes activating response plans from third-party partners, escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats. Our program leverages components from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which we use to help us identify, assess and manage cybersecurity risks relevant to our business. O ur cybersecurity program is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and emphasize the importance of cybersecurity across our organization through quarterly trainings, which include best practices and participation in simulated phishing exercises to strengthen employee vigilance.


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We also regularly test our environment as part of our focus on identifying and eliminating vulnerabilities. We incorporate the lessons learned from these engagements into our cybersecurity program. Recognizing the risks posed by external partners, we have implemented a third-party risk management program, which includes due diligence assessments, contractual safeguards, and regular monitoring of vendors and partners with access to our systems or data; however, we cannot ensure in all circumstances that their defensive efforts will be successful.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO, who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, may include escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is identified as a key risk area for the Company, and Management measures inherent risk, mitigating controls, and residual risk on a quarterly basis.

companyName: BANNER CORP

ticker: BANR


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Providing input for internal and external auditors and independent third-party engagements, including in relation to internal and external (i.e., third-party operated) penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). The ISO/IEC 27001 requirements provide a systematic and risk-based approach to managing sensitive information, ensuring its confidentiality, integrity, and availability. The requirements reflect best practices that organizations can use to guide an information security program. The Company considers these frameworks to be aspirational benchmarks to help inform the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents, and we have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident.


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes a risk appetite for each, as well as specific associated risk metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and also identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system and domain name security. It is tailored to align with the Company's size and complexity and the nature and scope of our activities.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 25 years of information technology experience. In addition, the Bank's Chief Information Security Officer (CISO) has been with the Company for more than 12 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing. The CIO and the CISO are supported by a team of information technology and information security specialists.


text: Our Information Technology (IT) Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee regarding the overall status of the Information Security Program. This reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.


text: We maintain a Cybersecurity Incident Response Team (CIRT), which is responsible for addressing the technical aspects of the Company's response to cybersecurity events. Additionally, our cross-functional Executive Cybersecurity Event Evaluation Team (ECEET) is responsible for assessing the potential business impacts and disclosure requirements related to cybersecurity events. Both the CIRT and the ECEET may consult cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other governance groups, which may include the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receive a quarterly report from the chair of the ECEET.


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, leveraging a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is considered to be a key risk area for the Company, with Management measuring inherent risk, mitigating controls, and residual risk on a quarterly basis.


text: The ability to mitigate cybersecurity risks depends on an effective risk assessment process that identifies, measures, controls, and monitors material risks from cybersecurity threats. These threats include any potential unauthorized activities that could compromise the confidentiality, integrity, or availability of the Company's information systems and data. Our Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Conducting internal and third-party security assessments, including penetration testing. • Overseeing third-party vendor risk through due diligence and monitoring.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). These frameworks provide best practices for managing cybersecurity risks and ensuring information security, and we consider them to be aspirational benchmarks to help inform the design of our Information Security Program. While our program is designed to be robust, the sophistication and evolving nature of cyber threats mean no system can fully eliminate risk. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established procedures for the timely escalation and, when required, disclosure of cybersecurity incidents, supported by a formal incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident. While cybersecurity risks could materially affect the Company, past incidents have not materially affected our business strategy, results of operations or financial condition. For further details on potential cybersecurity risks, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors annually reviews and approves the Company's Risk Appetite Statement, which defines key risk categories and associated metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect sensitive information in accordance with FDIC and FFIEC regulations. The program is tailored to align with the Company's size, complexity and operational scope.


text: Cybersecurity risk management is led by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), supported by our information technology and information security teams. The Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 26 years of information technology experience. The Bank's Chief Information Security Officer (CISO) has been with the Company for more than 13 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing.


text: Our Information Technology (IT) Management team is responsible for conducting risk assessments, designing the Information Security Program, overseeing service provider arrangements, establishing risk-based response programs for incidents involving unauthorized data access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program to reflect changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee on the status of the Information Security Program, including risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents and recommendations for improvements. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. The Board of Directors' Corporate Governance/Nominating Committee considers IT and cybersecurity expertise when assessing potential director candidates to help ensure effective oversight by the Board of Directors.


text: We maintain a Cybersecurity Incident Response Team (CIRT) to handle technical aspects of the Company's response to cybersecurity events and an Executive Cybersecurity Event Evaluation Team (ECEET) to assess potential business impacts and disclosure requirements related to cybersecurity events. Both teams may engage cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process facilitates updates to internal governance groups, including the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receives a quarterly report from the ECEET chair.


text: We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. For example, to identify and assess risks from cybersecurity threats, our enterprise risk management program considers cybersecurity as part of the Company's risk assessment process, and our risk management framework requires risk owners to monitor key risks such as cybersecurity on a continuous basis. See Item 1, " Business—Enterprise Risk Management " for additional information.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks. Our privacy and information security policies and standards govern our business lines and subsidiaries and encompass incident response, access control, and vendor management, among others. In order to develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.


text: We annually undergo an external evaluation by a third party cybersecurity firm with a specialty in penetration testing. Our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third party service providers. In addition, the Company negotiates appropriately protective terms in its legal agreements with these providers.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions that we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents. See Item 1A, " Risk Factors—Risk Relating to Our Industry, Business & Operations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation."


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").


text: Our cybersecurity and IT executives include our CIO, who has 33 years of experience in Information Technology, including 20 years in the financial services space. His responsibilities as the CIO include information security oversight, and board reporting. Our CISO, has 18 years of experience in Information Security. The CISO holds certifications from leading security associations. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.


text: • The Privacy and Security Committee ("P&S Committee"), co-chaired by the CISO and our Deputy General Counsel, brings together Information Security, legal, compliance, human resources and other function leads. The P&S Committee provides a forum for these cross-functional members of management to: consider new laws and regulations relating to privacy and security; consider emerging risks relating to cybersecurity and data protection; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Operational Risk Committee ("ORC"), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company's programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO's quarterly report to the Audit Committee. • The Crisis Incident Management Team ("CIMT"), which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Each quarter, the CIMT exercises its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. • The IT Steering Committee ("IT Committee", which includes our CIO, CISO, COO and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives.


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.


text: At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions. We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.