text: These processes are integral to our overall risk management system or processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP – Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP – AERC and consists of members of senior management including the CIDO and six other of the CEO's direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from these attacks or other cybersecurity incidents, including as a result of prior cybersecurity incidents.


text: –PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board —The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings a year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risk, a cybersecurity update from the CISO and/or CIDO, and review of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO are regular attendees at IOC meetings. In addition, the IOC meets with the CISO in executive session at each meeting with no other members of management present, and has also met with the CIDO, to whom the CISO directly reports, in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CIDO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG

secItem: Item 1C


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC and Audit Committee are informed of cybersecurity risks by way of frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate.


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of materials risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report of the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees twice per year, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity, risk and compliance team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity, risk and compliance team. The CISO has served in this role since September 2018. Our CISO has over 20 years of experience in IT security management and served as the director of information security and chief security architect in the insurance sector prior to joining PSEG. Our CISO has a bachelor's degree in electrical engineering and holds multiple security certifications, including Certificate of Cloud Security Knowledge, Certified Information Systems Security Professional, Certified Information Systems Auditor, Information Systems Security Architecture Professional, and National Institute of Standards and Technology Cyber Security Professional Practitioner.


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and meets with the IOC, without other members of management present, during each meeting's executive session. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity, risk and compliance team, who are tasked with these responsibilities on a day-to-day basis.


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity Risk and Compliance Team cybersecurity managing counsel, and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council.


text: In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks by way of updates shared during Cybersecurity Council meetings, as well as through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: FS KKR Capital Corp

ticker: FSK


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Our cybersecurity program is staffed by a team of highly skilled cybersecurity professionals, including over 24 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts. The program incorporates industry standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information, backed by a suite of best-in-class security technologies and tools to implement and automate security protections for our networks, employees, and customers.

companyName: Crane Co

ticker: CR


text: We utilize a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented an approach to identify and mitigate information security risks that we believe is commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. From the completion of the Company's separation from Crane Holdings on April 3, 2023. Since the separation and during the past five years (as Crane Holdings), no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond.


text: Crane has not experienced a material third-party security breach, but recognizes the inherent cyber risks associated with relying on third-party vendors such as cloud service providers, software vendors, data processors, and IT service providers with access to company information, systems, or processes. Crane is committed to managing these risks responsibly and transparently and has an active process in place to assess and reduce that risk, including performing due diligence on third-party vendors before onboarding and evaluating and assessing their cybersecurity policies, procedures, incident response plans, and relevant certifications (e.g., SOC 2, ISO 27001, etc.). We continuously monitor publicly available information about our third-party vendors for reports of security incidents and fully investigate any reports for impact to Crane systems or information and take appropriate measures to limit the impact to Crane in the event of a third-party security incident.


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all employees on cybersecurity standards and provide monthly training on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. We use advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we periodically engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.


text: Our approach to cybersecurity begins with our desire to maintain strong governance and controls to effectively manage and reduce security risks. Security begins with our "tone at the top", where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. The cybersecurity program is led by Crane's Chief Information Security Officer, who provides periodic updates to the Audit Committee of our Board of Directors, annual updates to the full Board of Directors, and regular reports to the executive management team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. The entire Board of Directors ultimately is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks, including cyber risks. The Company maintains cyber risk and related insurance policies as a measure of added protection.


text: We embrace a "defense in depth" approach to assess, identify, and manage cybersecurity threats. A defense in depth approach seeks to implement multiple layers of defenses in order to help reduce the risk that a single process or control failure might result in a material incident. We utilize a risk management framework to assess, manage, and report on material risks and threats. In light of the importance of cybersecurity matters, we have developed as part of this framework a risk domain specific to cybersecurity matters, including specifying applicable risk tolerances and metrics. The Executive Vice President, Chief Information Officer (CIO), who has served in information technology leadership roles with the Company since 2007 and has over 20 years of experience with matters related to cybersecurity, including as an executive leader and consultant, and Executive Vice President, Enterprise Risk Management (EVP, ERM), who has served in risk management leadership roles for the Company since 2015, have oversight over information technology and enterprise risk management matters, respectively, and receive monthly reports on cyber-related metrics and activities from their teams. In addition, we have implemented escalation procedures and protocols, including an incident response team that includes key members of management such as the CIO and EVP, ERM, to manage and coordinate responses to potentially significant cybersecurity incidents. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2023, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Company's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Company. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Company further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Company's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, as well as how such risks could materially affect the Company's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Company, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Company's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: TIAA's cybersecurity team periodically reports to the Company's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Company, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Company's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach to achieve systemwide resilience and protection across our operations and to ensure the appropriate acquisition, access, use, and/or disclosure of PHI, PII, and payment card information ("PCI"). Our Program employs the National Institute of Standards Technology (NIST) cybersecurity framework and strategy to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. In concert with our Program, the Company's Enterprise Risk Management program builds resiliency in our operations to support continuous delivery of services and considers cybersecurity risks alongside other company risks.

companyName: R1 RCM Inc. /DE


text: Our Program includes the following elements: (i) internet and perimeter security; (ii) endpoint and email security; (iii) threat intelligence, monitoring and management; (iv) data security for PHI, PII, and PCI; (v) personal accountability, which includes comprehensive training for our employees and third party-contractors (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks and opportunities; (vi) access management; (vii) application and cloud security; and (viii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually.


text: As a company managing the use and disclosure of PHI and PII, our Program incorporates annual independent Systems and Organization Control 2 (SOC 2) Type 2 audits that are conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, which provide an independent evaluation of the design and operating effectiveness of our controls. We also annually undergo independent HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards for protecting the confidentiality, integrity, and availability of data; independent attestations of compliance with the Payment Card Industry Data Security Standard (PCI-DSS); and Health Information Trust Alliance (HITRUST) certification. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST.


text: The R1 Security Program Policy delineates responsibilities and initiatives to maintain our comprehensive Program. It includes frequent reviews and development of our security policies and standards, monitoring to detect potential threats or disruptions, testing of protocols to verify the effectiveness of our defense systems, and training for our workforce. Our teams continuously and proactively monitor our information systems for potential risks, threats, and disruptions, including at our U.S.-based third-party data centers. Through the use of our rapid response and incident management processes, which include our IT incident management and IT disaster recovery processes, we assess potential incidents and determine a course of action. This may involve risk mitigation, resolution plan development, and process improvements.


text: In parallel with our Code of Integrity, we have created and posted publicly, and incorporate into vendor contracting, our Third-Party Code of Conduct for our contractors, subcontractors, and other vendors and suppliers, which holds R1's third parties to the same applicable data and privacy standards as R1. We request Attestations of Compliance and execute HIPAA-compliant Business Associate Agreements in these contexts as appropriate.


text: In 2023, we did not identify risks from cybersecurity threats that have materially affected or are currently reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See Part I, Item 1A "Risk Factors—Risks Related to Our Cybersecurity and Technology" for more information.


text: The Board, as a whole and through its committees, has responsibility for the oversight of risk management, including cybersecurity. The Board has delegated primary oversight of risk to the Compliance & Risk Management Committee, which partners with our Audit Committee to oversee risks related to the prevention, timely detection, and mitigation of the effects of cybersecurity threats or incidents on us. The Audit Committee monitors our Program, including as it relates to financial and reporting systems and controls. The Information Security Team, described below, communicates quarterly with the Audit and/or Compliance & Risk Management Committees to keep them informed about the state of our Program, current and evolving threats, compliance with regulations, and other strategic initiatives. Both committees regularly brief the entire Board on cybersecurity matters discussed during committee meetings.


text: Our Information Security Team is responsible for the oversight and operation of our Program. Our Chief Information Security Officer oversees our Information Security Team and works in close collaboration with our Chief Technology Officer, Chief Compliance Officer, General Counsel, and Chief Privacy Officer. This group works hand in hand with our Privacy Team in the protection of data. The Privacy Team is a team of senior leaders that identifies and addresses issues related to the use and disclosure of data. The Information Security Team, on the other hand, controls our security standards and operating procedures. In particular, they and their teams provide guidance and support to each of our business segments, coordinate internal reviews, including those conducted by our internal auditors, and monitor and evaluate the security assessments from our internal and external parties.


text: Cecil Pineda is our Chief Information Security Officer. Mr. Pineda has nearly 20 years of experience in the cybersecurity industry, having held senior IT security-related roles at nationally recognized companies and organizations. Mr. Pineda holds a degree in Electronics and Communications Engineering. He reports directly to Brian Gambs, our Chief Technology Officer. Mr. Gambs is an experienced leader with over two decades of expertise in managing cybersecurity risk for HIPAA-regulated entities, including payers and providers, and an extensive background in technology leadership for a publicly traded healthcare and financial services company. The other members of our Information Security Team have substantial cybersecurity experience, including cybersecurity incident response, mitigation and remediation; information security program design; and regulatory compliance.


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity framework, informed by the Center of Internet Security, or CIS, cybersecurity framework. This includes policies, processes and technologies designed to minimize risks from cybersecurity threats. We maintain oversight of our third-party vendors with access to our information technology resources through the inclusion of contractual security requirements as appropriate.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Our cybersecurity approach is designed to minimize risks from cybersecurity threats identified by internal stakeholders, threat intelligence providers, vulnerability management programs, and security management programs. Our internal team manages and maintains remediation strategies for identified risks, and reports on them periodically to senior leadership.


text: As appropriate, we assess our internal controls, including controls around our information technology systems and their impact on our financial statements or systems, through either independent audits or internal assessments with the assistance of third party resources.


text: Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 15 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.


text: The IT Director meets with the Chief Financial Officer, the Chief Compliance Officer, and the General Counsel periodically to monitor and review the outcomes of our cybersecurity program and to discuss and decide matters related to cybersecurity treatment strategy (including mitigations). The IT Director and the Chief Financial Officer provide periodic reports to the audit committee on cybersecurity risk management, and, quarterly, the Chief Financial Officer updates the audit committee of any material changes in the Company's cybersecurity framework or cybersecurity activity. The audit committee is responsible for reviewing and overseeing our risk management process, including risks from cybersecurity threats, pursuant to the audit committee charter. Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. In its risk oversight role, our board of directors has the responsibility to confirm that the risk management processes designed and implemented by management are appropriate and functioning as designed.


text: As a multi-line insurance company, our business operations rely upon secure information technology systems for data processing, storage, and reporting. Despite security and controls design, such information technology systems could become subject to cyberattacks. Network, system, application, and data breaches could result in operational disruptions or information misappropriation, which could have a material adverse effect on our business, results of operations and financial condition. Unauthorized access to or unintentional dissemination of confidential, highly-sensitive customer, employee, or company data through breach in our facilities, networks, or databases, or those of our agents or third-party information technology and software vendors, could result in loss or theft of assets or operational disruption.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: To address cybersecurity risk, we maintain a cybersecurity risk management program that is overseen by the Chief Information Security Officer (CISO). The CISO is responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations and third-party risk assessments; identifying and keeping abreast of developing security threats; as well as overseeing and implementing regular security awareness training of all employees on cybersecurity. In leading the cybersecurity risk management program, the CISO regularly works with other divisions of the company, including legal, compliance, IT, audit, and others to address potential risk from external threats, internal actions, and relationships with third-party service providers.


text: Horace Mann's CISO has more than two decades of experience in IT, including network, infrastructure, and cybersecurity. Before coming to Horace Mann, he led perimeter security at a publicly traded company, and the cybersecurity team of more than 150 members at another publicly traded company. In addition to the CISO, our internal cybersecurity team also works with third-party cybersecurity vendors to both mature the cybersecurity program and assess, monitor, and respond to cybersecurity threats.


text: The Board of Directors exercises risk management oversight, including cybersecurity risk, through the Audit Committee. The Audit Committee receives regular reports on our risk management program. These include regular reports from the CISO on the state of our cybersecurity risk management program and updates on cybersecurity matters.


text: The CISO is responsible for identifying and reporting any cybersecurity incidents to the Disclosure Committee. The Disclosure Committee is composed of senior executives from across Horace Mann and has oversight over SEC disclosure controls. After notification, the Disclosure Committee or designated subgroup would review known information and develop an action plan, which would include Board outreach, expert retention, insurance notification, communication plans, and a materiality assessment.


text: Although we believe we and our IT providers employ appropriate security technologies (including data encryption processes, intrusion detection systems), and conduct comprehensive risk assessments and other internal control procedures to assure the security of our and our customers' data, we can provide only reasonable, not absolute, assurance that these objectives will be met. Further, the design of any cybersecurity risk management program or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains despite our significant and comprehensive cybersecurity efforts. An investor should carefully consider the risks and all other information set forth in this Annual Report on Form 10-K, including disclosures in Part I - Item 1A—Risk Factors.


text: The HHH cybersecurity program is an enterprise-wide, risk-based program that is designed to support the security, confidentiality, integrity, and availability of our systems and information. We conduct periodic assessments of the cybersecurity program to identify and manage material cybersecurity threats and risks using internal teams and independent third parties. The assessment results are used to develop appropriate cybersecurity controls best practices and risk mitigation strategies, which are then implemented throughout the Company.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.


text: We employ a range of tools and strategies to mitigate cybersecurity risks, regularly testing them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan that is kept within our written information security program (WISP). Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of a similar size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.


text: Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual suspected security incident, executing the Company's WISP.


text: The Company's Board of Directors recently formed a technology committee (the Technology Committee) to assume governance and oversight of HHH's cybersecurity program from the Audit Committee. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform the Board of Directors on important matters. Furthermore, the Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.


text: At Lucid, cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in people, processes, and technology to protect Lucid's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We are continuously assessing and enhancing our protection, detection, response, and recovery capabilities and regularly engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. At its core, our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: Lucid Group, Inc.

ticker: LCID


text: Board and Committee Oversight Our Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Lucid's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Lucid's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Lucid's management, including our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.


text: At the management level, our information security steering committee, with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. Under the information security steering committee, we have a cybersecurity risk and compliance committee, led by our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, which is primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process. The cybersecurity risk and compliance committee receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the information security steering committee, which, with additional oversight and support from our CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise.


text: Our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified information systems security professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experience.


text: Management of Cybersecurity Risk Our Cybersecurity Risk Management Processes Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. Our program is designated to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.


text: Under the oversight of the information security steering committee, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who engage in identifying, considering and assessing risks from cybersecurity threats and incidents on an ongoing basis; establishing processes to monitor such cybersecurity risks; putting in place mitigation and remediation measures; policy review and development; product support and deployment; and maintaining our cybersecurity measures. Our cybersecurity team also implements ongoing data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers. Cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan. Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.


text: Lucid has also implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.


text: Third-Party Auditors and Consultants in Cybersecurity Risk Management Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements. We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the program posture. We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval. As a general matter, we have from time-to-time utilized third-party cybersecurity consultants on an ad hoc basis in specific instances, including (i) to address potential cybersecurity threats and incidents, (ii) to conduct cybersecurity assessments and penetration testing on high value systems and applications; and (iii) to develop internal capabilities to improve our cybersecurity defense.


text: Cybersecurity Risk Management of Third-Party Vendors and Service Providers We have also implemented risk management practices designed to minimize the material cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data. In order to oversee and identify such risks, we have implemented the following processes: (i) a third-party security risk management program designed to assess security risk of new third-party vendors or service providers and develop countermeasures to manage unacceptable risks; (ii) provisions in our third-party vendors and service provider contracts with added security requirements; (iii) training procurement teams on management of third-party vendor and service providers; (iv) role-based access controls for third-party personnel; and (v) data transfer mechanisms for the sharing of data with third parties. While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT audit, IT security, governance, risk, and compliance reviews. To protect, detect, and respond to cybersecurity threats, we conduct the following activities at various intervals during the year, which vary in maturity across our business: • Regular network and endpoint monitoring; •24x7 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;


text: • Role-based access controls to identify, authenticate and authorize individuals to access systems based on their job responsibilities; • Business resiliency planning with disaster recovery and business continuity testing; • Testing of new products and services and major changes to existing products and services to identify potential security vulnerabilities before release; • Protection, including encryption, for the secure communication of sensitive data; • Regular, proactive privacy and cybersecurity reviews of systems and applications, including third-party security practices; • Auditing of applicable data policies; • Regular internal and external security audits and penetration tests by third-party security vendors, as well as internal offensive team penetration testing; • At least annual security awareness training and testing of our employees; and • Monitoring emerging laws and regulations related to data protection and information security and implementing appropriate changes.


text: We have implemented incident response processes that focus on preparation for a cybersecurity incident; detection and analysis of a security incident; containment, eradication, and recovery; and post-incident analysis. Our program is designed to evaluate, rank by severity and prioritize response and remediation of security events and data incidents. Incidents are evaluated to determine operational and business impact, as well as privacy considerations. We also conduct tabletop exercises to simulate responses to cybersecurity incidents and evaluate the effectiveness of our incident response systems. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation, and remediation strategies. We maintain controls and procedures that are designed to promote prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Audit Committee of our Board in a timely manner.


text: As part of our risk management program, we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting our systems and the data entrusted to us.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the primary oversight of risks from cybersecurity threats. Members of the Audit Committee receive quarterly updates from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy officers.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our enterprise operations, compliance, and legal teams, including our Chief Information Officer and Chief Legal Officer. Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Our cybersecurity program is an enterprise-wide, risk-based program that is designed to support the security, confidentiality, integrity, and availability of our systems and information. We conduct periodic assessments of the cybersecurity program to identify and manage material cybersecurity threats and risks using internal teams and independent third parties. The assessment results are used to develop appropriate cybersecurity controls best practices and risk mitigation strategies, which are then implemented throughout the Company.

companyName: Howard Hughes Corp


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.


text: We employ a range of tools and strategies to mitigate cybersecurity risks, regularly testing them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan that is kept within our written information security program (WISP). Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of a similar size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.


text: Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual suspected security incident, executing the Company's WISP.


text: HHH's Board of Directors recently formed a technology committee (the Technology Committee) to assume governance and oversight of our cybersecurity program from HHH's Audit Committee. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the HHH Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform HHH's Board of Directors on important matters. Furthermore, HHH's Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.


text: Risk Management Strategy. Our cybersecurity program is focused on the following key areas: • Governance. As discussed in more detail below under "Board Oversight of Cybersecurity Risks," the Board's oversight of cybersecurity risk management is supported by the Audit Committee and Compliance and Quality Committee, each of which regularly interacts with the Company's enterprise risk management function, our Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO"), Chief Legal Officer ("CLO"), and Chief Ethics, Compliance and Risk Officer together with other members of management with responsibility for risk management and cybersecurity. • Collaborative Approach. We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: agilon health, inc.

ticker: AGL


text: Processes and Risks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We maintain processes for identifying, assessing and managing material risks from cybersecurity threats including: • Ongoing development of our understanding of cybersecurity risk and its impact our systems, data, employees and capabilities through assessment of business context of information security, cybersecurity access management, information security governance and risk management strategy such as vulnerability assessments. • Ongoing development and implementation of appropriate technical safeguards to ensure delivery of critical infrastructure services through access control, awareness and training, data security, information protection policies and procedures, proactive maintenance and protective technology such as firewalls, intrusion prevention and detection systems, and anti-malware functionality. • Ongoing development and implementation of appropriate activities to identify the potential occurrence of a cybersecurity event and actions necessary to address a detected cybersecurity event through anomaly and event detection, continuous monitoring of information security and ongoing detection processes. • Ongoing development and implementation of appropriate activities necessary to address a potential detected cybersecurity event through incident response planning, communications, analysis and mitigation. We regularly assess and test our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. • Ongoing development and implementation of appropriate activities to maintain plans for cybersecurity resilience, remediation of the effects of a potential cybersecurity event and restoration of any capabilities that could be potentially impaired due to a cybersecurity event through incident recovery planning and communications preparedness.


text: Our processes for identifying, assessing and managing material risks from cybersecurity threats are integrated into our overall risk management systems and processes and include cybersecurity risk assessment surveys, interviews of our personnel responsible for cybersecurity and ongoing development of cybersecurity risk mitigation plans based on program assessment.


text: We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The risks from cybersecurity threats have not to date materially affected us or not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in the healthcare industry that handle protected health information and companies in all industries that rely on technology to run their operations, a material cybersecurity incident could potentially impact our results of operations and financial condition.


text: Cyber Governance Board Oversight of Cybersecurity Risks. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our Board, Audit Committee, and Compliance and Quality Committee provide oversight of risks from cybersecurity threats through the following activities: • Cybersecurity risk governance including high-level guidance and oversight for us gleaned from each Director's extensive senior level operational management experience; and assessment of whether risks are being appropriately considered, evaluated and managed by management. • Oversight of cybersecurity risk ownership through assessment of our requirements and resources; and identification and evaluation of cybersecurity risks impacting our business. • Oversight of our cybersecurity risk mitigation operations through deployment of information technology, assessment of our cybersecurity risk management framework and review of our programs to meet business requirements. • Our Board, Audit Committee, and Compliance and Quality Committee receive regular presentations and reports on cybersecurity risks from management that address a wide range of topics, including: • recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technical trends and information security considerations arising with respect to our peers and third parties; • integrating cybersecurity oversight into the work of the Board, Audit Committee and Compliance and Quality Committee, allocating oversight responsibilities and leveraging Director skill sets; and • the role of the Board, Audit Committee, and Compliance and Quality Committee in potential incident response and recovery. • Oversight of the management of vendor and third-party service provider cybersecurity risks. • Oversight of data governance, automated intelligence and machine learning as applied to the Company's operations. • The Board, Audit Committee, and Compliance and Quality Committee, also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Role in Cybersecurity Risk Management. Our management is responsible for assessing and managing our material risks from cybersecurity threats. The CISO, CTO, and Chief Ethics, Compliance and Risk Officer work collaboratively across the company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CTO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and Compliance and Quality Committee when appropriate.


text: • Our CTO and CISO lead our management of cybersecurity risks. Our CTO and CISO have a combined over 50 years of experience in managing large company technology operations and extensive expertise in the management of cybersecurity defense. • The CTO holds an undergraduate degree in computer science and a master's degree in business administration and has served in various roles in information technology for over 27 years, including serving as either the Chief Technology Officer or Chief Information Officer of large companies. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of large companies. The CISO holds a CISSP certification and spent several years in law enforcement addressing computer crimes. • Our technology group management uses numerous processes to become informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Management regularly reviews the Company's cybersecurity risk management program with the Board, Audit Committee and Compliance and Quality Committee.


text: We have established information security protocols aimed at the identification, assessment, and management of significant cybersecurity risks that could impact our vital information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate cybersecurity risks, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence review, as well as internal and external assessments.

companyName: ONITY GROUP INC.

ticker: ONIT


text: To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs.


text: These aforementioned security measures are integrated into our broader enterprise risk management strategies. Cybersecurity risks identified through the processes described above under Item 1. Business - Risk Management are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are regularly reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these services have included external penetration testing, audit services, legal counsel, threat intelligence, forensic investigation, and managed security service providers.


text: In addition, we have processes in place for assessing and managing risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information they access. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider. We monitor third-party risks through due diligence questionnaires and periodic assessments, and we track the status of reported risks within our centralized risk governance framework.


text: In 2023 and 2024, cybersecurity incidents have occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. We cannot assure that future incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations."


text: Our Board of Directors addresses the Ocwen's cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Ocwen's overall risk management processes, including cybersecurity-related risks, and receives regular updates from the Chief Information Security Officer (CISO) concerning Ocwen's significant cybersecurity threats and the processes Ocwen has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity posture, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor's Degree in Computer Engineering and Master's Degree in Computer Science, our CISO holds a Bachelor's Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Ocwen executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.


text: Cybersecurity-related risk events are reported to Ocwen's Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Ocwen, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.


text: In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt mitigation of cybersecurity incidents and facilitate the notification of appropriate stakeholders.


text: Our information security program is led by our chief information security officer ("CISO"), who has over 25 years of experience in technology management, has 8 years of banking experience, and is a certified information systems security professional. The CISO oversees our "information security team" within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents. In addition to our information security team, we also employ an IT risk and compliance director who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators ("KRIs"), including KRIs related to cyber risks. Both our CISO and our IT risk and compliance director report to our chief information officer ("CIO"), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: As part of our information security program, we undertake efforts to monitor new and emerging risks and evaluate the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing (including penetration testing), incident response exercises, maturity assessments, and industry benchmarking. In connection with these efforts, we use, on an as-needed basis, certain third-parties, including auditors, consultants, and others, that have particular cyber expertise.


text: We also maintain multiple groups that help oversee risks associated with our third-party service providers. These groups include (1) our third-party risk management department, which facilitates reviews of certain third parties by our assurance providers, including our information security and business continuity teams, (2) our vendor council, which reviews contractual terms (including, at times, terms related to confidentiality and data protection) for certain third-party relationships, and (3) our architecture review board, which reviews certain new business initiatives that may impact the Company's technical and/or security architecture.


text: Our information security program is one component of our broader enterprise risk management program. As such, KRIs related to cyber risk (which are a subset of operational risk KRIs) are reported to, and overseen and monitored by, our enterprise risk management committee, which is comprised of senior executives of the Company. Additionally, we maintain an incident response framework that details the applicable teams, their functions, and guidelines when a cybersecurity incident occurs. The framework is designed to cover significant aspects of the incident including detection, containment, remediation, and post incident analysis. Various groups of senior executives help oversee responses to security incidents, including the data loss prevention team, the core computer security incident response team, and the extended computer security incident response team.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor "Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impact on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us." in "Item 1A. Risk Factors" of this Form 10-K for more information.


text: Our board of directors is aware of, and takes seriously, the importance of overseeing risks associated with cybersecurity threats. Senior management has provided the board of directors with cybersecurity information, as well as incident response training. Additionally, employees have received training related to cybersecurity. Cyber risks are incorporated into risk appetite metrics for operational risk and presented to and reviewed by the risk committee of the board of directors. Additionally, the audit committee of the board of directors receives and reviews internal audit reports concerning, among other things, matters related to information security. Furthermore, the board of directors of Simmons Bank, the Company's primary operating subsidiary, has established an information technology committee ("IT Committee") that receives regular reports from the CISO and CIO concerning our information security program and cybersecurity matters. The CIO also reports IT KRIs, including those related to cyber risks, to the IT Committee. Significant security incidents are also reported by senior management to the IT Committee or its chairman, when warranted. The IT Committee chairman provides reports of the committee's activities to the board of directors of Simmons Bank. The Company's board of directors, or the board of directors of Simmons Bank (as applicable), also approves information security-related policies, including the Acceptable Use Policy, Information Security Policy, IT Ransomware Policy, and Business Continuity Management Policy.


text: With respect to internal management, the CISO and CIO meet regularly to discuss the activities and operations of the information security team, and the CIO holds regular meetings with our chief executive officer to discuss cyber related matters, information technology issues, and cybersecurity threats. To enhance awareness, monitoring, and oversight of cybersecurity risks, management also uses the following internal committees (in addition to the enterprise risk management committee discussed above): (1) the IT strategy and investment committee, which is comprised of senior executives and helps provide oversight of the investment and strategic direction for the Company's IT function, (2) the IT steering committee, which is comprised of leaders from various business units and helps provide oversight and direction for inter- and intra-departmental IT related initiatives, and (3) the vulnerability management working group, which is comprised of IT leaders and helps establish appropriate roles, responsibilities, and escalation paths to resolve department and enterprise vulnerabilities within service level agreements.


text: Overview of Cybersecurity Risk Management The Company maintains a cybersecurity program that is designed to identify, prevent, detect, respond to, and recover from cybersecurity threats, and protect the confidentiality, integrity, and availability of our information technology, including the information residing on such systems. The Company has a dedicated Chief Information Security Officer (CISO) with overall responsibility for developing and implementing the global cyber strategy, risk management, and operational initiatives. The Company leverages recognized cybersecurity frameworks to organize, improve, and assess its cybersecurity program and to manage and reduce cybersecurity risk. The global information security team, under the direction of the CISO, develops, implements, and manages cybersecurity-related internal controls and risk processes for the Company, with internal controls consisting of a mix of administrative, technical, and physical controls.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We deploy, configure, and maintain numerous technologies to enforce security policies, detect and protect against cybersecurity threats, and help safeguard the Company's information systems and assets. We operate a Security Operation Center (SOC) to monitor cybersecurity threats, coordinate incident response resources, and reduce response times. Our internal SOC team is augmented by a third-party managed security services provider. The Company maintains a cybersecurity incident response plan that provides a structured approach for the Company's response to cybersecurity incidents. Under the plan, cybersecurity incidents are escalated based on a defined incident severity scale, including to the Board of Directors as appropriate. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises multiple times throughout the year. These exercises are conducted by internal team members and in some instances with assistance from third-party experts. The Company's cybersecurity program also includes regular cybersecurity trainings for staff. We actively evaluate the training effectiveness and adjust the trainings based on the evaluations.


text: The Company's cybersecurity program is periodically reviewed and adjusted by the CISO's office so that it can remain flexible and responsive as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Engagement of Third Parties We engage third-party cybersecurity consultants and experts to supplement staffing of our SOC as well as to assess, validate, and enhance our security practices, including conducting cybersecurity maturity assessments, vulnerability assessments, and penetration tests. As part of the incident response process described above, we engage third-party experts as needed to support the incident response team, such as external legal advisors, cybersecurity forensic firms, and other specialists.


text: Third Party Service Provider Risk Management Vendor risk assessment is part of the Company's cybersecurity program, which facilitates management of third-party service providers' IT-related risks. Third-party service providers that have access to the Company's network, data and information are subject to a cybersecurity due diligence process and the corresponding security control requirements based on the nature of the engagement. The vendor risk assessment process is reviewed at least annually.


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on SEE's risks relating to our technologies, systems, and networks.


text: Governance of Cybersecurity Risk Management The Board of Directors has oversight responsibility for our risk management programs, including cybersecurity risk management. The Board of Directors has delegated the specific responsibility of cybersecurity risk oversight to the Audit Committee, although the Board remains actively involved in overseeing cybersecurity risk management, both through presentations given by management during Board meetings, as well as through regular reports from the Audit Committee on its cybersecurity risk oversight activities.


text: Our Chief Information Officer (CIO) and CISO provide cybersecurity updates to the Audit Committee three times each year and the Board at least annually. These updates cover various topics, including information relating to cybersecurity strategy, program management, and performance trends. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee and the Board of Directors.