text: We utilize an internal global incident management team, comprised of executive and senior management-level personnel, that is responsible for oversight of our business resiliency and cybersecurity incident response programs. Within our information security organization, our cybersecurity incident response team works closely with the business resiliency team across business continuity, disaster recovery, and crisis management functions to plan, prepare, and practice response to simulated cybersecurity incident scenarios for response readiness. In the event of a cybersecurity incident, our incident response team would assess whether to engage the support of law enforcement or other third parties. In addition to our cybersecurity incident response team, we have retainers with leading incident response organizations to augment response activities, if needed. We also conduct one or more annual cybersecurity incident response tabletop exercises with senior management and third-party experts to test our incident response plan and enhance our readiness for a potential cybersecurity incident.


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls, and additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.

companyName: Unum Group

ticker: UNM

secItem: Item 1C


text: Cybersecurity risks associated with third-party service providers are managed in accordance with our Third-Party Risk Management (TPRM) program. Components of this program include cybersecurity due diligence and review of contractual terms with third parties that access our network or sensitive information. The TPRM program works to conduct appropriate review of all new third parties and performs ongoing monitoring of our existing relationships based on the risk presented by the third party.


text: As part of our cybersecurity program, we perform an annual cybersecurity risk assessment to evaluate our cybersecurity program and related controls. The cybersecurity risk assessment follows the guidelines published by the National Institute of Standards and Technology, which are aimed at identifying and determining the potential impact of threats and vulnerabilities and assessing the controls in place to mitigate those threats and vulnerabilities. Risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, operations, or financial condition.


text: Management's role in assessing and managing cybersecurity risks is led by our Chief Information Security Officer (CISO), who is a senior vice president and officer of the Company. As of the date of this report, our CISO has over twenty years of experience in information security leadership, including leading threat and vulnerability management, cybersecurity operations and cybersecurity defense, cybersecurity incident response, and technology risk management. He holds a bachelor's degree in computer science and several professional qualifications, including Certified Information Systems Security Professional and Information Systems Security Management Professional. The responsibilities of prevention, detection, mitigation, and remediation of cybersecurity incidents are allocated across the CISO's organization, and each organizational unit reports risks and incidents to the CISO, who in turn informs other senior management of cybersecurity incidents that may be material to the company.


text: Our cybersecurity program is overseen by the Information Security Committee (ISC), a cross-functional management committee whose membership include the CISO, Chief Risk Officer (CRO), Chief Technology Officer, Chief Compliance Officer, and others. Members of the ISC possess substantial experience in risk management, finance, and information security. The ISC is responsible for ensuring that the cybersecurity strategy and program align with our overall risk strategy. Our TPRM program is overseen by the Corporate Operational Risk Committee (CORC), a cross-functional management team whose membership includes leaders from our third-party risk management, corporate services, compliance, sourcing, information technology, and business resiliency teams. The CORC is responsible for ensuring risks to our non-insurance operational functions, including those related to third-party vendors, are identified and managed within our risk appetite, and that our TPRM program and strategy align with our overall business objectives.


text: The CORC and the ISC both report risks to our Executive Risk Management Committee (ERMC), which is comprised of senior management from our corporate functions and business segments and is responsible for overseeing our enterprise-wide risk management program. The ERMC is chaired by the CRO, who maintains a direct line of communication with the Risk and Finance Committee (RFC) of our board of directors.


text: The RFC is the board committee that oversees our cybersecurity risk management. Our CISO makes quarterly reports to the RFC about material cybersecurity risks, updates to the cybersecurity program, metrics that evaluate the effectiveness of the cybersecurity program, material cybersecurity incidents and remediation plans. The RFC also receives timely reports from the CISO when there are significant cybersecurity incidents or updates to the cybersecurity risk assessment. The board of directors also takes an active role in overseeing cybersecurity risk, including receiving an annual report from the CISO that provides an overview of the status and effectiveness of our cybersecurity risk management program and participating in cybersecurity incident response tabletop exercises.


text: See "Quantitative and Qualitative Disclosures About Market Risk" contained herein in Item 7A for further information. Also see "Risk Factors" included in Item 1A for additional information regarding cybersecurity risk.


text: We take our responsibility for the privacy and security of the information our customers share with us seriously. Through our cybersecurity program, we constantly watch for threats to our systems and make real-time adjustments to our defenses to protect customer data and minimize service disruptions.


text: We identify and assess cybersecurity risks on an ongoing basis by maintaining a cybersecurity program that involves a defense-in-depth approach with multiple layers of security controls to protect our environment. We have invested in and deployed a security operating model involving people, processes, and technology that is designed to protect against potential and known cybersecurity risks and threats. Our cybersecurity program involves collaboration with partners, including financial industry groups, to understand and incorporate best practices and engage in cybersecurity threat intelligence sharing. Our security operations team includes internal threat hunters, such as cybersecurity engineers and analysts, who are working directly with third parties to monitor the threat landscape. Alerts from monitoring are analyzed by our security teams for preemptive engagement to avoid or minimize the impact of potential cyber threats. Additional cybersecurity tools are used to detect and block malicious attacks, as well as to govern identity and access management, in each case to avoid or minimize risks of unauthorized access to systems and data.


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls. Our internal audit organization also provides independent assurance of the cybersecurity program through related audit engagements to complement external assessments and reviews. Additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.


text: The safety and security of our customers and team members is our top priority. This includes working to put in place appropriate administrative, physical and technical cybersecurity safeguards to help protect our assets that keep our operation running and securely store the information in our care. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information.

companyName: AMERICAN AIRLINES, INC.


text: We have created, and assess our program against, an integrated cybersecurity framework using various National Institute of Standards and Technology (NIST) security standards, guidelines and best practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use various NIST security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is overseen by our Executive Cybersecurity Risk Group (ECRG) which is comprised of our Chief Digital and Information Officer (CDIO), Chief Financial Officer and Chief Legal Officer. The ECRG, working with our Chief Information Security Officer (CISO), assists the Board of Directors and our senior leadership team in fulfilling their responsibilities for cybersecurity governance, approval and oversight through the periodic reporting and review of security strategy and risk management practices. Our cybersecurity risk management program is integrated into our overall risk management processes and shares common reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk governance programs.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, (3) vulnerability management program and (4) detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • policies, procedures and standards that are utilized to outline expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical IT service providers, suppliers, and vendors.


text: We are constantly assessing our environment for cybersecurity threats, and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. At the time of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. See Part I, Item 1A. Risk Factors – "Evolving cybersecurity and data privacy requirements (in particular, compliance with applicable federal, state and foreign laws relating to handling of personal information about individuals) could increase our costs, and any significant cybersecurity or data privacy incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition."


text: Our Board of Directors consider cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives periodic briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel, internal security staff, external counsel or external experts, as part of the Board of Director's continuing education on topics that impact public companies.


text: Our management team, including our CDIO, CISO, Vice President and Deputy General Counsel – Chief Privacy and Data Protection Officer, Vice President of Infrastructure and Operations and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our management team has extensive information technology experience, as well as cybersecurity incident response, compliance, oversight, and program management experience. Additionally, certain leaders and personnel within the cybersecurity organization hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other various sources including external consultants engaged by us.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, (3) vulnerability management program and (4) detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • policies, procedures and standards that are utilized to outline expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical information technology service providers, suppliers, and vendors.


text: We are constantly assessing our environment for cybersecurity threats, and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. At the time of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. See Part I, Item 1A. Risk Factors – "Evolving data privacy requirements (in particular, compliance with applicable federal, state and foreign laws relating to handling of personal information about individuals) could increase our costs, and any significant data privacy incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition."


text: Our Board of Directors consider cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives periodic briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel, internal security staff, external counsel or external experts, as part of the Board of Director's continuing education on topics that impact public companies.


text: Our management team, including our CDIO, CISO, Vice President and Deputy General Counsel – Chief Privacy and Data Protection Officer and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our management team has extensive information technology experience, as well as cybersecurity incident response, compliance, oversight, and program management experience. Additionally, certain leaders and personnel within the cybersecurity organization hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: As part of our enterprise security program, we perform risk assessments relating to cybersecurity and technology risks. Our enterprise security program has been developed based on industry standards, including those published by the International Organization for Standardization (ISO) and the National Institute of Standards and Technology. The program includes a comprehensive set of enterprise security policies and procedures that guide our protection strategy. Our policies, procedures and practices include, but are not limited to: • identifying critical assets and high-risk threats and analyzing identified risks to determine the potential impact on the organization and the likelihood of occurrence; • cybersecurity detection, controls and remediation practices, including vulnerability assessments, penetration testing and tabletop exercises; • an incident response and recovery plan that includes escalation protocols, procedures for containment of incidents and investigation and remediation procedures; • installation of and regular updates to antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems; • conducting regular workforce trainings for employees to identify cybersecurity concerns and educate employees on potential risks and best practices; • evaluating the effectiveness of our program by performing internal assessments; • periodic external audits by an independent third party to test for the adequacy of, and compliance with, controls and standards; and • regular collaboration with leading global security providers, intelligence and law enforcement communities and industry peers to exchange information on trends and best practices in order to address new and evolving cybersecurity risks.

companyName: ANALOG DEVICES INC

ticker: ADI


text: We have in place a third-party risk management program to evaluate the cyber postures of our critical partners' who handle the Company's sensitive data in order to identify, monitor and address material cybersecurity risks that may arise from such third-party relationships.


text: While we have experienced cybersecurity incidents in the past, in the last three years we have not experienced any cybersecurity incidents that have materially affected or are currently viewed as reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our enterprise security program will be effective in preventing material cybersecurity incidents in the future.


text: See the risk factor titled "Our computer systems and networks are subject to attempted security breaches and other cyber incidents and a significant disruption in, or breach in security of, our information technology systems or certain products could materially and adversely affect our business or reputation." in Risk Factors in Part I, Item 1A of this Annual Report on Form 10-K for further information.


text: Management is responsible for assessing and managing our day-to-day risks and control systems, and our Board is responsible for overseeing our enterprise risk management programs as a whole. The Board has delegated the oversight of cybersecurity risk assessment and management to the audit committee. As reflected in its charter, the audit committee is responsible for overseeing and reviewing the Company's cybersecurity and information security programs, practices and risk mitigation efforts. The audit committee receives quarterly reports on cybersecurity risks, or more frequent reports if circumstances dictate.


text: We have established a cross-functional Cybersecurity Steering Committee, comprised of our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other senior management. The Cybersecurity Steering Committee is charged with overseeing the management of our enterprise security program, including reviewing and prioritizing cybersecurity risks, monitoring potential incidents, establishing key mitigation initiatives, overseeing cybersecurity governance and promoting and supporting cybersecurity best practices. The Cybersecurity Steering Committee is chaired by our CISO, who reports to our CIO. Both our CISO and our CIO have extensive experience in assessing and managing cybersecurity programs and risk management through serving in various senior roles in information technology and cybersecurity, serving on external Boards of Directors and holding multiple industry-recognized certifications.


text: The prevention, detection, mitigation and remediation of cybersecurity incidents is accomplished pursuant to various policies, procedures and processes, including our incident response and recovery plan and the other elements of our enterprise security program described above under "Risk Management and Strategy." These measures include escalation protocols through which the Cybersecurity Steering Committee is informed about cybersecurity and incidents by our CISO. As part of our enterprise security program, we have communication processes enabled for employees to identify and report threats or potential vulnerabilities.


text: Our CIO and CISO provide regular updates to the full Board on the performance of, and enhancements to, key information technology projects, our enterprise security program and risk mitigation efforts, including relevant findings of the Cybersecurity Steering Committee. The full Board also receives updates from the audit committee. In addition, there are protocols in place for immediate escalation in the event of any cybersecurity issues or developments that may require consideration between regularly scheduled audit committee or Board meetings. Our internal audit team also provides regular updates to the audit committee on the performance of our enterprise security program from an internal audit perspective. In addition, our Chief Compliance and Risk Officer, who oversees our overall enterprise risk management and compliance programs and chairs our Enterprise Risk Management Committee, provides regular reports to the full Board, including periodic updates on risk management.


text: We have in place a third-party risk management program to evaluate the cyber postures of our critical partners who handle the Company's sensitive data in order to identify, monitor and address material cybersecurity risks that may arise from such third-party relationships.


text: We have established a cross-functional Cybersecurity Steering Committee, comprised of our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other senior management. The Cybersecurity Steering Committee is charged with overseeing the management of our enterprise security program, including reviewing and prioritizing cybersecurity risks, monitoring potential incidents, establishing key mitigation initiatives, overseeing cybersecurity governance and promoting and supporting cybersecurity best practices. The Cybersecurity Steering Committee is chaired by our CISO. Both our CISO and our CIO have extensive experience in assessing and managing cybersecurity programs and risk management through serving in various senior roles in information technology and cybersecurity and holding multiple industry-recognized certifications.


text: We recognize the critical importance of maintaining the confidentiality, integrity and availability of our information systems and data, and of effectively, assessing, identifying and managing cybersecurity and related risks. Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk, and it is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee (a committee comprised of primary corporate functions) and our Board of Directors. The underlying controls for the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) and the Center for Internet Security Benchmark (CIS).

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Our cyber risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties, as appropriate. Under the plan, a Cybersecurity Intake Team (CIT), which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.


text: Third party vendors and suppliers also play a role in our cyber risk management program. In circumstances where such third parties will access our systems and data, our SDIS participates in the vendor management process, including the review of contractual requirements and contractually imposing obligations on the vendor to report cybersecurity incidents to us so that we can assess the impact. In addition to the incident response plan and vendor management process, our cyber risk management program includes: • an information technology and cybersecurity training program, and ongoing employee testing to evaluate the effectiveness of quarterly internal training and awareness communications; • external advisors to assist with cybersecurity risk assessment, including third-party monitoring of the Company's systems, external network penetration testing, and yearly cyber event preparedness exercises; • development of strategies to mitigate cyber risks; • crisis management, business continuity, and disaster recovery plans.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect on our operations or financial standing.


text: Notwithstanding the efforts we take to manage our cybersecurity risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Within our organization, our CIO, who reports to our CEO, oversees our cybersecurity function. Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom. Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries. The SDIS maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications and holds a degree in information technology management.


text: Board's Role in Oversight Our full Board oversees our cyber risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program. At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks. In the event of a material cybersecurity incident, the Board would receive prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed. Cybersecurity-related risks are included in the Enterprise Risk Management committee's evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.


text: We recognize the critical importance of maintaining the confidentiality, integrity and availability of our information systems and data, and of effectively assessing, identifying and managing cybersecurity and related risks. Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk. It is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee, and our Board of Directors (Board). The underlying controls for the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology and the Center for Internet Security Benchmark.


text: Our cybersecurity risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties, as appropriate. Under the plan, a Cybersecurity Intake Team, which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.


text: Third party vendors and suppliers also play a role in our cybersecurity risk management program. In circumstances where such third parties will access our systems and data, our SDIS participates in the vendor management process, including the review of contractual requirements and contractually imposing obligations on the vendor to report cybersecurity incidents to us so that we can assess the impact. In addition to the incident response plan and vendor management process, our cybersecurity risk management program includes: • an information technology and cybersecurity training program, and ongoing employee testing to evaluate the effectiveness of quarterly internal training and awareness communications; • external advisors to assist with cybersecurity risk assessment, including third-party monitoring of the Company's systems, external network penetration testing, and yearly cyber event preparedness exercises; • development of strategies to mitigate cyber risks; and, • crisis management, business continuity, and disaster recovery plans.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect or are reasonably likely to have a material effect on our business strategy, operations or financial condition.


text: Within our organization, our CIO, who reports to our CEO, oversees cybersecurity. Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom. Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries. The SDIS maintains Certified Information Systems Security Professional and Certified Information Security Manager certifications and holds a degree in information technology management.


text: Board's Role in Oversight Our Board oversees our cybersecurity risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program. At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks. In the event of a material cybersecurity incident, the Board would receive prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed. Cybersecurity-related risks are included in the Enterprise Risk Management committee's evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.


text: We depend on integrated information systems to conduct our business. In order to defend against cybersecurity threats, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The frameworks used to design and assess our program include the National Institute of Standards and Technology Cybersecurity Framework and Sarbanes Oxley. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • tabletop exercises conducted at the management level to ensure the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cyber security incident response and risk management programs; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, cybersecurity resilience and recovery; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives a periodic update. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Vice-President of Information Technology ("VPIT") and our Director - Information Security ("DIS") or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our VPIT and DIS has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes extensive technology and finance leadership experience across multiple industries, experience in the Legal, Risk and Compliance disciplines, and over 20 years of cybersecurity leadership experience for our VPIT.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We depend on integrated information systems to conduct our business. In order to defend against cybersecurity threats, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The frameworks used to design and assess our program include the National Institute of Standards and Technology Cybersecurity Framework and The Sarbanes-Oxley Act of 2002. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise enhance our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • tabletop exercises conducted at the management level to ensure the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cyber security incident response and risk management programs; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, cybersecurity resilience and recovery; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, our operations, business strategy, results of operations, or financial condition. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors".


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives periodic updates. In addition, management updates the Audit Committee, as necessary, regarding any material or significant cybersecurity incidents.


text: Our management team, including our VPIT and DIS, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes extensive technology and finance leadership experience across multiple industries, experience in the Legal, Risk and Compliance disciplines, and over 20 years of cybersecurity leadership experience for our VPIT.


text: The Company has a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the risk landscape. ADM's cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by independent third-party auditors. The multifaceted nature of the Company's cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. The Company has established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which include the completion of due diligence before engaging with any third party, controls for response to mitigate any significant risks, and assessments and reviews during the course of the relationship. Additionally, the Company has ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: The Company has seen an increase in cyberattack volume, frequency, and sophistication. ADM seeks to detect and investigate unauthorized attempts and attacks against its network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to the Company's internal processes and tools; however, ADM remains potentially vulnerable to known or unknown threats. The Company's cyber incident response plan includes an escalation process if a cybersecurity incident meets specific rating criteria to trigger swift and effective action designed to minimize potential disruptions and protect the integrity of our operations. The Company also conducts periodic cybersecurity scenarios with senior management to enhance preparedness.


text: The Board of Directors has oversight of cybersecurity risk, which it manages as part of the ERM program. The Board of Directors is assisted by the Audit Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable. In recent years, the Board added a director who had served as Chief Information Officer for a large public company with sensitive information to assist the Board and Audit Committee in overseeing cybersecurity risks.


text: The Company's cybersecurity program is led by the Chief Information Security Officer (CISO), who reports to the Senior Vice President and Chief Technology Officer (CTO). The CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom hold cybersecurity certifications in Information Systems Security or Information Security Management, and through the use of technological tools and software and results from third party audits. Additionally, the CISO directs the Global Information and Cyber Security Council (the "Council"), which includes a diverse range of relevant experts. The Council includes management from global technology, compliance, privacy, controlling, operations, security, automation, ERM, and internal audit. The Council promotes alignment and communication of new and ongoing cybersecurity prevention techniques and provides a forum for staying current on the latest cybersecurity threats.


text: The CISO and CTO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. The CISO has served in that position since 2018 and, was previously the Vice President, Head of Enterprise Security, Americas at Worldpay and a Security Principal/Strategist for Hewlett Packard Enterprises for a combined cybersecurity experience of 20 years. The CTO joined ADM in 2016 and was previously Senior Vice President and Chief Information Officer at Dow Corning Corporation for approximately 6 years.


text: The Company faces significant and persistent cybersecurity risks due to: the breadth of geographies, networks, and systems ADM must defend against cybersecurity attacks such as exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats; the attractiveness of the Company's systems and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on ADM or its customers; the substantial level of harm that could occur to the Company and its customers in case of a material cybersecurity incident; and ADM's use of third-party products, services and components. During the year ended December 31, 2024, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the Company, including its business strategy, results of operations, or financial condition. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving. For more information on the Company's cybersecurity risks, refer to Item 1A. Risk Factors. ADM is committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the Company assess, identify, and manage these risks.


text: Cybersecurity risks are included in the risk universe that the Company's Enterprise Risk Management (ERM) function evaluates, with input from information security subject matter experts at the Company, to assess top risks to the enterprise. The ERM process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating cybersecurity risk into the overall ERM process in this manner assists the Company in identifying, assessing, and managing material cybersecurity risks.


text: ARCHER-DANIELS-MIDLAND COMPANY The Company has a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the risk landscape. ADM's cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by independent third-party auditors. The multifaceted nature of the Company's cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. The Company has established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which include the completion of due diligence before engaging with any third party, controls for response to mitigate any significant risks, and assessments and reviews during the course of the relationship. Additionally, the Company has ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.


text: The Board of Directors has oversight of cybersecurity risk as part of the ERM program. The Board of Directors is assisted by the Sustainability and Technology Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors and the Audit Committee, which assists the Board in its oversight of the Company's ERM program. Cybersecurity reviews by the Sustainability and Technology Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable. In recent years, the Board added a director who had served as Chief Information Officer for a large public company with sensitive information to assist the Board and Sustainability and Technology Committee in overseeing cybersecurity risks.


text: The Company's cybersecurity program is led by the Chief Information Security Officer (CISO), who reports to the Senior Vice President and Chief Technology Officer (CTO). The CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom hold cybersecurity certifications in Information Systems Security or Information Security Management, and through the use of technological tools and software and results from third party audits. Additionally, the CISO directs the Global Information and Cyber Security Council (the "Council"), which includes a diverse range of relevant experts. The Council includes management from global technology, compliance, privacy, controlling, operations, security, automation, ERM, and internal audit. The Council promotes alignment and communication of new and ongoing cybersecurity prevention techniques and provides a forum for staying current on the latest cybersecurity threats. The CTO and CISO report information about such risks to the Board of Directors, the Sustainability and Technology Committee, or the Audit Committee during the regular cybersecurity reviews.


text: Rapidly evolving cyber techniques and increased cybersecurity threats against energy and critical infrastructure companies have raised the level of risk across our industry in recent years. Greater use of technology and digitization in operations has delivered benefits to our business, while also opening the industry to new vulnerabilities in corporate and operational systems. The energy industry remains subject to evolving cybersecurity threats and actors, including criminals, terrorists and nation states and through insiders and third-party breaches.

companyName: SOUTHWESTERN ENERGY CO


text: The scale, scope, and complexity of our business raises a multitude of interdependent risks, which can vary over time. A primary responsibility of our Executive Leadership Team ("ELT"), subject to oversight by our Board of Directors and specifically, our Audit Committee, is to design and implement rigorous processes to identify, prioritize, assess monitor, and manage enterprise-level risks, including any material risks associated with cybersecurity threats. Our Enterprise Risk Management ("ERM") team directly oversees the ERM process which incorporates input from personnel from different functions, levels, and operating regions (collectively, the "cross functional team") to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. Our Chief Financial Officer leads and oversees the ERM team with input from other ELT members and the cross-functional team. The ERM team meets at least quarterly to discuss key risks and to discuss mitigation strategies. The results of our ERM process are communicated to the Board at least annually.


text: Cybersecurity is recognized as a top enterprise risk and is managed by our Business Information Systems ("BIS") team, a cross-functional team, which is led by our Vice President of Business Information Systems ("VP of BIS"), which reports to the ERM team on a quarterly basis. The Audit Committee of the Board of Directors oversees cybersecurity risks and receives quarterly cybersecurity reports from our VP of BIS and conducts at least two in-depth cybersecurity discussions annually. Our VP of BIS has more than 35 years of experience in Information Technology, including cybersecurity leadership roles. Our Director of Information Security, who reports directly to the VP of BIS, has over 20 years of experience in Information Security Management and maintains Certified Information Security Manager ("CISM") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications.


text: As part of our cybersecurity incident response plan, we have also established a cybersecurity incident escalation process whereby potential cybersecurity incidents are identified, monitored, assessed, and escalated to our Cybersecurity Disclosure Committee ("CSDC"), as appropriate. The CSDC is comprised of members of our ELT and representatives from our Business Information Systems, including our VP of BIS, Accounting, Legal and Internal Audit departments. The CSDC assists in evaluating qualitative and quantitative factors related to the cybersecurity incident in order to assess the impact of such cybersecurity incidents and to disclose the incident should we determine that the cybersecurity incident is material. The Audit Committee or its designee will be made aware of material cybersecurity incidents in the event they occur.


text: Protection of our informational assets is managed by a comprehensive, multilayer strategy modeled on the National Institute of Standards and Technology ("NIST") cybersecurity framework, and combines assessments, technology, services, policies, and user education to detect, prevent, mitigate and remediate cybersecurity incidents and related risks. However, this does not imply that we meet any particular technical standards, specifications, or requirements. We have instituted cybersecurity-related policies and procedures, which are key components of our cyber defense and our efforts to protect employees and contractors, while encouraging partnerships only with responsible vendors who also invest in effective cybersecurity practices.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our data or our systems. Third-party risks are included within our ERM assessment program.


text: We conduct regular, proactive cybersecurity vulnerability assessments to identify opportunities for improvement and reduce exposure to cybersecurity incidents. We also conduct regular cyber incident simulations and undergo internal and external audits of our processes. We participate in industry organizations, engage third-party service providers, and maintain close working relationships with law enforcement agencies to help us identify and address the latest cybersecurity threats.


text: In addition, we participate in the Department of Homeland Security's Cyber Resilience Review ("CRR"), a voluntary, nontechnical assessment to evaluate an organization's operational resilience and cybersecurity practices. The CRR assesses enterprise programs and practices across a range of 10 domains, including risk management, incident management and service continuity.


text: To date, we have not experienced any material losses or interruptions relating to cybersecurity incidents; however, there can be no assurance that we will not suffer such losses in the future. For further discussion regarding cybersecurity risks and their impact on our business strategy, results of operations and financial condition, see the risk factor entitled "A cyber incident could result in information theft, data corruption, operational disruption and/or financial loss" under the heading " Risk Factors " in Item 1A of this Annual Report.


text: The Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation's overall approach to enterprise-wide risk management. The Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: As one of the elements of the Corporation's overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the heading "Governance," the ERC has delegated to senior management responsibility for managing the Information Security Program. Senior management carries out this mandate through the Operational Risk and Enterprise Risk Management Committees. To maintain alignment and appropriate insight regarding information security activities, an Information Security Steering Committee provides general program insight. • Collaborative Approach: The Corporation has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security organization oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense Center and the Incident Response Plan: The Corporation has a Security Operations Center, known as the "Cyber Defense Center," which provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. The Corporation's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled. • Third-Party Risk Management: Management of the Corporation's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Corporate Risk Management. The process provides awareness and collaboration across all internal teams including Information Security and Business Resumption. A Technical Requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. This process is aimed at advocating the necessary security, infrastructure, and application standards or controls so that information systems and the third party have recovery plans in place. • Security Awareness and Education: The Corporation provides annual, mandatory training for personnel regarding security awareness as a means to equip the Corporation's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Corporation's information security policies, standards, processes and practices.


text: The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Corporation conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Corporation with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Corporation adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.


text: The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, including the management of risks arising from cybersecurity threats. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation's approach to cybersecurity risk management with the Corporation's CISO.


text: The CISO, under the guidance of our CIO, CRO, CEO and General Counsel, works collaboratively across the Corporation to implement a program designed to protect the Corporation's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Corporation's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Corporation's cybersecurity risk management program, multidisciplinary teams throughout the Corporation are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the 2nd Line Information Security Risk Management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the ERC when appropriate.


text: The CISO has served in various roles in Information Technology and Information Security for over 35 years, including serving in a Chief Information Security Officer role of two large public companies, including Associated Bank for 17 years. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional Information Systems Audit and Control Association certification of Certified Information Security Manager in 2005. The CIO holds an undergraduate degree in business management, with a minor in international business, and is currently pursuing a master's degree in cybersecurity and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The CRO has over 30 years of banking experience, holds a degree in computer science, and earned the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The Corporation's CEO and General Counsel each hold degrees in their respective fields, and each has extensive experience managing risks at the Corporation and similar financial institutions, including risks arising from cybersecurity threats.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: The Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Cybersecurity Framework, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these guidelines and frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.


text: Among other things, the Information Security Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the heading "Governance," senior management carries out this mandate through the Operational Risk and Enterprise Risk Management Committees. To maintain alignment and appropriate insight regarding information security activities, an Information Security Steering Committee provides general program insight. • Collaborative Approach: The Corporation has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security organization oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense Center and the Incident Response Plan: The Corporation has a Security Operations Center, known as the "Cyber Defense Center," which provides continual security monitoring 24 hours per day, seven days per week, where resources deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. The Corporation's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures. • Third-Party Risk Management: Management of the Corporation's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Corporate Risk Management. • Security Awareness and Education: The Corporation provides annual, mandatory training for personnel regarding security awareness as a means to equip the Corporation's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Corporation's information security policies, standards, processes and practices.


text: The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation's environment, using vulnerability scanning tools, penetration testing, system management tools, and process and procedural reviews. The Corporation conducts a variety of assessments throughout the year, both internally and through third parties.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors — Operational Risks for additional disclosures with regard to the possible impact of future cybersecurity threats or incidents.


text: The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation's overall approach to enterprise-wide risk management. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation's approach to cybersecurity risk management with the Corporation's CISO.


text: The CISO, under the guidance of our CIO, CRO, Chief Executive Officer and General Counsel, works collaboratively across the Corporation to implement an information security program. To facilitate the success of the Corporation's cybersecurity risk management program, multidisciplinary teams throughout the Corporation are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the 2nd Line Information Security Risk Management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the ERC when appropriate.


text: The CISO has served in various roles in Information Technology and Information Security for over 35 years, including serving in the CISO role of two large public companies, including Associated Bank for 18 years. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional Information Systems Audit and Control Association certification of Certified Information Security Manager in 2005. The CIO holds an undergraduate degree in business management, with a minor in international business, and is currently pursuing a master's degree in cybersecurity and has served in various roles in information technology for over 40 years, including serving as either the Chief Technology Officer or CIO of four public companies. The CRO has over 30 years of banking experience, holds a degree in computer science, and earned the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The Corporation's Chief Executive Officer and General Counsel each hold degrees in their respective fields, and each has extensive experience managing risks at the Corporation and similar financial institutions, including risks arising from cybersecurity threats.


text: We recognize the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. This strategy is supported by both management and our Board of Directors.

companyName: ASTRONICS CORP

ticker: ATRO


text: We continuously strive to surpass industry best practices by implementing robust risk-based controls aimed at safeguarding both our partners' and the Company's information systems. In order to protect both commercial and defense-related businesses and support our production operations, the Company has adopted security principles in accordance with the National Institute of Standards and Technology Cybersecurity Framework, contractual requirements and other global standards. We conduct comprehensive annual security assessments, including external and internal penetration tests, social engineering attacks, and vulnerability assessments. These assessments provide critical insights into our security posture and help us identify and address potential weaknesses proactively. Leveraging the expertise of multiple vendors, we ensure a thorough evaluation from diverse perspectives, enhancing the effectiveness of our security measures. Furthermore, as we implement solutions, we engage with industry-leading partners to receive guidance on best practices for solution use and overall security. This collaboration ensures that our cybersecurity strategies align with the latest industry standards and best practices. We also maintain regular communication with external partners to stay abreast of current cybersecurity trends and emerging threats. This proactive approach enables us to continuously enhance our security posture and adapt our defenses to evolving cyber risks.


text: The Company's Director of Information Technology ("IT"), who reports to our CFO, has over 20 years of experience leading cyber security oversight and is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our IT security team, lead by the Director of IT, consists of professionals with broad cybersecurity experiences, including a number of cybersecurity certifications and degrees. Our cybersecurity initiatives benefit from a wealth of practical knowledge and strategic insight. The IT security teams' comprehensive understanding of industry best practices, combined with hands-on experience in implementing cybersecurity solutions, ensures that our networks and systems are effectively protected against emerging threats. As a result, cybersecurity remains a top priority across the organization, with resources allocated efficiently to mitigate risks and enhance our overall security posture.


text: The Board of Directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value. The Director of IT provides a report to the Board of Directors on an annual basis, or more frequently as needed, with respect to information security activity, security assessments, controls and investments.


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters. The Company's Incident Management Policy provides a framework for reporting and managing security incidents affecting the Company's information and business computing devices and systems, losses of information, and information security concerns. All users, including employees, contractors, consultants, suppliers, customers, government, and all personnel affiliated with third parties that perform work for the Company, are obligated to report information security incidents in order to mitigate the consequences and reduce the risk of future breaches of security. Our incident response process consists of several principal steps, including 1) preparation for a cybersecurity incident, 2) detection of a security incident and assignment to the appropriate IT personnel, 3) identification and preservation of evidence, and 4) risk assessment. Depending on the nature and severity of an incident, notifications are escalated to our CEO and the Board of Directors and, if determined to be material, externally. The incident management process is overseen by the Director of IT. The Company maintains additional policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, mobile devices and data destruction. These policies go through an internal review process and are approved by appropriate members of management.


text: Our IT security team reviews enterprise risk management-level cybersecurity risks annually. The following key risk elements are evaluated: • Insiders – Whether intentional or unintentional, individuals within our Company may cause damage to our systems. We have processes in place to seek to mitigate these threats, including but not limited to controls over access to our systems and access to network resources. • External threats – We recognize the risk that hackers, vandals, and saboteurs may seek to gain access to information contained in our systems. We employ multi-layered defense and continuous monitoring to seek to mitigate the risk associated with these threats. The Company also conducts regular periodic training of its employees as to the protection of sensitive information which includes security awareness training intended to prevent the success of "phishing" attacks. • Third-party risks – We also consider and evaluate cybersecurity risks associated with use of third-party service providers. User access to third-party systems is reviewed annually, and we obtain and review a System and Organization Controls (SOC) 1 or SOC 2 report from key third-party service providers. Key cybersecurity risks and mitigating responses are addressed within our Company-wide policies.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Our business and operations could be adversely impacted in the event of a failure of our information technology infrastructure or adversely impacted by a successful cyber-attack."


text: We continuously strive to surpass industry best practices by implementing risk-based controls aimed at safeguarding both our partners' and the Company's information systems. In order to protect both commercial and defense-related businesses and support our production operations, the Company has adopted security principles in accordance with the National Institute of Standards and Technology Cybersecurity Framework, contractual requirements and other global standards. We conduct annual security assessments, including external and internal penetration tests, social engineering attacks, and vulnerability assessments. These assessments provide critical insights into our security posture and help us identify and seek to address potential weaknesses proactively. We leverage multiple vendors and their diverse perspectives as means to enhance the effectiveness of our security measures. Furthermore, as we implement solutions, we engage with industry-leading partners to receive guidance on best practices for solution use and overall security. This collaboration seeks to align our cybersecurity strategies with the latest industry standards and best practices. We also maintain regular communication with external partners to stay abreast of current cybersecurity trends and emerging threats. This proactive approach enables us to seek to enhance our security posture and adapt our defenses to evolving cyber risks.


text: The Company's Director of Information Technology ("IT"), who reports to our CFO, has over 20 years of experience leading cyber security oversight and is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our IT security team, led by the Director of IT, consists of professionals with broad cybersecurity experiences, including a number of cybersecurity certifications and degrees. As a result, our IT security teams utilize their understanding of industry best practices and hands-on experience to seek to implement effective cybersecurity solutions. Cybersecurity remains a top priority across the organization, with resources allocated in an efficient manner to seek to mitigate risks and enhance our overall security posture.


text: The B oard of Directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value. The Director of IT provides a report to the Board of Directors on an annual basis, or more frequently as needed, with respect to information security activity, security assessments, controls and investments.


text: Our IT security team reviews enterprise risk management-level cybersecurity risks annually. The following key risk elements are evaluated: • Insiders – Whether intentional or unintentional, individuals within our Company may cause damage to our systems. We have processes in place to seek to mitigate these threats, including through controls over access to our systems and access to network resources. • External threats – We recognize the risk that hackers, vandals, and saboteurs may seek to gain access to information contained in our systems. We employ multi-layered defense and monitoring to seek to mitigate the risk associated with these threats. The Company also conducts regular periodic training of its employees as to the protection of sensitive information which includes security awareness training intended to prevent the success of "phishing" attacks. • Third-party risks – We also consider and evaluate cybersecurity risks associated with use of third-party service providers. User access to third-party systems is reviewed annually, and we obtain and review a System and Organization Controls ("SOC") 1 or SOC 2 report from key third-party service providers. Key cybersecurity risks and mitigating responses are addressed within our Company-wide policies.


text: At ADP, security is integral to our products, our business processes and infrastructure. We have an enterprise-wide approach to security with the objectives of protecting client data and funds, and preventing security incidents that could adversely affect the confidentiality, integrity, or availability of our information systems and data that resides in those systems, while also improving our system resilience with the aim of minimizing the impact to our business when incidents do occur.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff. We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees. As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.


text: ADP has implemented a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats. Our cybersecurity policies, processes, and standards are informed by industry practices and by industry frameworks and standards such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization for Standardization information security standards, including those standards for which we do not have a certification, but we do exercise judgment in selecting applicable controls from such framework or standards. Our cybersecurity program includes: • Technical Safeguards. We have implemented a layered approach to defend against cybersecurity threats. We periodically evaluate technical controls through application security assessments, vulnerability management, penetration testing, and security audits. • Incident Management and Response. A global team monitors our key applications and systems 24/7/365 to detect, investigate and respond to anomalies and incidents. This team addresses reported or detected issues by following a defined incident lifecycle and uses an incident management system to record facts, impact and remedial actions taken. We have established a cybersecurity incident response plan and escalation process, outlining processes for responding to incidents from identification to mitigation and notifying members of senior leadership, the board of directors and external advisors, as appropriate. We test our plans and processes through simulation exercises, scenario planning and tabletop exercises, using findings to improve processes. • External and Internal Assessments. We periodically engage assessors, consultants, auditors, and other third parties to evaluate our technology, security, and related controls and benchmark against industry practices. We engage in both internal and external assurance and audit activities across the company multiple times a year including an annual third-party review of our overall cybersecurity program. • Threat Intelligence. We maintain affiliations with cybercrime task forces and other third-party monitoring organizations. In addition, we collaborate with professional security organizations, law enforcement and technology companies to proactively identify malicious activity. • Business Resiliency Program. We have established a global, integrated business resiliency program designed to manage the impacts of technological, environmental, process and health risks on service delivery. This program uses an integrated framework that lays out our mitigation, preparedness, response and recovery process. • Third-Party Risk Management. We maintain a third-party risk management process, designed to identify and manage risks associated with our vendors and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement. We also seek to include security and privacy terms, where appropriate, in our contracts with third-party service providers that require third parties to maintain security controls to protect our data and notify us in the event of a cybersecurity incident.


text: • Security Awareness and Training Program. Our security training and awareness program is a continuous, dynamic initiative, designed to develop and maintain a security-focused culture and empower our associates to make responsible, secure decisions. As part of this awareness program, we communicate to our associates on a regular basis regarding key security topics and current events, best practices for addressing such cybersecurity threats, and gamification to reinforce effective behaviors. All associates are also required to take an annual, interactive security training program that includes an overview of key security topics, policies and responsibilities.


text: We have also integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting ADP, including cybersecurity risks. Our enterprise risk management team conducts a range of activities, including an annual enterprise risk management assessment.


text: We have been, and continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, and denial of service. Although we believe that we maintain a robust program of information security and controls and none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, results of operations, or financial condition, we cannot provide assurances that a cybersecurity incident will not materially affect us, or our business strategy, results of operations or financial condition in the future. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: A cross-functional, enterprise-wide management program operates to evaluate our global cybersecurity program's effectiveness and members of the company's executive committee, through an executive security council, routinely review strategy, policy, program effectiveness, standards enforcement and cyber issue management.


text: Our chief information security officer ("CISO") leads our global cybersecurity program and oversees the global cybersecurity services team, which is responsible for monitoring, identifying, assessing and managing cybersecurity threats across ADP. Our CISO reports to our chief security officer ("CSO"), who leads our global security organization and is responsible for cybersecurity, fraud prevention, operational risk management, client security management, and workforce protection. Our CSO has over 20 years of experience in a range of security roles, including serving as a chief security officer at another public company, and participates in various cyber security organizations. The current CISO has served in various roles in cybersecurity and information technology for over 25 years and has attained the professional certification of Certified Information Security Manager.


text: Our board of directors and our audit committee are actively engaged in the oversight of our global cybersecurity program. Our audit committee receives regular, quarterly reports on these matters from our CSO and leadership from our global product and technology organization, including on the status of projects to strengthen the company's cybersecurity systems and improve cyber readiness, as well as on existing and emerging threat landscapes. Concurrent and in addition to these reports, our chief administrative officer ("CAO") (who oversees legal, security and compliance matters) provides a legal, regulatory and ethics update at each meeting of the audit committee of our board of directors, which includes matters of cybersecurity, as appropriate. In addition, important actual or emerging cybersecurity events are communicated to the board of directors by our CAO and Chief Legal Officer, even if immaterial to us.


text: Our global cybersecurity program is subject to an annual third-party assessment overseen by our board of directors and this assessment reviews all aspects of our cyber program. Findings are reported to our board and, in response, ADP develops initiatives to improve our maturity across each of the pillars of the NIST Cybersecurity Framework. The status of these initiatives is then reviewed with our audit committee during its quarterly meetings. This governance process encourages an environment of continuous improvement. In advance of these quarterly meetings, members of our audit committee with cybersecurity expertise informally meet with our CAO, CSO, and other members of leadership, as appropriate, to advise and provide additional guidance and industry insights to the Company.


text: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors, our partners, and our employees, contractors and temporary staff. We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees. As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.