text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cyber risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyber attack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cyber security incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board"). To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Our risk management organization, which is led by our Chief Risk Officer, manages our information security program along with enterprise risk management, business continuity, internal audit and physical security. Our risk management team routinely reports on cybersecurity matters to our executive management team and our Board. Our Chief Information Security Officer, who reports directly to our Chief Risk Officer, leads a dedicated information security team that manages our information security program. The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.

companyName: IRON MOUNTAIN INC

ticker: IRM

secItem: Item 1C


text: Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program. As part of the risk management team, our Chief Information Security Officer reports key performance indicators of our information security program to the RSC at least three times a year to facilitate the committee's oversight of the effectiveness of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.


text: Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. Our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise comprised of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies, structures and systems in place for managing risks of the business, including cybersecurity risk. Our executive management team reviews and prioritizes significant risks, allocates resources for risk mitigation. Our Chief Risk Officer and other members of our risk management team provide reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk. We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.


text: We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team, and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. The results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards. We require all employees to undertake data protection and cybersecurity training and compliance programs annually.


text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cybersecurity risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyberattack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cybersecurity incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board").


text: To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Attacks on our internal IT systems could damage our reputation, cause us to lose revenues, and adversely affect our business, financial condition and results of operations", which should be read in conjunction with the information above.


text: Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does, consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies, and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program.


text: Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. As part of our enterprise risk program, our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise composed of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies and management plans in place for managing risks of the business, including cybersecurity risk, as well as reviewing and prioritizing significant risks and allocating resources for risk mitigation.


text: Our Chief Risk Officer provides reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk, and our Chief Information Security Officer provides quarterly reports to the RSC on the key performance indicators of our information security program to facilitate the RSC's oversight of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.


text: We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.


text: The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.


text: We have processes in place to identify, assess and manage material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and have been embedded in our internal controls and information systems.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.


text: We contract with external firms to assess our cyber security controls relative to our peers using the NIST CSF. We also have a third-party risk management program that assesses risks from vendors and suppliers. In addition, we maintain a Business Continuity and Disaster Recovery Plan as well as a cybersecurity insurance policy.


text: We have established cybersecurity and information security awareness training programs. Formal training on topics relating to our cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to our network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular company-wide communications with frequent updates to educate on the latest adversary trends and social engineering techniques.


text: Additionally, we engage in cyber crisis response simulations to assess our ability to adapt to information and operational technology threats. Improper or illegitimate use of our information system resources or violation of our information security policies and procedures is subject to disciplinary action. Our security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication to ensure that access to information and communication is vetted and secure.


text: We also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate our security posture. We also engage external firms to measure our NIST CSF maturity level.


text: Our board of directors established a standing Cybersecurity Committee, which is tasked with oversight of the Cybersecurity Program, including: (i) strategy and governance; (ii) operations; and (iii) risk management and regulatory compliance.


text: The Cybersecurity Committee responsibilities include: • reviewing our enterprise cybersecurity strategy and framework, including our assessment of cybersecurity threats and risk, data security programs, and our management and mitigation of cybersecurity and information technology risks and potential breach incidents; • reviewing any significant cybersecurity incident that has occurred, reports to or from regulators with respect thereto, and steps that have been taken to mitigate against reoccurrence; • evaluating the effectiveness of our cyber risk management and data security programs measured against our cybersecurity threat landscape; • assessing the effectiveness of our data breach incident response plan; • reviewing and assessing our information technology disaster recovery capabilities; and • reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.


text: The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer ("CIO") and other executives and cybersecurity specialists. Following each committee meeting, the chair of the Cybersecurity Committee briefs the full board of directors on matters covered at the prior Cybersecurity Committee meeting. The board also receives periodic briefings on emerging trends in order to enhance its literacy on cybersecurity issues. At least annually, the Cybersecurity Committee receives updates about the results of the Cybersecurity Program reviews. The Cybersecurity Committee participates with management periodically in "tabletop" exercises to evaluate our data breach incident response plan.


text: Management's Role and Expertise in Assessing and Managing Cybersecurity Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management. Our CIO has more than 27 years of experience in the IT industry. Since 2006, he has held multiple roles at the Company and most recently as Vice President of IT Strategic Solutions.


text: Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the "IRP"), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. The IRP provides definitions of key terms, stakeholder roles and responsibilities, and a response governance and escalation process.


text: We have an incident response team comprised of our CIO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include: • evaluating and validating the impact of an incident; • approving certain incident response countermeasures and remediation actions; • escalating incidents and response countermeasures for approval; and • acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We maintain a Business Continuity and Disaster Recovery Plan that addresses our preparation for, management, recovery from, and ultimate resumption of business after a crisis, including emergency response, continued recovery, and business resumption activities such as information systems recovery, when a cybersecurity incident may potentially have a significant impact on our business strategy, results of operations, or financial condition.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "Cybersecurity breaches and other disruptions or misuse of our network and information systems could affect our ability to conduct our business effectively.", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We also utilize internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate our security posture. We also engage external firms to measure our NIST CSF maturity level.


text: We have established policies and processes for assessing, identifying and managing risks from cybersecurity threats based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our technology environment is regularly assessed, both internally and through the use of third parties, against the six NIST principles (identify, detect, protect, recover, respond, govern) to oversee and identify the likelihood and impact of risks from cybersecurity threats. Additionally, we apply these principles where appropriate to third-party technology providers. We also utilize third parties to assess the effectiveness of our cybersecurity program on a periodic basis, which includes engaging cybersecurity assessors and cybersecurity experts to assist in the detection, verification and validation of risks from cybersecurity threats, as well as to support associated mitigation plans when necessary. We have a cybersecurity incident response plan in place to assist us in detecting, analyzing, containing, responding to and recovering from cybersecurity incidents. We also maintain cybersecurity insurance coverage to protect against certain potential losses arising from cybersecurity incidents.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: We have identified and as a result monitor cybersecurity as an enterprise risk of the Company. We have an Information Security Steering Committee that meets quarterly to review the cybersecurity threat landscape, current risks, incidents and program management. We routinely assess the cybersecurity threat landscape, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: Our Chief Information Security Officer ("CISO") leads a dedicated cybersecurity team responsible for policy, governance, vulnerability management, architecture and incident response. Our team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments and tabletop exercises. All personnel with access to UNFI systems are made aware of our cybersecurity policies and procedures upon hire and through periodic refresher trainings. Such policies and procedures cover areas such as identity and access management, vendor management, data governance and protection, vulnerability management, incident response, recovery, communications and cybersecurity hygiene.


text: We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this Annual Report. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For more information on risks from cybersecurity threats, refer to the risks described under "Risk Factors" included in Part I, Item 1A in this Annual Report.


text: Board's Role in Oversight of Risks from Cybersecurity Threats Our Board of Directors has appointed the Audit Committee to assist in fulfilling its responsibilities with respect to the oversight of cybersecurity, data privacy and information technology. Several of our Directors, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity and meet regularly with members of our management team to advise on cybersecurity matters and technology initiatives.


text: Our Chief Information Officer ("CIO"), CISO and other members of management provide quarterly updates to the Audit Committee and meet with the Board of Directors at least annually regarding risks related to information systems, information security and cybersecurity. Specific topics may include updates to the Company's strategy to combat cybersecurity risks; cybersecurity news and events; key focus areas; the threat landscape; and the results of certain assessments and testing. Our CIO, CISO or other members of management provide information to the Audit Committee or our Board of Directors, as applicable, pursuant to risk-based escalation protocols for cybersecurity incidents in accordance with an established materiality framework.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The information security function is led by our CISO, under the direction of our CIO. Our CISO, who has been serving in this position since January 2020, has over 20 years of experience in information security and is a Certified Information Systems Security Professional. Our CISO maintains primary responsibility for developing cybersecurity strategies; cybersecurity governance; identifying, assessing and monitoring cybersecurity risks; preparing for and responding to cybersecurity incidents; verification and testing of cybersecurity; and disaster recovery governance. Our CISO may authorize specific Company associates to assist in managing these responsibilities if determined necessary, including the Crisis Response Team. Our CIO and CISO have oversight responsibilities of the Company's cybersecurity program.


text: We conduct a regular cybersecurity risk assessment process through our CISO and dedicated information security team, which reports to the Information Security Steering Committee. This committee meets at least quarterly to review current program progress and discuss and evaluate risks that could be material to our business, including cybersecurity threats. The Information Security Steering Committee is comprised of key leadership across the Company to support cross-functional representation.


text: We have identified, and as a result monitor, cybersecurity as an enterprise risk of the Company. We have an Information Security Steering Committee that meets quarterly to review the cybersecurity threat landscape, current risks, incidents and program management. We routinely assess the cybersecurity threat landscape, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: In the fourth quarter of fiscal 2025, we became aware of unauthorized activity on certain of our information technology systems. We promptly activated our incident response plan and implemented containment measures, including proactively taking certain systems offline (the "Cybersecurity Incident"). As a result, our ability to fulfill and distribute customer orders was temporarily impacted until the unauthorized activity could be contained, and we could safely restore the core systems that our customers and suppliers use, enabling business operations to normalize. As a result of the Cybersecurity Incident, we experienced reduced sales volume and increased operational costs in the fourth quarter of fiscal 2025, which negatively impacted our results of operations.


text: Other than the Cybersecurity Incident, we have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For more information on risks from cybersecurity threats, refer to the risks described under "Risk Factors" included in Part I, Item 1A in this Annual Report.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The information security function is led by our CISO, under the direction of our CIO. In fiscal 2025, following the retirement of our former CISO, we appointed an interim CISO who has over 20 years of experience in information technology and security and is a Certified Information Systems Security Professional. Our CISO maintains primary responsibility for developing cybersecurity strategies; cybersecurity governance; identifying, assessing and monitoring cybersecurity risks; preparing for and responding to cybersecurity incidents; verification and testing of cybersecurity; and disaster recovery governance. Our CISO may authorize specific Company associates to assist in managing these responsibilities if determined necessary, including the Crisis Response Team. Our CIO and CISO have oversight responsibilities of the Company's cybersecurity program.


text: The strength and resilience of our cybersecurity and data privacy programs are critical in maintaining the trust of our patients, customers, employees, shareholders, and other stakeholders. Securing our business information, customer, patient and employee data and IT systems is an important part of our overall risk management framework. We rely on IT systems, some of which are dependent on services provided by third parties, to provide data and other services, including diagnostic information services for patients, clinicians and healthcare organizations, clinical testing, test ordering and reporting, billing, customer service, logistics, commercial and operational data, human resources management, legal, finance and tax compliance, and other information and processes necessary to operate and manage our business.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: We maintain comprehensive cybersecurity and data privacy programs that are designed to be aligned to best practice frameworks and applicable laws and regulations, as well as our contractual obligations. These enterprise-wide programs are designed to secure our facilities, information systems and safeguard data throughout its lifecycle, including data provided to third parties performing services on our behalf. Our cybersecurity program incorporates standards, processes, and activities over a number of domains, including governance, access controls, facility and data protection, IT systems and data transmission security, threat intelligence and incident response, third-party risk management, disaster recovery and vulnerability management.


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other vulnerabilities; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Our program includes procedures to identify cybersecurity risks and threats of our suppliers and third-party outsourcing providers with whom we interface, or who store, process, host or transmit confidential patient and employee data or other confidential information. Our Strategic Threat and Intelligence Center manages our threat landscape and uses a variety of security technology and threat intelligence tools designed to detect, prevent, block, analyze, and respond to cybersecurity threats. We collaborate with government agencies regarding potential cybersecurity threats and work with consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. At least annually, we review and test our program to simulate emergent threats and scenarios that could arise from potential cybersecurity attacks and data breaches. Our cybersecurity program is based on multiple security frameworks, including the National Institute of Standards and Technology's NIST 800 Special Publication Information Security standard, MITRE ATT&CK Framework, the Payment Card Industry Data Security Standard, the System and Organization Controls for Service Organizations 2 (SOC 2), and ISO 9001:2015 and ISO 15189.


text: We have integrated cybersecurity risk management into our overall risk management infrastructure through our enterprise risk management program. The enterprise risk management program, which is driven by our executive leadership, entails a formal process that identifies, assesses, mitigates and manages the risks from both internal and external conditions that could significantly impact the Company and influence our business strategy and performance.


text: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations, the scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.


text: The Company's Chief Information Security Officer (CISO), in coordination with the Company's Chief Litigation Officer, Executive Director, Privacy Officer, Corporate Controller/Chief Accounting Officer and other internal stakeholders, is responsible for leading the team responsible for assessing, identifying and managing cybersecurity and data privacy risks, including implementation of our cybersecurity risk management program. The CISO has extensive experience working in the IT and services industry and is a subject matter expert in varied topics including cybersecurity, data integrity, IT risk, enterprise architecture, third-party risk, threat intelligence, incident response, and regulatory compliance. Management committees consisting of senior officers of the Company regularly receive briefings on cybersecurity matters, who in turn regularly report to the Board of Directors and its committees on such matters.


text: The Board of Directors and its committees play an active role in overseeing our key enterprise level risks. Our Board, which annually reviews our enterprise risk management program, has delegated primary responsibility for overseeing the enterprise risk management program to the Audit and Finance Committee. The Board has delegated primary oversight of cybersecurity, a key enterprise risk, to the Cybersecurity Committee. The Board's Quality and Compliance Committee oversees and receives regular updates on data privacy, another key enterprise risk.


text: The Audit and Finance Committee is responsible for reviewing our policies with respect to risk assessment and risk management, as well as our insurance programs, including regarding cybersecurity. Our internal audit team reports to the Audit and Finance Committee on summaries of findings from completed internal audits of, among other matters, our IT security systems and processes, including network security and data protection. The Audit and Finance Committee regularly reports to the Board on its activities.


text: The Cybersecurity Committee is responsible for the general oversight of our cybersecurity policies, plans, program and practices and risks related to cybersecurity and data security. The Cybersecurity Committee reviews the adequacy and effectiveness of our cybersecurity program and regularly receives reports from management on cybersecurity matters. It also reviews our management of risks and compliance with legal and regulatory requirements and industry standards related to our IT security systems and processes, including network security and data protection. The Cybersecurity Committee regularly reports on its activities to the Board to promote effective coordination and to ensure the entire Board remains apprised of the effectiveness of our cybersecurity risk management and our cybersecurity risk landscape, and also assesses how management is managing these risks.


text: Although no cybersecurity incident during the year ended December 31, 2024 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations, the scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.


text: The Company's Chief Information Security Officer (CISO), in coordination with the Company's Chief Litigation Officer, Executive Director, Privacy Officer, Corporate Controller/Chief Accounting Officer, Executive Director, Corporate Security and other internal stakeholders, is responsible for leading the team responsible for assessing, identifying and managing cybersecurity and data privacy risks, including implementation of our cybersecurity risk management program. The CISO has extensive experience working in the IT and services industry and is a subject matter expert in varied topics including cybersecurity, data integrity, IT risk, enterprise architecture, third-party risk, threat intelligence, incident response, and regulatory compliance. Management committees consisting of senior officers of the Company regularly receive briefings on cybersecurity matters, who in turn regularly report to the Board of Directors and its committees on such matters.


text: We maintain a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, and we partner with leading cybersecurity experts to continually enhance the security of our operating environments. Some of the key risks identified include unauthorized access to our systems, spoofing valid credentials, and monetary motivated attacks, amongst others. As an organization, we have devoted significant resources to cybersecurity processes aimed at addressing the known risks, as well as adapting to the changing cybersecurity landscape and responding to emerging threats, if any, in a timely and effective manner. Our comprehensive cybersecurity program is implemented and maintained using information security tools, policies, training, and a team of information technology professionals. We have a Cybersecurity Incident Response Plan and a Business Continuity and Disaster Recovery Program, in addition to other company policies and procedures that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process, are approved by the appropriate members of management, and are a required part of our employee training on an annual basis.

companyName: GENESIS ENERGY LP

ticker: GEL


text: Our cybersecurity program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We have engaged the assistance of third-party experts to conduct comprehensive cybersecurity assessments centered on appraising our alignment with the NIST. Additionally, as further described in Item 1. Business-Regulation-Safety and Security Regulations, TSA has issued a series of security directives that all pipeline owners and operators must include in their cybersecurity planning, testing and in their reporting of any incidents. We have continued to expand investments in cybersecurity, including additional end-user training, using layered defenses, identifying and protecting critical assets, and strengthening monitoring and alerting. We regularly test our cybersecurity defenses by performing simulations and drills at both a technical level (including through penetration testing) and by reviewing our operational policies and procedures with third-party experts. We report the test results to the TSA as required. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our stakeholders, including investors, customers, employees, and vendors. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers. The internal business owners of our hosted applications are required to document user access reviews at least annually and receive and review a System and Organization Controls (SOC 1 or SOC 2) report from the vendor. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and evaluate the risks associated with that relationship. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity program.


text: The Audit Committee of the Board of Directors oversees our entity wide risks, including cybersecurity strategy, the assessment of cybersecurity risks, and the actions we take to monitor and mitigate cybersecurity risks. Working directly with executive management, our cybersecurity program is overseen and implemented by our Chief Information Officer ("CIO"), who has over 20 years of experience building and maintaining cybersecurity programs, and a team of skilled individuals, including a Director of Enterprise Security, and a Cyber-Resilience Team, who, together, are responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats, and seeking to continually harden our cybersecurity program. The Cyber-Resilience Team is dedicated to recovery efforts and business continuity plans and is knowledgeable across our information technology and operational applications. The Audit Committee reviews, with the CIO and executive management, the company's technology and cybersecurity program, including company plans, programs, policies, assessments and opportunities at its regularly scheduled meetings. Our CIO is responsible for providing regular updates, at least quarterly at regularly scheduled meetings, to the Audit Committee regarding cybersecurity-related situations, intelligence pointing to increased adversary activity, regulatory changes, and improvements or impediments to our cybersecurity posture. The Audit Committee reports on cybersecurity-related matters to the Board of Directors on an annual basis, or more frequently if there are any required matters to report. Based on these updates, the Audit Committee and the Board of Directors may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks and threats may also be escalated to the Audit Committee by the CIO and executive management on an as needed basis.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks, including as a result of previously identified cybersecurity incidents that have, or are reasonably likely to have, materially affected us, including our business strategy, results of operations, or financial condition. We have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks and we acknowledge that cybersecurity risks are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: We maintain a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, and we partner with leading cybersecurity experts to continually enhance the security of our operating environments. Some of the key risks identified include unauthorized access to our systems, spoofing valid credentials, and monetary motivated attacks, amongst others. As an organization, we have devoted significant resources to cybersecurity processes aimed at addressing the known risks, as well as adapting to the changing cybersecurity landscape and responding to emerging threats in a timely and effective manner. We assess the materiality of cybersecurity risks and incidents based on factors such as financial impact, regulatory implications, operational disruption, and reputational harm. Material cybersecurity incidents, if any, are evaluated in accordance with SEC guidelines, and appropriate disclosures are made when required. Our comprehensive cybersecurity program is implemented and maintained using information security tools, policies, training, and a team of information technology professionals. We have a Cybersecurity Incident Response Plan and a Business Continuity and Disaster Recovery Program, in addition to other company policies and procedures that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process, are approved by the appropriate members of management, and are a required part of our employee training on an annual basis.


text: Our cybersecurity program leverages the National Institute of Standards and Technology ("NIST") framework, which consists of five core functions: identify, protect, detect, respond and recover. We have engaged the assistance of third-party experts to conduct comprehensive cybersecurity assessments centered on appraising our alignment with the NIST. Additionally, as further described in Item 1. Business-Regulation-Safety and Security Regulations, TSA has issued a series of security directives that all pipeline owners and operators must include in their cybersecurity planning, testing and in their reporting of any incidents. We have continued to expand investments in cybersecurity, including additional end-user training, using layered defenses, identifying and protecting critical assets, and strengthening monitoring and alerting. We regularly test our cybersecurity defenses by performing simulations and drills at both a technical level (including through penetration testing) and by reviewing our operational policies and procedures with third-party experts. We report the test results to the TSA as required. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our stakeholders, including investors, customers, employees, and vendors. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers. The internal business owners of our hosted applications are required to document user access reviews at least annually and receive and review a System and Organization Controls (SOC 1 or SOC 2) report from the vendor. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and evaluate the associated risks. If a provided SOC report identifies significant deficiencies or control weaknesses, we conduct a detailed risk assessment, request remediation plans, implement additional monitoring measures, or, if necessary, reevaluate the vendor relationship. Our assessment of third-party provider risks is an integral part of our overall cybersecurity program, ensuring that appropriate safeguards are in place to protect our data and operations.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks, including as a result of previously identified cybersecurity incidents that have, or are reasonably likely to have, materially affected us, including our business strategy, results of operations, or financial condition. We have periodically encountered threats and security breaches affecting our data and systems, including malware and cyberattacks. We recognize that cybersecurity risks are constantly evolving, and while we implement robust security measures, the potential for future incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: We recognize the critical importance of maintaining the safety and security of our technology systems and data and have a holistic process for overseeing and managing cybersecurity and information technology related risks. This process is supported by both management and our Board. The Audit Committee (the "Audit Committee") of our Board has oversight of the Company's risk management program, and cybersecurity is a component of our overall approach to risk management.

companyName: INSEEGO CORP.

ticker: INSG


text: Our cybersecurity policies, standards, processes, and practices are integrated across our operational risk management programs and are based on recognized frameworks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: As one of the critical elements of our overall risk management program, our cybersecurity program is focused on the following key areas: • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response & Recovery Planning: We have established and maintain incident response and recovery plans that address our response procedures in the event of a multitude of various cybersecurity incidents. We leverage a Managed Detection and Response service which further helps support our internal security team to identify real time threats across our landscape. • Risk Management: We maintain a preemptive and comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks across our entire technology stack. The approach aligns to industry standards such as ISO 27005 (Information Security Risk Management). This approach also includes third-party risk management issues presented by third parties, including our vendors, service providers and other external users of our systems. We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities, including on-site visits for evaluation of certain core operational third-party vendors. In addition, our agreements with material vendors include indemnification provisions with respect to cybersecurity matters. • Outside Consultants: In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, auditors, and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advise on potential improvements to our incident prevention, response, and documentation procedures. • Team Member Education & Awareness: We provide training to new team members, as well as frequent, mandatory training for all team members regarding cybersecurity threats to equip our team members with effective tools to identify and prevent cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Governance & Personnel Our Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates our information security strategies to ensure effectiveness and, if appropriate, may also include a review from third-party consultants and experts. Senior management updates the Board and Audit Committee on matters regarding information security policies and procedures and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for our risk management oversight.


text: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, our Director of Information Security and Privacy. The IT Security Committee meets quarterly to discuss and address management of the risks facing our business. Technological risk is a regular component analyzed by our IT Security Committee to identify and assess potential cybersecurity risks across our business operations.


text: Our information security team is led by our Director of Information Security and Privacy, who has decades of experience in information technology and cybersecurity. Furthermore, our Director of Information Security and Privacy holds a number of certifications, including CISSP (Certified Information Systems Security Professional) and CCSP (Certified Cloud Security Professional). The information security team conducts periodic assessment and testing of our policies, standards, processes, and practices that are designed to address a multitude of potential cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, adoption and regular evaluation of incident response plans and procedures, regular team member email phishing test campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, team member cybersecurity awareness programming, regular audits & evaluations of internal and third-party systems, and continuous improvement of the information security management system.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition.


text: Our cybersecurity policies, standards, processes, and practices are integrated across our operational risk management programs and are based on recognized frameworks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in material adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have dedicated resources and implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: As one of the critical elements of our overall risk management program, our cybersecurity program is focused on the following key areas: • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, Security information and event management, Managed detection and response and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response & Recovery Planning: We have established and maintain incident response and recovery plans that address our response procedures in the event of a multitude of various cybersecurity incidents. We leverage a Managed Detection and Response service which further helps support our internal security team to identify real time threats across our landscape. • Risk Management: We maintain a preemptive and comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks across our entire technology stack. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. This approach also includes third-party risk management issues presented by third parties, including our vendors, service providers and other external users of our systems. We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities. We also evaluate certain core operational capabilities of our third-party vendors. In addition, our agreements with material vendors include indemnification provisions with respect to cybersecurity matters. • Outside Consultants: In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, auditors, and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advise on potential improvements to our incident prevention, response, and documentation procedures. • Team Member Education & Awareness: We provide training to new team members, as well as frequent, mandatory training for all team members regarding cybersecurity threats to equip our team members with effective tools to identify and prevent cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, and our VP of Information Technology and Security. The IT Security Committee meets quarterly to discuss and address management of the risks facing our business. Technological risk is a regular component analyzed by our IT Security Committee to identify and assess potential cybersecurity risks across our business operations.


text: Our information security team is led by our VP of Information Technology and Security, who has decades of experience in information technology and cybersecurity. Furthermore, our VP of Information Technology and Security holds several certifications, including CISSP (Certified Information Systems Security Professional), ACCISO (Associate Certified Chief Information Security Officer) and CISM (Certified Information Security Manager). The information security team conducts periodic assessment and testing of our policies, standards, processes, and practices that are designed to address a multitude of potential cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, adoption and regular evaluation of incident response plans and procedures, regular team member email phishing test campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, team member cybersecurity awareness programming, regular audits & evaluations of internal and third-party systems, and continuous improvement of the information security management system.


text: We maintain a comprehensive process for identifying, assessing and managing material risks arising from cybersecurity threats, and have integrated these into our overall risk management processes. Our senior leadership team, along with representatives from our information technology, legal, human resources and finance departments, are responsible for developing the Company's overall risk management program and are also responsible for executing our cybersecurity policies.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: We are establishing a formal written information security policy and incident response policy which outlines the methods for assessing, identifying, and managing risks related to the Company. We've developed a robust cybersecurity program which includes multiple security layers. We understand the importance of a strong cybersecurity framework and have hired external security consultants to assess, audit, and monitor its security controls and events. We also ensure that third-party service providers have the ability to implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. In addition, we maintain a cybersecurity insurance policy. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats.


text: Our board of directors, with delegation to the audit committee, as appropriate, retains oversight of the Company's cybersecurity risks. The senior leadership team provides periodic reports to our board of directors, as well as the Chief Executive Officer and audit committee as necessary. In addition, we have contracted with certified security experts that act as an extension of the internal information technology team for all security related items. These communications include potential risks facing the Company, assessments and evaluations of our cybersecurity environment, results of internal controls testing, and reports on our on-going initiatives to strengthen our cybersecurity framework.


text: We rely on information technology systems and various software applications to operate our business. To address cybersecurity risks, we have implemented a comprehensive process for identifying, assessing, and managing material threats, and integrating these measures into our overall risk management framework. Our Security Operations Team and Security Audit/Advisory Team play a key role in this strategy.


text: Our senior leadership team, in collaboration with representatives from the Security Operations Team, as well as the legal, human resources, and finance departments, are responsible for developing and executing the company's overall risk management program, including cybersecurity policies. To enhance security, we have established an Information Security Program with a formal written security and incident response policy. This policy outlines methods for assessing, identifying, and mitigating risks. Our cybersecurity program incorporates multiple security layers, and we engage external security consultants to assess, audit, and monitor our security controls and events. Additionally, we require third-party service providers to implement and maintain appropriate security measures and promptly report any suspected breaches that may impact the Company. We also maintain a cybersecurity insurance policy.


text: We have invested in relevant tools and technologies to protect our data and business partners. Our Security Operations Team continuously monitors risks specific to our industry. We also leverage third-party assessors, consultants, and advisors to enhance our cybersecurity risk assessment and mitigation efforts. To foster a security-conscious culture, we have implemented a cybersecurity awareness program that educates employees on identifying and reporting threats. We conduct periodic phishing campaigns and training sessions to equip employees with the necessary skills to manage and defend against prevalent cybersecurity risks. Additionally, employees in specialized IT roles receive targeted training, including tabletop exercises, among other training.


text: We continuously update and improve our cybersecurity program through independent assessments, penetration testing, and system vulnerability scanning. Our security framework follows a hybrid approach, incorporating best practices from the Center for Internet Security framework and incorporating relevant standards from the National Institute of Standards and Technology Cybersecurity framework. We also undergo an annual third-party assessment to evaluate the maturity of our cybersecurity program. Additionally, we periodically engage external advisors to assess our program's effectiveness, strengthen policies, and identify potential vulnerabilities. Our Security Operations Team led by VP of Technology, collaborates regularly with IT network teams and other management stakeholders to review and address cybersecurity risks and opportunities. We have a global incident response plan with defined incident management protocols, escalation timelines, and responsibilities among other policies to manage data and its risks. As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.


text: Assessing, identifying, and managing material risks from cybersecurity threats We are committed to maintaining robust cybersecurity practices to safeguard our information assets and ensure the confidentiality, integrity, and availability of our operations. We employ a comprehensive approach to assess, identify, and manage material risks arising from cybersecurity threats. The identification and oversight of material cybersecurity risks is included in continuous Enterprise Risk Management (ERM) Committee and Board of Directors meetings and reporting.

companyName: LITHIA MOTORS INC

ticker: LAD


text: We complete regular cybersecurity assessments to identify potential vulnerabilities and threats, analyzing our infrastructure, systems, and data. Assessments are conducted both internally and by third parties and consider internal and external factors, technological changes, regulatory requirements, and emerging cyber threats. Our cybersecurity program adheres to widely recognized standards for managing cybersecurity risk, including the National Institute of Standards and Technology Cybersecurity Framework, Center for Internet Security Controls and UK Cyber Essentials.


text: We use advanced threat detection tools and technologies to identify potential cybersecurity risks. This includes continuous monitoring, intrusion detection systems, and anomaly detection mechanisms, to promptly identify any unusual activities or security breaches. Threat intelligence sharing with industry partners helps ensure we stay informed about the latest cybersecurity threats.


text: We assess cybersecurity risks for their potential impact on our operations, data, and reputation. Risks are prioritized based on their severity and likelihood of occurrence before implementing appropriate controls, safeguards, and mitigation measures to address and manage these risks effectively.


text: We have developed a well-defined and frequently updated information security incident response plan that outlines procedures to be followed in the event of a cybersecurity incident. The plan is periodically drilled with incident response team members and includes robust processes for identification, categorization, escalation and reporting of incidents. Employees are regularly trained on key cybersecurity subjects to ensure awareness.


text: While no company can or will be completely immune from cybersecurity threats, especially as they relate to vendors and government agencies that we rely on, we know of no cybersecurity incident that has or is likely to materially affect us, our business strategy, or our results of operations, or financial condition.


text: Our Board of Directors oversees our cybersecurity and data protection strategy and appoints a director to lead the Board's efforts. Our Board is briefed on our cybersecurity posture, current and future risks and potential incidents or vulnerabilities on a quarterly basis. Board members and executives participate in engagements on cybersecurity, such as simulated cyber incident response and crisis management exercises. Our Board also regularly receives and reviews third-party cybersecurity assessments, which include assessments of our cyber maturity and cyber risk.


text: Management's Assessment and Response to Material Risks from Cybersecurity Threats Our information security team and its leadership have primary responsibility for assessing and managing cybersecurity risks, within the scope of the overall ERM Committee. Such individuals collectively have over 80 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity threats are reported to management through robust and documented incident reporting processes. Our ERM Committee is comprised of Information Security, Legal, Treasury and other key executive stakeholders. The committee meets on a quarterly basis or as necessary to assess and respond to enterprise risks, including cybersecurity. The ERM Committee reports updates to the Board of Directors when appropriate and at least on an annual basis.


text: Assessing, identifying, and managing material risks from cybersecurity threats We are committed to maintaining robust cybersecurity practices to safeguard our information assets and ensure the confidentiality, integrity, and availability of our operations. We employ a comprehensive approach to assess, identify, and manage material risks arising from cybersecurity threats. The identification and oversight of material cybersecurity risks is included in continuous ERM Committee and Board meetings and reporting.


text: We complete regular cybersecurity assessments to identify potential vulnerabilities and threats, analyzing our infrastructure, systems, and data. Assessments are conducted both internally and by third parties and consider internal and external factors, technological changes, regulatory requirements, and emerging cyber threats. Our cybersecurity program adheres to widely recognized standards for managing cybersecurity risk, including the National Institute of Standards and Technology Cybersecurity Framework, Center for Internet Security Controls and U.K. Cyber Essentials.


text: We use advanced threat detection tools and technologies to identify potential cybersecurity risks. This includes continuous monitoring, intrusion detection systems, and anomaly detection mechanisms, to promptly identify any unusual activities or security breaches. Threat intelligence sharing with industry partners helps us stay informed about the latest cybersecurity threats.


text: We have developed a well-defined and frequently updated information security incident response plan that outlines procedures to be followed in the event of a cybersecurity incident. The plan is periodically drilled with incident response team members and includes robust processes for identification, categorization, escalation and reporting of incidents. Team members are regularly trained on key cybersecurity subjects to ensure awareness. In June 2024, a cybersecurity incident occurred involving CDK, a third-party provider of certain information systems used by us, that triggered our information security incident response plan. Although the incident disrupted our operations, we believe our response plan operated substantially as we intended and the incident did not materially impact our financial condition or results of operations. The incident, however, provided us an opportunity to test our response plan, refine our procedures and consider improvements.


text: Our Board oversees our cybersecurity and data protection strategy and appoints a director to lead the Board's efforts. Our Board is briefed on our cybersecurity posture, current and future risks and potential incidents or vulnerabilities on a quarterly basis. Board members and executives participate in engagements on cybersecurity, such as simulated cyber incident response and crisis management exercises. Our Board also regularly receives and reviews third-party cybersecurity assessments, which include assessments of our cyber maturity and cyber risk.


text: Management's Assessment and Response to Material Risks from Cybersecurity Threats Our information security team and its leadership have primary responsibility for assessing and managing cybersecurity risks, within the scope of the overall ERM Committee.


text: Our Senior Director of Information Security is responsible for identifying, assessing, and managing risks from cybersecurity threats. The Senior Director of Information Security manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security management team, through internal cyber risk management processes. The Senior Director of Information Security reports to the Chief Technology and Innovation Officer (CTIO) and provides frequent and up to date reporting on cyber risk to our ERM Committee, a cross functional executive-level steering group, which includes the CTIO and has a wealth of experience in enterprise risk. The ERM Committee meets on a quarterly basis or as necessary to assess and respond to enterprise risks, including cybersecurity, and reports updates to the Board.


text: The Senior Director of Information Security has over 10 years of experience in senior level information security roles, has over 20 years' experience in Fortune 500 enterprise IT roles, and holds Associate and Bachelor Degrees and the Certified Information Security Manager (CISM) Professional certification, amongst others. The members of our information security management team have extensive experience in technology and security roles, possessing cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Cisco Certified Network Professional (CCNP) and Global Certified Incident Handler (GCIH), amongst others."


text: In the past two years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND XXII LTD PARTNERSHIP


text: The Management Company's third-party advisor has performed cybersecurity risk assessments of its information technology security processes and implemented technologies to lessen risk. Using third party services, the Management Company monitors, scans, assesses, audits, and remediates identified vulnerabilities across its networks, as appropriate. Furthermore, recognizing that the Management Company's employees are an essential line of defense in cybersecurity, it requires employees to participate in training and testing programs through which it provides education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. The Management Company's policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: The Management Company's cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of its ongoing cybersecurity vulnerability management, and it endeavors to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to its networks and applications, along with detection of potential unusual activity within its networks or applications. Any potential cybersecurity incident is immediately reported to the President and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the entity's cyber risk management program, typically on an annual basis.


text: There have been no cybersecurity incidents which have materially affected the Management Company to date, including its business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect the Management Company, including its execution of business strategy, reputation, results of operations and/or financial condition.


text: In the past three years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.


text: In the past three years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND 25 LLC


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Entity's cyber risk management program, typically on an annual basis.


text: We are committed to safeguarding our stakeholders' sensitive information shared in the application of software and services provided by the Company. We believe that our cybersecurity program, risk management and governance reflect our commitment to our stakeholders.

companyName: Simulations Plus, Inc.

ticker: SLP


text: We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive cyber security program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our stakeholders' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, and OWASP Top 10, we prioritize the identification and assessment of risks to create a protective shield around our customers' data. This guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers.


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management and Board of Directors, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy notice reflects this by incorporating internal audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.


text: As of the date of this Report, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors included elsewhere in this Report.


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity program. Our Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security program. In the oversight of the program, the Board is focused on cybersecurity risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: We have engaged a third party consulting firm, VeraSafe, as our DPO. The DPO is responsible for ensuring that we have a Personal Data Protection program in place that is compliant with data privacy laws such as the EU GDPR, UK GDPR, China's PIPL, and data privacy laws enacted at the state level, as applicable to us. Our corporate Personal Data Protection program includes policies, practices, and training directed to protecting personal data.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security program is overseen by our VP of Information Technology, supported by corporate leadership from legal and finance. Our VP of Information Technology and the support team is accountable for the program. Our function and business unit executive leadership, acting in support of the VP of Information Technology and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Data Privacy Officer, are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.


text: Our VP of Information Technology and support team also have a reporting responsibility to the executive leadership and the Board. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the Board and other stakeholders on an as needed basis. The Board receives regular reports from management on our cybersecurity program, risks and activity.


text: We have established processes to ensure that management is informed about and monitors cybersecurity incident prevention, detection, mitigation, and remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of the security and privacy program.


text: We recognize that cybersecurity risks pose a significant threat to our business, clients, and stakeholders, and we have implemented a comprehensive cybersecurity program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our stakeholders' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, and OWASP Top 10, we prioritize the identification and assessment of risks to create a protective shield around our clients' data. This guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, auditing our vendors and audits from clients.


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management and Board of Directors, mitigation, remediation, and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Furthermore, we conduct annual cybersecurity awareness training for our employees to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy notice reflect this by incorporating internal audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity program. Our Board of Directors (the " Board ") is ultimately responsible for the oversight of the Company's security program. In the oversight of the program, the Board is focused on cybersecurity risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: The Data Protection Officer ("DPO") is responsible for ensuring that we have a Personal Data Protection program in place that is compliant with data privacy laws such as the EU GDPR, UK GDPR, China's PIPL, and data privacy laws enacted at the state level, as applicable to us. Our corporate Personal Data Protection program includes policies, practices, and training directed to protecting personal data.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security program is overseen by our VP of Information Technology, supported by corporate leadership from legal, compliance and finance. Our VP of Information Technology and the support team is accountable for the program. Our functional area executive leadership, acting in support of the VP of Information Technology, the DPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and DPO, are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.


text: Our VP of Information Technology and support team also have a reporting responsibility to the executive leadership and the Board. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the Board and other stakeholders on an as needed basis. The Board receives regular reports from management on our cybersecurity program, risks and activity. Our VP of Information Technology has more than 25 years of experience in IT infrastructure, cybersecurity operations, and software engineering.


text: 8x8 recognizes the critical importance of cybersecurity in maintaining the integrity, confidentiality, and availability of its systems and data. As a leading provider of communication and collaboration solutions, 8x8 is committed to safeguarding its assets, including customer data, from evolving cybersecurity threats.

companyName: 8X8 INC /DE/

ticker: EGHT


text: 8x8's cybersecurity program is aligned with the National Institute of Standards and Technology, or NIST, cybersecurity framework, a widely recognized set of guidelines for managing and mitigating cybersecurity risks. By leveraging the National Institute of Standards and Technology framework, 8x8 has implemented a comprehensive and structured approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents.


text: At 8x8, cybersecurity is integral to the enterprise-wide risk management program. The Chief Information Security Officer, or CISO holds a pivotal role in overseeing the Company's cybersecurity initiatives. The Company's Chief Information Security Officer has served in various security leadership roles, including at a Fortune 500 technology company, and is a Certified Information System Security Professional, or CISSP, and a Licensed Private Investigator, and completed Harvard University's Cybersecurity Managing Risk in 2021. He also held a United States Top Secret / Sensitive Compartmentalized Information, or TS/SCI, security clearance when he advised the White House, Pentagon, National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation on classified projects. Reporting directly to the Chief Legal Officer, who in turn reports to the CEO, the Chief Information Security Officer is empowered to lead the Executive Risk Management Committee. Through this committee, critical cybersecurity issues are monitored, addressed, and escalated as necessary.


text: Furthermore, the Chief Information Security Officer provides regular updates and presentations directly to the Board of Directors on cybersecurity matters. This direct line of communication ensures that the Board remains informed and engaged in understanding and managing cybersecurity risks facing the Company.


text: To enhance oversight and governance in this area, 8x8's Board of Directors has established the Technology & Cybersecurity Committee. This committee focuses specifically on the Company's technology, products, and cybersecurity program, providing strategic guidance and oversight to ensure alignment with business objectives and industry standard practices.


text: Transparent reporting and communication are key components of 8x8's cybersecurity program. Incidents are promptly reported to the Chief Information Security Officer, who is responsible for escalating to relevant stakeholders, including executive leadership, the internal disclosure committee, and the Board of Directors, as required. Regular communication channels ensure that stakeholders are kept informed of the Company's cybersecurity posture and any emerging threats or incidents.


text: 8x8 conducts thorough assessments to determine the potential impact and materiality of cybersecurity incidents. 8x8's Chief Information Security Officer is a member of 8x8's internal disclosure committee emphasizing the importance of cybersecurity as part of 8x8's disclosure controls and procedures. By evaluating factors such as the nature of the incident, the extent of data exposure, and potential regulatory implications, the Company assesses the significance of cybersecurity events, which helps it take appropriate measures to mitigate risks, minimize impact and properly report any material cybersecurity incidents.


text: 8x8 has developed and implemented a comprehensive Incident Response Plan, or IRP, to effectively manage cybersecurity incidents. The Incident Response Plan outlines clear reporting and escalation processes, delineating roles and responsibilities for incident response team members. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.


text: The cybersecurity program at 8x8 is fully integrated with the Company's overall risk management program through our Chief Information Security Officer's participation in such governance structures as the executive risk management committee, data protection committee, and internal disclosure committee and the incorporation of security in the Company's overall compliance and enterprise risk management programs. By aligning cybersecurity initiatives with 8x8's broader enterprise risk management initiatives, 8x8 pursues a holistic approach to identifying, assessing, and mitigating risks across the organization.


text: 8x8 conducts regular risk assessments to identify and prioritize cybersecurity risks. Through measures such as vulnerability assessments, and penetration testing, the Company identifies potential vulnerabilities and takes proactive steps to address them. 8x8 has also implemented technical, administrative and legal controls to manage our risk from third party service providers, including implementation of a third-party vendor risk management platform. Individuals or entities have attempted, and will continue to attempt, to penetrate our network security, and that of our platform, to try to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or causing interruptions of our products and platform. See the sections entitled "Risks Related to our Products and Operations" and "Risks Related to Regulatory Matters" in Part I, Item 1A "Risk Factors" for more information on our cybersecurity risks.


text: 8x8 invests in comprehensive training and awareness programs to educate employees about cybersecurity best practices and their roles in safeguarding company assets. By promoting a culture of cybersecurity awareness, 8x8 strengthens its overall security posture and reduces the risk of human error leading to cybersecurity incidents.


text: 8x8 collaborates with third-party auditors, consultants, and participates in bug bounty programs to enhance its cybersecurity capabilities. External audits and assessments provide independent validation of the effectiveness of 8x8's cybersecurity controls, while bug bounty programs leverage the collective expertise of the cybersecurity community to identify and address potential vulnerabilities.


text: 8x8 prioritizes cybersecurity as a fundamental aspect of its operations and is dedicated to maintaining a robust cybersecurity program aligned with industry practices and regulatory standards. Through strong governance, risk management, and continuous improvement efforts, 8x8 aims to protect its systems, data, and stakeholders from cybersecurity risks.


text: 8x8 recognizes that cybersecurity is critical to the trust placed in our platform by customers, partners, and other stakeholders. The Company is committed to maintaining the confidentiality, integrity, and availability of its systems and data through a comprehensive cybersecurity risk management and governance framework.