text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CISO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CISO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO. With over twenty years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Hilltop Holdings Inc.

ticker: HTH

secItem: Item 1C


text: Our CISO is responsible for our Information Security Program and our information security leaders report directly to our CISO. We also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management, our CISO and information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our Information Security strategy and program, and daily Security Operations.


text: Monitor Cybersecurity Incidents Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CISO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Cybersecurity Risk Management and Assessment Advanced Energy understands the importance of managing risks from cybersecurity threats and maintains a comprehensive cybersecurity program developed with reference to the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cybersecurity program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of our data. We devote significant resources to network, operations, and product security, data encryption, business continuity/disaster recovery, vulnerability management, event monitoring and incident response, and other measures to protect our systems and data from unauthorized external access or internal misuse, including, but not limited to, the following:

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Operational Security. Access to our systems is restricted to those who require access in accordance with the principle of least privilege. We also conduct background checks for our employees where permitted by local law, require signed confidentiality agreements and acceptable use agreements, and follow termination/access removal processes.


text: Employee Training. We provide all employees with annual training on information security, data protection, and relevant Company policies so that they are empowered to identify cybersecurity risks and take action. To further enhance awareness and responsiveness to potential threats, we also conduct regular phishing simulations and email communications on cybersecurity trends awareness throughout the year. Third Party Assessment. We engage independent third party consultants to review the effectiveness and maturity of our cybersecurity program.


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, operational personnel, and members of the Board of Directors.


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting key vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.


text: Risk Monitoring. Management and our Board monitor cybersecurity and data protection developments, including new or forthcoming changes to the legislative and regulatory landscape as well as Advanced Energy's cybersecurity processes, investments, and actions as described below.


text: Cybersecurity risk is a component of Advanced Energy's broader risk management program and managed at the highest levels of the Company, starting with Advanced Energy's CIO, who meets with the Chief Executive Officer and other members of executive management regularly to discuss issues, assess risks, and coordinate Company-wide cybersecurity initiatives. Our CIO leads a dedicated cybersecurity technical team that manages, monitors, and enforces compliance with the cybersecurity program.


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached, disrupted, or fail, we may incur significant legal and financial exposure and liabilities" under the heading Part I, Item 1A "Risk Factors".


text: Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, two members of the Board have been delegated authority to serve as initial points of contact for the Board in the event of a severe information security incident. The full Board receives a cybersecurity briefing from the CIO annually.


text: As discussed above, our cybersecurity risk management and strategy are led by our CIO, who has extensive leadership experience with enterprise information technology in the manufacturing and telecom industries, where he has held various executive roles in which he developed and executed IT strategy, including cybersecurity programs, helped achieve and maintain Sarbanes-Oxley compliance, and brought companies into compliance with ISO 27001, among other things.


text: We rely on our information technology to operate our business and provide our Barostim Therapy to patients. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication, and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Board of Directors assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices, and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.


text: Our chief financial officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: We recognize the critical importance in developing, implementing and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The fundamental controls of our cybersecurity program are based around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We engage qualified third-party consultants and advisors to conduct risk and vulnerability assessments to evaluate our systems and to advise us on cybersecurity risk management processes. We maintain a robust vulnerability-management program to evaluate our systems on a monthly basis, and we prioritize remediation efforts based on risk level and criticality of the system or data. We conduct comprehensive penetration testing with external consultants on our enterprise environment and our own products on at least an annual basis.


text: Cybersecurity risk management is an integral part of our technology modernization program. It is integrated into our business, as well as the broader software and digital environment. Our technology modernization program will move many of our core applications to industry-specific healthcare cloud solutions that offer robust HIPAA compliant, data security capabilities and tools. Our modernization plans revolve around simplifying our technology estate to reduce technical debt, automate security functions, and enable applications to take full advantage of best-practice, cloud security capabilities.


text: Our cybersecurity risk management process includes assessment of third-party service providers, suppliers and other business partners' ability to maintain compliance with our cybersecurity requirements, including review of Service Organization Control Type 2 ("SOC 2") reports and security controls. Our onboarding process for any third-party service provider includes execution of a business associate agreement that defines the service provider's responsibility to notify us in the event of any known or suspected cyber incident.


text: We maintain a thorough business continuity and resilience program designed to ensure our operations will withstand significant disruption and minimize impact on our patients and employees in the face of a significant challenge. Using standards developed by Disaster Recovery Institute International (DRII), we regularly conduct a business impact analysis to determine risk level, assess impact severity and prioritize business processes based on company needs.


text: As part of our monitoring process, we perform tabletop exercises at least annually to test our current plans. These cross-functional exercises involve employees from multiple departments and are designed to gain perspective, collect feedback and validate plan effectiveness. The information obtained from the business impact analysis, exercises and testing is utilized to update contingency plans for each department.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and risk management programs, and receives updates from our Information Security and Compliance teams regarding the effectiveness of these programs on a quarterly basis. These reports include descriptions of security incidents and observed trends in threat activity, new programs and tooling designed to address developing areas of risk, and performance reporting of third-party testing, including security awareness training and cybersecurity assessments. The full Board of Directors has general oversight of the Company's risk management programs, which include cybersecurity risks, and the Audit Committee provides regular reports to the full Board of Directors related to cybersecurity matters and related risk oversight.


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 25 years of technology leadership experience, including 19 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's team, including its Head of Risk Management and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service providers to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS


text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider; Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis;


text: Contractually obligating the provider to make us aware of significant cybersecurity related incidents; and Coordinating independent security assessments with the provider utilizing our own resources.


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified.


text: We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents, which have capabilities to automatically isolate and terminate vulnerabilities. We utilize industry leading tools and controls for user management, authentication, and privileged access management.


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We periodically test, evaluate and refine our CIRP in response to identified risks.


text: To manage the third-party cybersecurity risk introduced by our cloud-first strategy, we have implemented a due diligence process for new software partners as well as an annual review process for essential SaaS system partners.


text: We conduct cybersecurity awareness training annually and simulated phishing campaigns no less than quarterly to test and educate our employees.


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats.


text: Our Chief Information & Technology Officer along with our Vice President of Cybersecurity & Cloud Infrastructure provide principal oversight and guidance of our cybersecurity risk management strategy, programs and processes. The Chief Information & Technology Officer has over 20 years of experience in information technology in the real estate sector, leading organizations through strategic technology and process improvement initiatives. The Vice President of Cybersecurity & Cloud Infrastructure has over 15 years of extensive experience in cybersecurity and information technology. They are supported in their efforts by a team of technical experts who have had formal training and possess relevant industry related experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.


text: The Audit Committee of our Board of Trustees provides board-level governance and oversight regarding cybersecurity matters. Management meets with the Audit Committee periodically to discuss cybersecurity strategy, risk, trends, and internal personnel and qualifications. As part of our annual enterprise risk assessment, technology and cyber risks are standing risk factors which are ranked and reviewed by management.


text: In the event of a cyberattack, we engage our CIRP, which provides a framework of processes and procedures related to identifying, categorizing, responding, containing, analyzing, and eradicating cybersecurity threats to mitigate downtime and promptly restore systems and services. Management has responsibility for reporting cybersecurity incidents to the Audit Committee as they occur, if consistent with our CIRP. The CIRP also addresses management's responsibility, with Audit Committee oversight, with respect to any reporting or disclosure determinations related to a given cybersecurity incident and provides for Audit Committee and Board of Trustee briefings as appropriate.


text: Risks, Threats and Material Incidents As of December 31, 2024, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, we and our third-party providers have been the target of cybersecurity threats and expect them to continue. Notwithstanding the extensive approach we take to address cybersecurity, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A "Risk Factors" - Risks Related to Our Business and Operations - The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical IT Systems and information.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical IT Systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: risk review of certain third-party service providers, including software vendors, third-party cloud services, and third-party hosting services, with ongoing risk monitoring for critical vendors through an external cybersecurity intelligence service;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, please see our Risk Factors in Item 1A.


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our former CIO left the Company in January 2025. Currently Shashank Patel, our Chief Financial Officer, is serving as Interim CIO as we proceed with an executive search to appoint a permanent CIO. Mr. Patel has been overseeing the Company's Information Technology function since he joined the Company in July 2018. References to the CIO and the CIO's duties refer to our CIO's historical role, Mr. Patel's interim CIO role, and our future CIO's role.


text: Mr. Patel has over 10 years of experience overseeing an Information Technology function. Our VP of Information Security has over 25 years of experience in leading cybersecurity functions across strategy, architecture, engineering, and operations.


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include, but are not limited to, risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is responsible for assessing our material, or reasonably likely to be material, risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from the CIO and the VP of Information Security at least twice yearly. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from the CIO and the VP of Information Security on cybersecurity, or from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.


text: Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We have a Data Protection Office that works closely with, and assists, our enterprise Privacy Program, overseen by the Chief Privacy Officer, along with advisory support from appointed Data Protection Officers in Europe and Quebec.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, including within the last three years, these incidents have not had a material impact on our Company, including our business strategy, results of operations or financial condition. Risks from cybersecurity threats, including previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, are also not currently viewed as reasonably likely to materially impact our Company, including our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts and developments and technological advancements also increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Although we have implemented and maintain commercially reasonable security measures and safeguards, including to protect against and identify potential threats, these protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.


text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.


text: Our cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard and is integrated into our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition as of the end of fiscal year 2024. Our Risk Factors include further detail about our material cybersecurity risks.


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 25 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.


text: The Cybersecurity Program, which is integrated into our enterprise risk management framework, assesses, identifies and protects our enterprise information systems, data and business operations from various security threats and contains the following elements: Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. Identity and Access Management - Managing enterprise identity and access control systems. Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support.


text: Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses.


text: Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence.


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps.


text: Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.


text: Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Our Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of directors' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our overall enterprise risk management framework. Additionally, our Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.


text: The board of directors oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of directors and our board committees.


text: Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services, to process and record financial and operating data and to collect and store sensitive data, including our proprietary business information and personally identifiable information of our employees and others. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: We recognize that cybersecurity threats are constantly evolving, and we have implemented risk management procedures designed to protect our systems and data. We conduct vulnerability assessments, and periodic audits to identify and address potential cybersecurity vulnerabilities. We conduct periodic assessments to identify material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response to those findings. As part of our efforts to safeguard our systems and data, we have sought to implement industry-standard security controls, including firewalls, encryption, and multi-factor authentication.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices to attempt to identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. We require that our employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We have implemented processes to oversee and identify the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight and Management's Role Our Board of Directors has delegated the responsibility for the oversight of risks from cybersecurity threats and our cybersecurity practices to the Audit Committee. Our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Company's Chief Technology Officer ("CTO").


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. Our CTO focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts (collectively with the CTO, the "Technology Team"). Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across oil and gas, consulting, and power generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team, the Audit Committee and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.


text: Risk Management and Strategy TripCo's corporate level IT and cybersecurity functions are provided by Liberty Media as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty Media's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below. Tripadvisor, as a separate publicly traded company from TripCo, operates its own cybersecurity function. While primary oversight for Tripadvisor rests with its board of directors and Audit Committee, we receive regular reporting from Tripadvisor management and collaborate with those tasked with oversight to ensure risks are appropriately addressed.

companyName: Liberty TripAdvisor Holdings, Inc.


text: The Company is committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, has implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: We rely on a multidisciplinary team, including our information security functions, legal departments, management, and third-party consultants, as described further below, at the corporate level and at Tripadvisor to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools, such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our Board of Directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Tripadvisor. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C. "Cybersecurity" in their 2024 Form 10-K filed on February 20, 2025.


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with Liberty Media, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level. The ISSC receives regular reports and updates from Tripadvisor regarding their cybersecurity risk management activities and, if any, incidents that have occurred.


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of Tripadvisor's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications and has worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data. Tripadvisor maintains rigorous standards for its information security leadership positions, including requiring extensive experience in building and leading cybersecurity teams and implementing enterprise-wide cybersecurity programs.


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process, including processes related to cybersecurity risks.

companyName: BALL Corp

ticker: BALL


text: The company employs a standards-based cybersecurity program aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), including ongoing assessment and continuous improvement to address the rapidly evolving threat landscape. Ball partners closely with a strong network of external partners, including conducting annual assessments of the cyber risk management program against the NIST CSF.


text: Our information security team has established and implemented formal processes and policies to assess, identify, and manage risks arising from cybersecurity threats, including those associated with our internal operations and the use of third-party service providers. We continually refine our approach to address evolving cybersecurity regulations, identify potential and emerging security risks, and implement strategies to manage these risks. Ball has developed an incident response plan that includes a cyber incident materiality assessment with appropriate leadership governance. In addition, we have aligned our incident response plan with our enterprise risk and global crisis management processes.


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. In addition, we also augment and extend our cyber team using a select few trusted third-party partners that are integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous global cyber operations 24/7.


text: We are aware that there are potential cybersecurity risks associated with third-party service providers. Prior to engaging with third-party providers, Ball conducts thorough security assessments. We monitor for third-party cyber incidents and manage any third-party cyber incidents under our incident response plan and processes. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation. To date, we have not identified any cybersecurity incidents that have affected, or are reasonably likely to affect, our business, operations, or financial condition.


text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts to protect the company from cyber threats. In the event of a cyber incident, our cross-functional response team will enact our incident response plan, and notify appropriate levels of management, including the executive leadership team, disclosure committee, and Board of Directors, as appropriate.


text: Our Board of Directors oversees our company's cybersecurity and information technology strategies. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture and the effectiveness of its risk management strategies.


text: The Company assesses cybersecurity risk and exposure on an ongoing basis and implements tools that are commensurate with the risks that the Company faces. In light of the Company's relatively small size and personnel, it relies heavily on reputable third-party vendors to mitigate key cybersecurity risks and exposures. While the nature of the Company's business and the data it processes inherently limit the Company's exposure to cybersecurity risk, the Company has implemented and maintains controls, policies, procedures and safeguards to maintain and protect confidential information as well as the integrity, continuous operation, redundancy and security of all information technology systems and data used in connection with the Company's business. The Company generally approaches cybersecurity threats through a comprehensive approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Farmland Partners Inc.

ticker: FPI


text: Consistent with overall risk management policies and practices, the Company's cybersecurity program focuses on the following areas:


text: The Company employs tools to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents in accordance with our internal cybersecurity policies and controls.


text: Systems Safeguards: The Company and its third party vendors deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis.


text: The Company ensures that all third party vendors that process or have access to sensitive information have appropriate cybersecurity risk controls in place.


text: The Company communicates regularly with employees to increase awareness around phishing and spoofing attempts and other cybersecurity schemes. Employees are encouraged to report suspicious emails or incidents to the General Counsel or the President and Chief Executive Officer.


text: Incident Response Policies: The Company has established and maintains incident response policies that address the Company's response to a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and our Board of Directors.


text: Our Board of Directors oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Our Board of Directors receives presentations on cybersecurity issues and developments as needed. Our Board of Directors also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, our Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting the breach or incident to our Board of Directors and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Mr. Fabbri, in coordination with our Board of Directors, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to our Board of Directors and applicable regulatory authorities when appropriate.


text: The Company has in the past experienced cyberattacks on its computer networks and, although none to date have been material, the Company expects that additional cyberattacks will occur in the future. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, and the Company's full Board and management is actively involved in overseeing the risk management process. These processes include response to, and an assessment of, internal and external threats to the security, confidentiality, integrity and availability of Company data and systems, along with other material risks to Company operations. We recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: As part of our risk management process, the Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Company's cybersecurity program is focused on the following key areas: • Departmental Collaboration: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, potential acquisition targets and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by members of management and relevant management committees.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: The Company has established a risk committee (the " Risk Committee ") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.


text: The Company's Audit Committee is briefed on cybersecurity risks at least once each calendar year and as necessary with respect to any material cybersecurity incidents. The Audit Committee also reviews the enterprise risk management matrix presented by the Risk Committee on an annual basis. The process of reviewing the matrix includes an overall assessment of the Company's compliance with cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company's cybersecurity processes and practices are integrated into our risk management and oversight program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We utilize a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's management team.


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.


text: Technical Safeguards: Together with the MSP, we deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which is tested and evaluated on a regular basis.


text: Together with the MSP, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: As directed by the Company, the MSP provides regular training for Company personnel regarding cybersecurity threats as a means to equip such personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Together with the MSP, we engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We execute a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk management program includes a cybersecurity incident response plan and dedicated cybersecurity incident response team ("CSIRT"). We do not have actual or contractual access to the systems or information maintained by our tenants, who maintain their own cybersecurity risk management programs to protect their operations from various risks from cybersecurity threats.

companyName: SIMON PROPERTY GROUP L P


text: We use the National Institute of Standards and Technology Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, public relations and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment;


text: a team comprised of IT security, infrastructure, and compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents, supported by legal, human resources, corporate security and other internal resources;


text: the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, which enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices; cybersecurity awareness training of employees with access to our IT systems;


text: a cybersecurity incident response plan and Security Operations Center ("SOC") to respond to cybersecurity incidents; and a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See further discussion in Item 1A. Risk Factors.


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with varied expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.


text: Our Chief Financial Officer periodically provides reports to the Audit Committee, and, together with our Chief Technology Officer and Director of Cybersecurity, leads the Company's overall cybersecurity function. The Audit Committee receives regular reports on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity, IT and data protection topics.


text: Our Chief Financial Officer oversees our CSIRT, whose members have years of experience working in cybersecurity and certifications including CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), CGRC (Certification in Governance of Enterprise IT), GIAC (Global Information Assurance Certification) and GCED (GIAC Certified Enterprise Defender). Our CSIRT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: The CSIRT is responsible for assessing and managing our material risks from cybersecurity threats. They have primary responsibility for leading our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity service providers.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management system. We have a cross-departmental approach to identifying, assessing, and managing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and its Risk Committee and Audit Committee (respectively, the "Risk Committee" and the "Audit Committee"), as well as senior management in, among other areas, the information security, information technology, operations, and risk management (including enterprise and operational risk) areas, devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and to identify and respond to cybersecurity threats and incidents in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, identification, and remediation. Our information technology and information security areas review enterprise risk management-level cybersecurity risks continually, and key cybersecurity risks are incorporated into the Company's Enterprise Risk Management Framework that supports its Risk Appetite Statement. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. On an annual basis, the Board approves the Company's Information Security Policy and Program which provides a layered approach to cybersecurity, and includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information in accordance with applicable law.

companyName: SouthState Bank Corp

ticker: SSB


text: The Company's Chief Information Security Officer (" CISO ") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 20 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external and internal control validations to assess our processes and procedures and the threat landscape, and we maintain a vulnerability management program designed to identify vulnerabilities and coordinate remediation efforts for any identified vulnerabilities in the environment. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, and vendors. Results of these ongoing activities are reported quarterly to management through the Cyber and Information Technology Steering Committee. In addition, we periodically perform simulations and tabletop exercises at the management level and incorporate external resources and advisors as needed. All employees are required to complete information security training at least once every year, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile, and in 2024, a third-party cybersecurity consultant reviewed the Company's vulnerability management program These reviews assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.