text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of the FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.


text: At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy's cyber security program. The CISO has 5 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology. The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification. The CISO reports directly to FirstEnergy's Chief Information Officer. Under the CISO's oversight, FirstEnergy's cyber security team implements and provides governance and functional oversight for cyber security controls and services. Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Chief Information Officer, legal, and the executive leaders as appropriate based on the severity of any such risk or incident. In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.

companyName: FIRSTENERGY CORP

ticker: FE

secItem: Item 1C


text: In the event of any significant cyber security incident, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by a cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the Chief Information Officer, Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit and Operations and Safety Committees or full FE Board.


text: Although the risks from cyber threats have not materially affected FirstEnergy's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.


text: FirstEnergy seeks to protect its customers, employees, facilities and the ongoing reliability of the electric system. FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security risks, exchange information, and put safeguards in place to comply with strict reliability and security standards. From a security standpoint, the electric utility sector is one of the most regulated industries.


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the Audit Committee, the Operations and Safety Committee, and the FE Board, as described in greater detail below.


text: Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats. FirstEnergy's written policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated. FirstEnergy aims to align its cyber security program with national standards. For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards. FirstEnergy also complies with various state laws and regulations on cyber security.


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year. These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's written policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.


text: To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks. In 2024, FirstEnergy also evaluated its current third-party vendors to identify which vendors had similar access to personally identifiable information and is currently reviewing the results of its analysis.


text: FirstEnergy conducts cyber security exercises and training. For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates personnel on FirstEnergy's policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems. FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy's utility and business functions. FirstEnergy's management also holds executive cyber security incident tabletop exercises to train on cyber security incident response.


text: Additionally, FirstEnergy leverages third-party security firms in various capacities to assist with various aspects of FirstEnergy's cyber security program, including risk assessments, vulnerability scans, and penetration testing. FirstEnergy uses a variety of processes to address cyber security threats related to the use of third-party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of FirstEnergy's process to continuously improve its cyber and information security programs, FirstEnergy also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs. In addition to the aforementioned efforts, FirstEnergy also strongly considers cyber security risks as a part of its overall strategy and invests heavily in sophisticated and layered security measures that use both technology and hard defenses to protect critical transmission facilities and its digital communications networks. For example, security enhancements to FirstEnergy's transmission infrastructure, such as enhanced cyber security monitoring and alarming are a key component of FirstEnergy's transmission investment program.


text: Despite the security measures and safeguards FirstEnergy has employed, including certain measures implemented pursuant to mandatory NERC Critical Infrastructure Protection standards, FirstEnergy's infrastructure may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to information technology systems may be made. Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and to the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.


text: At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy's cyber security program. The CISO has 6 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology. The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification. The CISO reports directly to FirstEnergy's Senior Vice President, Shared Services, who is responsible for all of FirstEnergy's digital and technology services and is FirstEnergy's most senior information technology executive. Under the CISO's oversight, FirstEnergy's cyber security team implements and provides governance and functional oversight for cyber security controls and services. Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Senior Vice President, Shared Services, legal, and the executive leaders as appropriate based on the severity of any such risk or incident. In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.


text: In the event of any significant cyber security incident, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the Senior Vice President, Shared Services, the Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit Committee and Operations and Safety Committee, or the full FE Board.


text: We maintain a comprehensive process for: (i) identifying the assets, threats, and vulnerabilities that affect our information systems and networks; (ii) analyzing the likelihood and impact of potential cyberattacks on our assets, operations, and objectives; (iii) evaluating the existing cybersecurity controls and measures that we have in place to prevent, detect, and respond to cyberattacks; and (iv) implementing and monitoring the appropriate cybersecurity solutions and practices that reduce our cyber risk exposure and enhance our cyber resilience.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: In doing so, our Global IT Security Team, which is comprised of dedicated privacy and security professionals and run by our Chief Information Security Officer ("CISO"), stays abreast of security industry and threat trends and regularly seeks to improve our cybersecurity risk management program. Our executive leadership team, with input and guidance from our CISO, is responsible for our overall enterprise risk management system and processes, and regularly considers cybersecurity risks in the context of other material risks to the Company.


text: As part of our overall cybersecurity strategy, as and when we detect cybersecurity threats, our Global IT Security team documents the relevant incident details, assesses the impact and severity of it, identifies the root cause and corrective actions, and communicates the incident to our CISO and any other relevant parties as needed. We also seek to address cybersecurity risks associated with our third-party vendors by making our Global IT Security team a key part of relevant vendor onboarding, whereby we conduct comprehensive risk assessments of such vendors' cybersecurity policies and practices. When necessary, we utilize third party auditors and consultants to assess third-party cybersecurity risks, and we consult with outside counsel as appropriate, including on materiality analysis and disclosure matters. Our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: Our full Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, and, in conjunction with the Audit Committee, the related effects, if any, on financial reporting and internal controls. Our Chief Digital Officer and Chief Legal Officer, in conjunction with members of the Global IT Security team, regularly update the Board of Directors on the Company's cybersecurity risk profile and incidents, if any, and our overall cybersecurity strategy and process improvements.


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, refer to Item 1A. Risk Factors of this Annual Report on Form 10 K.


text: In doing so, our Information Security Team, which is comprised of dedicated privacy and security professionals and run by our Chief Information Security Officer ("CISO"), stays abreast of security industry and threat trends and regularly seeks to improve our cybersecurity risk management program. Our executive leadership team, with input and guidance from our CISO, is responsible for our overall enterprise risk management system and processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Our CISO, who has over 15 years' experience in cybersecurity and 30 years' experience in software engineering, design, and development, has been with the Company for more than ten years and has helped grow the Company's Information Security Team into its current mature form.


text: As part of our overall cybersecurity strategy, as and when we detect cybersecurity threats, our Information Security Team documents the relevant incident details, assesses the impact and severity of it, identifies the root cause and corrective actions, and communicates the incident to our CISO and any other relevant parties as needed. We also seek to address cybersecurity risks associated with our third-party vendors by making our Information Security Team a key part of relevant vendor onboarding, whereby we conduct comprehensive risk assessments of such vendors' cybersecurity policies and practices. When necessary, we utilize third party auditors and consultants to assess third-party cybersecurity risks, and we consult with outside counsel as appropriate, including on materiality analysis and disclosure matters. Our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: Our full Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, and, in conjunction with the Audit Committee, the related effects, if any, on financial reporting and internal controls. Our Chief Information Security Officer, Chief Technology Officer, and Chief Legal Officer regularly update the Board of Directors on the Company's cybersecurity risk profile and incidents, if any, and our overall cybersecurity strategy and process improvements, including the results of "tabletop" exercises, as well as the Company's insurance coverages and related matters.


text: CYBERSECURITY RISK MANAGEMENT Sempra, SDG&E and SoCalGas have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. These cybersecurity risk management processes include cybersecurity incident response plans that are integrated into each entity's respective enterprise risk management and emergency management programs.

companyName: SEMPRA

ticker: SREA


text: Our cybersecurity processes are largely designed and assessed based on the National Institute of Standards and Technology Cybersecurity Framework and the DOE's Cybersecurity Capability Maturity Model standards. This does not imply that we meet any technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management processes include: risk assessments performed by internal personnel and third-party advisors designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environments information security teams principally responsible for developing and implementing (1) cybersecurity risk assessment processes, (2) information security controls, and (3) response plans to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our information security controls cybersecurity awareness training and policies designed to address social engineering attacks targeting employees and contractors cybersecurity incident response plans that include procedures for responding to certain cybersecurity incidents risk management processes for third-party service providers, suppliers, and vendors We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our results of operations, financial condition, cash flows and/or prospects.


text: CYBERSECURITY GOVERNANCE Sempra's, SDG&E's and SoCalGas' respective boards of directors consider cybersecurity risk as part of their risk oversight function. The Sempra board of directors has delegated to its SST Committee, which is entirely composed of independent directors under the independence standards established by the NYSE, oversight of cybersecurity and other information and operational technology risks. The SST Committee reports to the Sempra board of directors regarding the Committee's activities, including those related to cybersecurity. The SST Committee receives briefings on cybersecurity topics from Sempra's chief information security officer, internal information security staff or external experts in part for continuing education on topics that impact public companies. The SST Committee as well as the SDG&E and SoCalGas boards of directors oversee management's implementation of our cybersecurity risk management processes and receive regular reports from management on our material cybersecurity risks. In addition, management updates the SST Committee and SDG&E and SoCalGas boards of directors about certain cybersecurity incidents. The SDG&E and SoCalGas boards of directors receive briefings from SDG&E's and SoCalGas' chief information officer and internal information security staff. SDG&E's and SoCalGas' boards of directors also have formed safety committees that, at times, may oversee the matters described above on behalf of those companies' respective boards of directors.


text: We have formed cybersecurity councils to provide overall corporate oversight for managing material risks from cybersecurity threats. The cybersecurity councils meet regularly to receive updates on cybersecurity developments at Sempra and our consolidated entities from their cybersecurity management teams.


text: Our cybersecurity management teams supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by information security tools deployed in the information technology environment. Cybersecurity management also supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Sempra's director of cybersecurity governance & chief information security officer provides additional oversight and support for the operational cybersecurity activities at our consolidated entities.


text: We have also formed materiality assessment teams, which include chief information security officers, chief information officers, chief risk officers, chief accounting officers or chief financial officers, and general counsels, to help assess the materiality of certain cybersecurity incidents.


text: The cybersecurity councils, cybersecurity management teams and materiality assessment teams include members with decades of operational experience as cybersecurity professionals as well as management with decades of service in the areas of information and operational technology and legal, compliance, financial reporting and enterprise risk management. Some of these members hold degrees and certifications that we believe enhance our ability to manage and respond to cybersecurity risks, including, among others, bachelor's and/or master's degrees in cybersecurity and computer science as well as certified information systems security professional, certified incident handler, and certified information security manager certifications.


text: CYBERSECURITY RISK MANAGEMENT Sempra, SDG&E and SoCalGas have cybersecurity risk management processes in place that are intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. These cybersecurity risk management processes include cybersecurity incident response plans that are integrated into each entity's respective enterprise risk management and emergency management programs.


text: Our cybersecurity risk management processes include: risk assessments performed by internal personnel and third-party advisors designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environments information security teams principally responsible for developing and implementing (1) cybersecurity risk assessment processes, (2) information security controls, and (3) response plans to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our information security controls cybersecurity awareness training and policies designed to address social engineering attacks targeting employees and contractors cybersecurity incident response plans that include procedures for responding to and reporting, if applicable, certain cybersecurity incidents risk management processes for third-party service providers, suppliers, and vendors We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our results of operations, financial condition, cash flows and/or prospects.


text: CYBERSECURITY GOVERNANCE Sempra's, SDG&E's and SoCalGas' respective boards of directors consider cybersecurity risk as part of their risk oversight function. The Sempra board of directors has delegated to its SST Committee, which is entirely composed of independent directors under the independence standards established by the NYSE, oversight of cybersecurity and other information and operational technology risks. The SST Committee reports to the Sempra board of directors regarding the Committee's activities, including those related to cybersecurity. The SST Committee receives briefings on cybersecurity topics from Sempra's chief information security officer, internal information security staff or external experts in part for continuing education on topics that impact public companies. The SST Committee as well as the SDG&E and SoCalGas boards of directors oversee management's implementation of our cybersecurity risk management processes and receive regular reports from management on our material cybersecurity risks. In addition, management updates the SST Committee and SDG&E and SoCalGas boards of directors about certain cybersecurity incidents. The SDG&E and SoCalGas boards of directors receive briefings from SDG&E's and SoCalGas' chief information officer and internal information security staff. SDG&E's and SoCalGas' boards of directors also have safety committees that, at times, may oversee the matters described above on behalf of those companies' respective boards of directors.


text: Our cybersecurity management teams supervise efforts designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by information security tools deployed in the information technology environment. Cybersecurity management also supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Sempra's director of cybersecurity governance & chief information security officer provides additional oversight and support for the operational cybersecurity activities at our consolidated entities.


text: Our cybersecurity materiality assessment teams, which include chief information security officers, chief information officers, chief risk officers, chief accounting officers or chief financial officers, and general counsels, help assess the materiality of certain cybersecurity incidents.


text: The cybersecurity councils, cybersecurity management teams and materiality assessment teams include members with decades of operational experience as cybersecurity professionals as well as management with decades of service in the areas of information and operational technology and legal, compliance, financial reporting and enterprise risk management. Some of these members hold relevant degrees and certifications that we believe enhance our ability to manage and respond to cybersecurity risks, including, among others, bachelor's and/or master's degrees in cybersecurity and computer science as well as certified information systems security professional, certified incident handler, and certified information security manager certifications.


text: Cybersecurity forms a critical component of the services we provide to our customers. We collect and utilize many different types of information, including financial, medical, human resources, and other personal information. Federal and state laws and regulations, contractual obligations, and national and international industry standards, impose obligations on us to protect the confidentiality, integrity, and availability of information relating to employees, clients, vendors, patients, and citizens. We maintain an Information Security Office (ISO), whose mission is to protect the confidentiality, integrity, and availability of data through administrative, technical, and physical safeguards.

companyName: MAXIMUS, INC.

ticker: MMS


text: Identifying, assessing, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which is our approach to identifying, assessing, and mitigating major risks. Cybersecurity threats are evaluated based on our perceived vulnerability to a particular threat and the potential impact such a threat could have, with mitigation efforts focused on the highest risks. This risk assessment is updated no less than annually and reviewed by the Board of Directors.


text: We have experienced cybersecurity incidents that were immaterial and, as previously disclosed, in the third quarter of fiscal year 2023, we experienced a material cybersecurity incident as the personal information of a significant number of individuals was accessed by an unauthorized third-party exploiting a zero-day vulnerability in a third-party vendor's file transfer application used by many organizations, including us. We have recorded expenses in connection with the investigation and remediation activities related to this incident; further details are included in "Note 15. Commitments and Contingencies" in Item 8 of this Annual Report on Form 10-K. To date, we are not aware of any other cybersecurity incidents that have had a material effect on our business. Despite our preventative and remediation efforts, we may continue to experience cybersecurity incidents in the future. There can be no guarantee that such efforts will be sufficient to protect the company's information systems, information, and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the company or its results of operations or financial condition or cause reputational or other harm to the company. Refer to Item 1A of this Form 10-K, which includes a section on "Risks Pertaining to Data and Data Security," for further discussion of the associated risks.


text: We engage third parties to conduct independent cybersecurity assessments. The assessments include technical control reviews of new technologies, penetration testing, and ongoing monitoring of our security posture. We also rely on third parties to conduct annual audits to maintain cybersecurity certifications, such as ISO 27001 and Cyber Essentials. As a government contractor, we are also subject to numerous Service Organization Control (SOC) audits each year to fulfill contractual requirements.


text: The ISO manages our security vendor risk management program. Each vendor's cybersecurity risk is ranked using a risk tiering calculator. The calculator is designed to provide a consistent methodology for evaluating key risk factors, such as the type of service or product the vendor provides and the location and classification of data. For high- and moderate-risk vendors, an assessment is completed that includes reviewing external audits and certifications (e.g., SOC 2 Type 2 audit, ISO 27001 and associated Statement of Applicability, FedRAMP authorization). As needed, an industry-standard questionnaire is completed by the vendor and the results assessed by ISO in an effort to ascertain information security maturity and overall posture. High-risk vendors are re-evaluated annually while moderate-risk vendors are evaluated every three years. Ongoing monitoring is in place for all high, moderate, and low risk vendors using an external service that rates the cybersecurity posture of corporate entities using a scored analysis of cyber threats.


text: We are in the process of implementing an enterprise-wide third-party risk management program that expands the review of vendors and includes financial and operational screening. This new solution is designed to help ensure compliance with the National Institute of Standards and Technology (NIST) supply chain risk framework that is required when supporting federal agencies.


text: Board's Roles and Responsibilities Oversight for risk management and the overall enterprise risk management strategy of the Company, including cybersecurity, is the responsibility of the Board of Directors. Risks identified are monitored by the Board as a whole or the Board may delegate oversight to a specific subcommittee. Our Technology Committee, comprised of four board members possessing relevant background and experience, assists the Board of Directors in its oversight role with respect to strategy and risk management for our information systems, information technology, or IT, and IT security, including cybersecurity.


text: The Technology Committee is briefed at least quarterly, on the quality and effectiveness of our cybersecurity practices and policies, information security program and infrastructure, and data governance and security program, along with key initiatives in this area. The Technology Committee also assesses the cybersecurity risk management strategy. This assessment includes reviews of the results of audits, testing, and metrics, including reports of third-party reviewers.


text: In the event of a cybersecurity incident, we have an incident response process and an escalation process in place to promptly identify, notify and brief the Board, including the Chair of the Technology Committee, outside of the regular reporting process in the event of an emerging or potentially material cybersecurity incident. The Board of Directors may choose to delegate responsibility for oversight of a particular cybersecurity matter to the Technology Committee in its discretion.


text: Management's Roles and Responsibilities Our cybersecurity response is handled by our information security team and managed by our Chief Information Security Officer (CISO), who reports to the Chief Financial Officer. Our CISO has over thirty years of business and technical experience in information risk, risk management, and regulatory compliance, including twelve years in a CISO role. Our information security team manages risks by establishing policies and procedures that manage information system access appropriately. These policies and procedures are tested through internal exercises and with external assistance and supplemented by training and communication to our employees and subcontractors.


text: Cybersecurity threats are constantly evolving, which drives the evolution of our responses. Typical activities for our information security team include system monitoring, new hire and annual training, testing and evaluation, including "phishing" exercises, and publication of tips and best practices. The results of this testing are communicated company-wide, including to the Technology Committee of the Board of Directors. Our CISO reports to the Technology Committee as requested, but no less than quarterly.


text: We have experienced cybersecurity incidents that were immaterial and, as previously disclosed, in the third quarter of fiscal year 2023, we experienced a material cybersecurity incident as the personal information of a significant number of individuals was accessed by an unauthorized third-party exploiting a zero-day vulnerability in a third-party vendor's file transfer application used by many organizations, including us. We recorded expenses in connection with the investigation and remediation activities related to this incident; further details are included in "Note 15. Commitments and Contingencies" in Item 8 of this Annual Report on Form 10-K. To date, we are not aware of any other cybersecurity incidents that have had a material effect on our business. Despite our preventative and remediation efforts, we may continue to experience cybersecurity incidents in the future. There can be no guarantee that such efforts will be sufficient to protect our information systems, information, and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on our results of operations or financial condition or cause reputational or other harm to us. Refer to Item 1A of this Form 10-K, which includes a section on "Risks Pertaining to Data and Data Security," for further discussion of the associated risks.


text: The ISO manages our security vendor risk management program. Each vendor's cybersecurity risk is ranked using a risk tiering calculator. The calculator is designed to provide a consistent methodology for evaluating key risk factors, such as the type of service or product the vendor provides and the location and classification of data. For high- and moderate-risk vendors, an assessment is completed that includes reviewing external audits and certifications (e.g., SOC 2 Type 2 audit, ISO 27001 and associated Statement of Applicability, or FedRAMP). As needed, an industry-standard questionnaire is completed by the vendor and the results assessed by ISO in an effort to ascertain the vendor's information security maturity and overall posture. High-risk vendors are re-evaluated annually while moderate-risk vendors are evaluated every three years. Ongoing monitoring is in place for all high and moderate risk vendors using an external service that rates the cybersecurity posture of corporate entities using a scored analysis of cyber threats.


text: Board's Roles and Responsibilities Oversight for risk management and the overall enterprise risk management strategy of the Company, including cybersecurity, is the responsibility of the Board of Directors. Risks identified are monitored by the Board as a whole or the Board may delegate oversight to a specific subcommittee. Our Technology Committee, comprised of four board members possessing relevant background and experience, assists the Board of Directors in its oversight role with respect to strategy and risk management for our information systems, IT, and cybersecurity.


text: The Technology Committee is briefed at least quarterly, on the quality and effectiveness of our cybersecurity practices and policies, information security program, and data governance and security program, along with key initiatives in these areas. The Technology Committee also periodically assesses the cybersecurity risk management strategy. This assessment includes reviews of the results of audits, testing, and metrics, including reports of third-party reviewers.


text: Management's Roles and Responsibilities Our cybersecurity response is handled by our information security team and managed by our Chief Information Security Officer (CISO), who reports to the Chief Financial Officer. Our CISO has over thirty years of business and technical experience in information risk, risk management, and regulatory compliance, including thirteen years in a CISO role. Our information security team manages risks by establishing policies and procedures that manage information system access appropriately. These policies and procedures are tested through internal exercises and with external assistance and supplemented by training and communication to our employees and subcontractors.


text: Cybersecurity threats are constantly evolving, which drives the evolution of our responses. Typical activities for our information security team include system monitoring, new hire and annual training, testing and evaluation, including "phishing" exercises, and publication of tips and best practices. The results of this testing are communicated to corporate leadership, including to the Technology Committee of the Board of Directors. Our CISO reports to the Technology Committee as requested, but no less than quarterly.


text: Maintaining people's trust is of paramount importance for Logitech. Logitech's security capability is designed to protect the confidentiality, integrity, availability and accessibility of Logitech's information, digital assets, products and services. Our security capability includes: (i) cybersecurity, which protects information and digital assets used at Logitech to conduct business and (ii) product security, which protects Logitech products and services provided to our customers.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: We have established a Security Governance Framework that defines roles and responsibilities, so that security is taken into account at all levels and in every department or function of the Company.


text: Identifying and assessing cybersecurity risk is integrated into our enterprise risk management. We have implemented incident response and breach management processes that include the following steps: mobilizing the right stakeholders and containing the attack, maintaining trust with all affected stakeholders and understanding the attack, recovering the most critical business operations, and learning from the attack. We also conduct tabletop exercises to, among other things, align activities and expectations in connection with our incident response processes, discuss strategic questions, and review third party recommendations.


text: Our security framework provides guidance for the organization, governance and implementation of security across the company. Logitech and its infrastructure have been certified for compliance with ISO 27001, an international standard for information security management.


text: As part of our risk management program, we continuously assess risks from third parties, including vendors, suppliers, and other business partners associated with our use of third-party service providers.


text: We have not previously experienced a cybersecurity event that was determined to be material, and our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For additional information regarding risks from cybersecurity threats, please refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K.


text: Board of Directors and Board Committees Oversight of Risks from Cybersecurity Threats Logitech's Board of Directors oversees risk management and reviews Logitech security risks, controls and procedures. The Board of Directors is assisted in its role by each of the Audit Committee and the Technology and Innovation Committee. The Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a semi-annual basis from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity. The Technology and Innovation Committee periodically reviews the Company's cybersecurity, information security and other technology risks, controls and procedures, including product security and related threats. Finally, the Board has formed a Cyber Crisis Subcommittee tasked with overseeing any future significant cybersecurity crisis.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Cybersecurity Team is tasked, among other things, with evaluating, reporting and advising about cybersecurity risks, defining and leading the enterprise cybersecurity program to protect Logitech business against cybersecurity threats, maintaining and updating the cybersecurity framework, monitoring the level of compliance with the cybersecurity framework across Logitech digital assets and services, providing enterprise-wide cybersecurity services, defining cybersecurity standards and advising on secure architectures, performing assessments and due diligence checks internally and with business partners, providing cybersecurity guidance for digital projects, creating and deploying cybersecurity training programs, managing cybersecurity incidents and breaches, and monitoring cybersecurity threats. The Cybersecurity Team, which is part of the IT organization, is led by the CISO, who has 20 years of cybersecurity experience across different industries. The Cybersecurity Team leads the enterprise cybersecurity strategy and roadmap, which applies to all information and digital assets, used at Logitech to conduct business. Our cybersecurity is managed based on industry-leading standards such as ISO 27001, National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS).


text: Our Product Security Team is responsible for the development of product security policies and standards for the Company, including supporting product security threat identification, supporting product security risk assessment, building and maintaining security policies, standards and guidelines, performing internal audits against the product security policies and standards, performing product security architecture analysis and reviews, raising product security awareness across the Company, monitoring product security through the product development lifecycle, and managing vulnerabilities (pre- and post-production). The Head of Product Security, who reports to our Head of Software, is accountable for the release or deployment approval of a product based upon the review of internal and external validation (functionality, performance, security) reports. Our Head of Software has more than 20 years of experience leading software teams, including over a decade in the cybersecurity industry. We assess our product security programs against the Open Worldwide Application Security Project (OWASP) Application Security Verification Standard (ASVS) and the Software Assurance Maturity Model (SAMM).


text: Our CISO and the Head of Software regularly report on cybersecurity and product security matters, respectively, to the Audit Committee and/or the Technology and Innovation Committee and the Board of Directors.


text: Maintaining people's trust is of paramount importance for Logitech. Logitech's security capability is designed to protect the confidentiality, integrity, availability and accessibility of Logitech's information, digital assets, products and services.


text: We have established a Security Governance Framework that defines roles and responsibilities, so that security is taken into account at all levels and in every department or function of the Company. Our framework provides guidance for the organization, governance and implementation of security across the company. Logitech and its infrastructure have been certified for compliance with ISO 27001, an international standard for information security management.


text: Identifying and assessing cybersecurity risks is integrated into our enterprise risk management. As part of our risk management program, we continuously assess risks from third parties, including vendors, suppliers, and other business partners associated with our use of third-party service providers. We have implemented incident response and breach management processes that include the following steps: mobilizing the right stakeholders and containing the attack, maintaining trust with all affected stakeholders and understanding the attack, recovering the most critical business operations, and learning from the attack. We also conduct tabletop exercises to, among other things, align activities and expectations in connection with our incident response processes, discuss strategic questions, and review third party recommendations.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Security Team is responsible for evaluating, reporting and advising about security threats and risks, defining and leading the enterprise security program to protect Logitech business against security threats, maintaining and updating the security framework, monitoring the level of compliance with the security framework across Logitech digital assets, products and services, providing enterprise-wide security services, defining security policies, standards and guidelines, advising on secure architectures, performing assessments and due diligence checks internally and with business partners, providing security guidance for digital projects, creating and deploying security training programs, managing security incidents and breaches, and conducting threat intelligence and managing vulnerabilities.


text: Our Security Team also monitors security through the entire software and product development lifecycle. The Head of Application and Product Security is accountable for the release or deployment approval of a product based upon the review of internal and external validation (functionality, performance, security) reports.


text: The Security Team, which is part of the Digital Office organization, is led by the CISO, who has 20 years of security experience across different industries. The CISO reports to our Head of Digital Office, who has more than 20 years of experience leading software and infrastructure teams, including over a decade in the cybersecurity industry. Our security is managed based on industry-leading standards such as ISO 27001, National Institute of Standards and Technology (NIST), Center for Internet Security (CIS), Open Worldwide Application Security Project (OWASP) Application Security Verification Standard (ASVS) and the Software Assurance Maturity Model (SAMM).


text: Our CISO and the Head of Digital Office regularly report on cybersecurity to the Audit Committee and/or the Technology and Innovation Committee and the Board of Directors.


text: Management & Strategy A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We have a comprehensive, cross-functional approach to cybersecurity risk management, driven by our information security management systems and propelled by industry-leading expertise from both our internal information technology security team and top-tier third-party consultants and firms that we engage. Our cyber risk management process is supported by both management and our Board of Directors.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our cybersecurity risk management strategies represent an integral component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and based on the recognized National Institute of Standards and Technology (NIST) Cybersecurity Framework. We continuously seek to adopt market-leading standards and procedures to protect our tower infrastructure, data, and carrier and consumer information. Key elements of our cybersecurity risk management strategy include:


text: (1)System Monitoring and Testing. We work collaboratively with third-party industry experts and consultants to conduct regular vulnerability assessments and penetration testing from both outside and within our system networks. Our information security team utilizes endpoint software together with technology platforms and applications designed to enable it to monitor user and network behavior and origination points in real time both at our corporate headquarters as well as any of our sites globally. In addition, we conduct quarterly phishing campaign simulations which include notification of the respective Executive Vice President in the event of a failure by an employee in their department.


text: (2)Threat Identification & Response. Our internal information security team works collaboratively with our external industry consultants to identify threats utilizing analytics and metrics, which are aligned with the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework, and mitigate attacks across various layers of our enterprise systems. We leverage the core functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover) to constantly work toward identifying opportunities for further improvement and development of our risk mitigation strategies. We also build upon the principles of the ISO 27001 standard and have achieved ISO 27001:2013 certification for one of our data centers. As part of our response preparedness, our executive management team participates in comprehensive tabletop exercises annually simulating cybersecurity breaches or other incidents which simulate identifying, responding and reporting of such an incident in accordance with our risk management programs.


text: (3)Defense Procedures & Preparedness. We have established and maintain a data incident response and a business continuity management plan to timely, consistently, and appropriately address cyber threats that may occur despite our safeguards. The response plan is global in scope and covers the major phases of the incident response process, including preparation, detection and analysis, containment and investigation, notification (which may include timely notice to our Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. Our response plan is reviewed annually, regularly tested, and updated based on developments in the industry. Our business continuity management system includes targets and objectives, impact analyses and risk assessments, exercise and testing, training and awareness, documentation and standards for data centers and servers.


text: (4)Outside Consultants & Industry Experts. In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, security firms, auditors, and other third-party subject matter experts, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our cybersecurity programs. We are also members of recognized global industry organizations such as the Information Systems Audit and Control Association (ISACA), International Information System Security Certification Consortium (ISC), and International Association of Privacy Professionals (IAPP).


text: (5)Third-Party Risk Assessments. We maintain a comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks presented by third parties, including our vendors and service providers. We have a dedicated information technology vendor management team that reports to our Chief Information Officer ("CIO"). We conduct initial and regular cybersecurity assessments of third-party vendors that we engage with in our operations and their information security policies and systems in order to identify, evaluate, and address potential vulnerabilities.


text: (6)Team Member Education & Awareness. We remain dedicated to fostering an internal culture of cybersecurity, where all of our team members are trained to identify, respond, and report potential cybersecurity threats that may arise. New hires are required to participate in cybersecurity onboarding training, and current employees are responsible for completing mandatory cybersecurity training annually and phishing awareness training quarterly. Our leadership team participates in advanced, targeted cybersecurity training and exercises to ensure additional security.


text: As part of our cybersecurity risk management strategy, each cyber threat is evaluated for materiality and escalated based upon evaluation of the potential severity and risk impact on our operations. We have not experienced a material cybersecurity breach in the past three years. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from penalties or settlements related to a cybersecurity breach during that time. For more information regarding cybersecurity-related risks that could materially affect our business strategies, results of operations, or financial condition, please see Item 1A in this Form 10-K under the headings "Security breaches and other disruptions could compromise our information, which would cause our business and reputation to suffer."


text: Governance & Personnel Our Board believes a robust cybersecurity strategy is vital to protect our business, customers, and assets. The Board has delegated to the Audit Committee responsibility for oversight and review of our cybersecurity and other information technology and data privacy risk management program, controls, strategies, and procedures. The Audit Committee periodically evaluates our cybersecurity strategies to ensure effectiveness and, if appropriate, includes a review from third-party experts. In addition, our Board also may review and assess cybersecurity risks as part of its responsibilities for general risk oversight.


text: Our CIO reports to the Audit Committee at every regularly scheduled meeting (or more frequently, as needed) to discuss cybersecurity risk exposure and risk management strategy. Our CIO has over 25 years of experience in the information technology and security industry with global organizations. Our executive leadership team, which includes our CIO, reviews and manages implementation of our cybersecurity strategy and programs through regularly scheduled meetings.


text: Our information security team, led by our CIO and Senior Director, IT Security and Compliance, has over 75 years of collective cybersecurity experience and maintain numerous active industry-recognized cyber certifications, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and Certified Information Systems Auditor (CISA). Our information security team undertakes a variety of measures in the daily monitoring and management of cybersecurity risks across our business. For example, the information security team monitors our technology infrastructure with tools designed to detect suspicious behavior and decrypt VPN traffic on our systems globally. The information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in its cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of our cybersecurity program. In addition, our information security team works with our internal audit function to monitor reporting and escalation of cybersecurity incident reports from across our business.


text: Our cybersecurity risk management strategies represent an integral component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and based on the recognized National Institute of Standards and Technology (NIST) Cybersecurity Framework. We continuously seek to adopt market-leading standards and procedures to protect our tower infrastructure, data, and carrier, vendor, and consumer information. Key elements of our cybersecurity risk management strategy include:


text: (5) Third-Party Risk Assessments. We maintain a comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks presented by third parties, including our vendors and service providers. We have a dedicated information technology vendor management team that reports to our Chief Information Officer ("CIO"). We conduct initial and regular cybersecurity assessments of third-party vendors that we engage with in our operations and their information security policies and systems in order to identify, evaluate, and address potential vulnerabilities.


text: (6)Team Member Education & Awareness. We remain dedicated to fostering an internal culture of cybersecurity, where all of our team members are trained to identify, respond, and report potential cybersecurity threats that may arise. New hires are required to participate in cybersecurity onboarding training, and current employees are responsible for completing mandatory cybersecurity training annually and phishing awareness training quarterly. Our leadership team participates in advanced, targeted cybersecurity training and exercises to ensure additional security. Our leadership team also participates in table-top exercises and trainings tailored to specific business units. For example, most recently our internal audit and finance teams participated in a successful table-top exercise which simulated cyber-attacks on our payroll and financial systems. All of our table-top exercises are facilitated by a third-party.


text: As part of our cybersecurity risk management strategy, each cyber threat is evaluated for materiality and escalated based upon evaluation of the potential severity and risk impact on our operations. We have not experienced a material cybersecurity breach in the past three years. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from penalties or settlements related to a cybersecurity breach during that time. For more information regarding cybersecurity-related risks that could materially affect our business strategies, results of operations, or financial condition, please see Item 1A in this Form 10-K under the headings "Information technology disruptions, including as a result of cybersecurity breaches, could compromise our information, which would cause our business and reputation to suffer."


text: Governance & Personnel Our Board believes a robust cybersecurity strategy is vital to protect our business, customers, and assets. The Board has delegated to the Audit Committee responsibility for oversight and review of our cybersecurity and other information technology and data privacy risk management program, controls, strategies, and procedures. The Audit Committee periodically evaluates our cybersecurity strategies to ensure effectiveness and, if appropriate, includes a review from third-party experts. In addition, our Board also may review and assess cybersecurity risks as part of its responsibilities for general risk oversight. Additionally, the Audit Committee has established a subcommittee to evaluate cybersecurity incidents, if any, and determine the Company's disclosure obligations in light of such incidents.


text: Our information security team, led by our CIO and Senior Director, IT Security and Compliance, has over 75 years of collective cybersecurity experience and maintains numerous active industry-recognized cyber certifications, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and Certified Information Systems Auditor (CISA). Our information security team undertakes a variety of measures in the daily monitoring and management of cybersecurity risks across our business. For example, the information security team monitors our technology infrastructure with tools designed to detect suspicious behavior and decrypt VPN traffic on our systems globally. The information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in its cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of our cybersecurity program. In addition, our information security team works with our internal audit function to monitor reporting and escalation of cybersecurity incident reports from across our business. Our information security team also works with our Executive Vice President, Chief Administrative Officer and General Counsel on our data privacy program, including with respect to the preservation and protection of the integrity and confidentiality of our data and systems.


text: We take an enterprise approach to information security risk management and governance. Our information security program and framework comprise processes, policies, practices, systems, and technologies that are designed to identify, assess, prioritize, manage, and monitor risks to our information systems, including risks from cybersecurity threats and events and risks associated with the use of third-party service providers.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Our established recovery approach is designed to provide for the ready availability and use of our business-critical processes in the event of any downtime, disaster, or outages. We also seek to identify and mitigate the risks associated with the use of third-party service providers through the review of their security programs prior to our engagement thereof. Additionally, our control environment and internal audit process bring a systematic, disciplined approach to evaluate our risk management, control, and governance processes concerning cybersecurity and our information security framework.


text: We have a cybersecurity Incident Response Plan (IRP) that sets forth a process to obtain information, coordinate activities, assess results, and communicate applicable developments to our employees, law enforcement, other external parties and agencies, and our Board. The IRP includes the following major components: preparation, detection and analysis, containment, eradication, notification, recovery, reporting, and lessons learned. Specific incident response playbooks have also been prepared for data breaches, malware, unauthorized remote access, and ransomware, which include applicable legal protocols. We have also retained certain third-party experts to assist us with various aspects of incident assessment and response in the event those services become necessary or useful.


text: Typically, we (i) perform periodic tabletop exercises with a company-wide cross-functional team that is facilitated by a third-party expert and is intended to simulate a real-life security incident, (ii) conduct penetration testing as needed and annually conduct Payment Card Industry Data Security Standard testing and firewall reviews, and have periodically engaged a third-party expert to help therewith, (iii) hold annual cybersecurity awareness trainings, and (iv) periodically engage a third-party expert to conduct a review of our information security framework, which helps to identify existing and emerging risks, and mitigate against such risks. These internal efforts and external third-party reviews also support our ability to regularly assess our information security program and framework against emerging risks, market and industry developments and provide opportunities to make adjustments or enhancements when deemed prudent or necessary. To date, there have been no cybersecurity incidents that have materially affected us, or that are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations.


text: For additional information on the cybersecurity risks we face, see "ITEM 1A. RISK FACTORS—Cybersecurity and Privacy Related Risks—We are subject to risks arising from a significant breach of our information systems."


text: Our Board's Role in Cybersecurity Oversight Oversight of risk management, including with respect to risks from cybersecurity threats, is the responsibility of our Board, which exercises its oversight responsibilities both directly and through its committees. The Audit Committee of our Board has formal oversight responsibilities established in its committee charter concerning our initiatives and strategies respecting cybersecurity and information technology risks. At least once annually, the heads of our information services and internal audit teams provide a report to the Audit Committee on cybersecurity and information technology risks, as well as our information security operations, structure, framework, various cybersecurity and information technology metrics, our cybersecurity and information security management and improvement efforts, future projects, and our governance and assessments related to cybersecurity and information technology. The chair of the Audit Committee reports to the Board a summary of the information presented by the heads of our information services and internal audit teams during their cybersecurity update. Periodically, the Board also receives reports on such matters directly. As noted above, the IRP also contains notification procedures to the Board.


text: Management's Role in Assessment and Management of Material Risks from Cybersecurity Threats We have an Information Security Committee (Infosec Committee) consisting of refining, renewable diesel, ethanol, logistics, and information services personnel that meets weekly to evaluate third-party exchange of data and collaborate on strategy for dealing with information security risks and other related matters. The Infosec Committee reports to our Information Security Oversight Committee (Infosec Oversight Committee) and our Executive Steering Committee on cybersecurity (Executive Steering Committee). Our Infosec Oversight Committee consists of information services, refining, and internal audit personnel and meets quarterly to discuss network threats and the overall security landscape. Our Executive Steering Committee consists of management within our information services, internal audit, refining, renewable diesel, ethanol, legal, and logistics teams, and meets twice per year to review and discuss information security metrics and results of security assessments, among other items. Key members of the Infosec Oversight Committee and the Executive Steering Committee provide a report to the Audit Committee of the Board as discussed above.


text: Our information services team is led by our Vice President Information Services & Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology and/or cybersecurity areas. On a monthly basis, our Vice President Information Services & Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred. If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.


text: Our established recovery approach is designed to provide for the ready availability and use of our business-critical processes in the event of any downtime, disaster, or outages. We also seek to identify and mitigate the risks associated with the use of third-party service providers through the review of their security programs prior to our engagement thereof. Additionally, our control environment and internal audit process are designed to bring a systematic, disciplined approach to evaluate our risk management, control, and governance processes concerning cybersecurity and our information security framework.


text: We have a cybersecurity Incident Response Plan (IRP) that sets forth a process designed to effectively respond to an incident by obtaining information, coordinating activities, assessing results, and communicating applicable developments to our stakeholders, including employees, law enforcement, other external parties and agencies, and our Board. The IRP includes the following major components: preparation, detection and analysis, containment, eradication, notification, recovery, reporting, and lessons learned. Specific technical and legal playbooks have also been developed for data breaches, malware, unauthorized remote access, and ransomware. We have also retained certain third-party experts to assist us with various aspects of incident assessment and response in the event those services become necessary or useful.


text: Typically, we (i) perform periodic tabletop exercises with a company-wide cross-functional team that are facilitated by a third-party expert and are intended to simulate a real-life security incident, (ii) conduct penetration testing as needed and annually conduct Payment Card Industry Data Security Standard testing and firewall reviews, and have periodically engaged a third-party expert to help therewith, (iii) hold annual cybersecurity awareness trainings, and (iv) periodically engage a third-party expert to conduct a review of our information security framework, which is designed to help identify existing and emerging risks, and mitigate against such risks. These internal efforts and external third-party reviews also support our efforts to regularly assess our information security program and framework against emerging risks, market and industry developments and provide opportunities to make adjustments or enhancements when deemed prudent or necessary. In 2024, we established a company-wide cross-functional team to preliminarily assess the risks and opportunities from conventional and generative AI and will continue these assessments in 2025. To date, there have been no cybersecurity incidents that have materially affected us, or that are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations.


text: Our information services team is led by our Vice President-Information Services and Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology industry and/or cybersecurity areas. On a monthly basis, our Vice President-Information Services and Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred. If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.


text: The Board and Audit Committee are responsible for overseeing IT and OT risks from cybersecurity threats. The Board recognizes the importance of maintaining the trust and confidence of our customers, employees, and stockholders and the need to protect information stored on our and our vendors' systems, including personal and proprietary data.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our Senior Vice President of Corporate Services & Chief Risk Officer (SVP & CRO), who reports directly to our Chairman, President & CEO leads a team that is responsible for managing our enterprise-wide information security strategy, policy, standards, architecture, and processes, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our SVP & CRO holds a Master's Degree in Business Administration and a Bachelor's Degree in Management Information Systems, has over 25 years of information and operational technology experience, is a certified Project Management Professional, and is a Certified Information Security Manager from the Information Systems Audit and Control Association. He served for one year as the President of the Bay Area InfraGard chapter and four years on its Board. InfraGard is a collaboration between the Federal Bureau of Investigation (FBI) and members of the private sector that promotes the protection of U.S. critical infrastructure and enables the exchange of important information. Our Director of IT Security and Chief Information Security Officer (CISO), who reports to the SVP & CRO, has over 25 years of information technology and 15 years of cybersecurity experience and holds a Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium.


text: The Board and Audit Committee receive regular reports from management no less than quarterly, and on an ad hoc basis, on information and operational technology risks, including cybersecurity and data security risks, as well as on the status of projects to strengthen our information security systems, assessments of our security program, and the emerging threat landscape.


text: The SVP & CRO receives reports on cybersecurity threats from the CISO who regularly reviews threat intelligence from various sources including the FBI and Department of Homeland Security (DHS). The SVP & CRO, in conjunction with management, also regularly reviews risk management measures implemented by us to identify and mitigate data security and cybersecurity risks. The significance of these threats is assessed by the SVP & CRO and his team and reported, as appropriate depending on the significance, to the Audit Committee.


text: Our cybersecurity risk management approach is informed in part by multiple standards and regulations for cybersecurity and data privacy, including the following: • National Institute of Standards and Technology (NIST) Cybersecurity Framework • NIST 800-171 and Cybersecurity Maturity Model Certification (NIST 800-171 CMMC) • Payment Card Industry Data Security Standard • California Privacy Rights Act • Health Insurance Portability and Accountability Act • Defense Federal Acquisition Regulations Supplement (DFARS)


text: We regularly assess our adherence to these standards and maintain programs designed to support our compliance with these requirements. External firms audit our compliance with NIST 800-171 CMMC and DFARS every three years. In addition, our cybersecurity processes have been integrated into our overall enterprise risk management system and specific cybersecurity-focused disclosure controls and procedures have been developed. Management continues to support a variety of practices that are intended to align with recognized frameworks and reflect our approach to assess, identify, and manage material risks from cybersecurity threats: • Incident response: We have adopted a Cybersecurity Incident Response Plan (IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel and third-party contractors, vendors, and partners that perform functions or services that require access to secure our information, and to all devices and network services that are owned or managed by the Company. • Regular testing: We engage a third-party cybersecurity firm to conduct an annual network penetration test on our corporate and supervisory control and data acquisition networks. The annual penetration test enables us to assess our existing security controls to identify weaknesses and eliminate vulnerabilities to defend against cybersecurity threats proactively. Our Information Technology team also conducts rehearsals of our IRP to test and enhance our ability to respond to cybersecurity incidents. • Monitoring for risks: We engage a third party cybersecurity firm to manage our Security Operations Center (SOC) who is responsible for monitoring our network traffic 24/7. Our SOC helps to identify and respond to cybersecurity issues in real time by assessing the level of threats and making recommendations on appropriate actions. • Security controls: We incorporate physical- and software-based preventive, detective, and corrective security controls to prevent or detect unauthorized activities and proactively alert us should an unauthorized activity occur within the organization. Early detection can enable the security team to quickly contain and eradicate the unauthorized activity to reduce the time exposure window and the impact of the incident. Our Security Incident Event Management tool monitors security logs, includes detective controls, and helps to identify irregular activities. • Detection and preventative technology: We have implemented multiple technologies designed to help protect our systems from cybersecurity threats, including an intrusion prevention system, next-generation antivirus program, end point protection system, and a data loss prevention security tool. • Regular improvements: We regularly work to enhance our systems and integrate new information and technology to upgrade our systems. We review and approve software and hardware acquisitions to enhance our ability to detect and manage cybersecurity threats. We also engage the FBI, DHS, and Fusion Center for incident response support and collaborate to share critical information.


text: Management also shares knowledge to protect our infrastructure and learn from recent developments. In addition to InfraGard, our SVP & CRO is a member of The Northern California Regional Intelligence Center, which is part of the California State Threat Assessment System supporting public safety as an intelligence and information sharing nexus in Northern California. Our CISO also actively participates on the Safety and Security Committee of the National Association of Water Companies to collaborate with members of our industry and learn best practices.


text: Our employees represent the foundation of cybersecurity protection and are a key line of defense, and we seek to strengthen their ability to target risks by proactively training active employees and contractors each year. We update our online security awareness training annually to review key policies and practices for security. To engage our workforce and inform employees of applicable security topics, we provide a monthly internal cybersecurity newsletter. Our monthly campaign on mock phishing emails is designed to serve as a reminder to employees to refrain from clicking on fraudulent emails disguised as safe content. We also assign enhanced cybersecurity training to employees who have access to potentially sensitive governmental information.


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely on our information technology (IT) and a number of complex business systems to assist with the management of our business and customer and supplier relationships, and a disruption of these systems, including from cyber-attacks, could adversely affect our business."


text: The Board and Audit Committee are responsible for overseeing IT and OT risks from cybersecurity threats. The Board recognizes the importance of maintaining the trust and confidence of our customers, employees, regulators, and stockholders and the need to protect information stored on our and our vendors' systems, including personal and proprietary data.


text: Our Senior Vice President of Corporate Services & Chief Risk Officer ( SVP & CRO), who reports directly to our Chairman, President & CEO leads a team that is responsible for managing our enterprise-wide information security strategy, policy, standards, architecture, and processes, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The team is also responsible for overseeing any third-party firms used as part of our information security strategy. Our SVP & CRO holds a Master's Degree in Business Administration and a Bachelor's Degree in Management Information Systems, has over 25 years of information and operational technology experience, is a certified Project Management Professional, and is a Certified Information Security Manager from the Information Systems Audit and Control Association. He served for one year as the President of the Bay Area InfraGard chapter and four years on its Board. InfraGard is a collaboration between the Federal Bureau of Investigation (FBI) and members of the private sector that promotes the protection of U.S. critical infrastructure and enables the exchange of important information. Our Director of IT Security and Chief Information Security Officer (CISO), who reports to the SVP & CRO, has over 25 years of information technology and 15 years of cybersecurity experience and holds a Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium.


text: The Board and Audit Committee receive regular but no less than quarterly reports from management, and on an ad hoc basis, on information and operational technology risks, including cybersecurity and data security risks, as well as on the status of projects to strengthen our information security systems, assessments of our security program, and the emerging threat landscape.


text: We regularly assess our adherence to these standards and maintain programs designed to support our compliance with these requirements. External firms audit our compliance with NIST 800-171 CMMC and DFARS every three years. In addition, our cybersecurity processes have been integrated into our overall enterprise risk management system and specific cybersecurity-focused disclosure controls and procedures have been developed. Management continues to support a variety of practices that are intended to align with recognized frameworks and reflect our approach to assess, identify, and manage material risks from cybersecurity threats: • Incident response: We have adopted a Cybersecurity Incident Response Plan (IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel and third-party contractors, vendors, and partners that perform functions or services that require access to secure information, and to all devices and network services that are owned or managed by the Company. • Regular testing: We engage a third-party cybersecurity firm to conduct an annual network penetration test on our corporate and supervisory control and data acquisition networks. The annual penetration test enables us to assess our existing security controls to identify weaknesses and eliminate vulnerabilities to defend against cybersecurity threats proactively. Our IT team also conducts rehearsals of our IRP to test and enhance our ability to respond to cybersecurity incidents. • Monitoring for risks: We engage a third-party cybersecurity firm to manage our Security Operations Center (SOC), which is responsible for monitoring our network traffic 24/7. Our SOC helps to identify and respond to cybersecurity issues in real time by assessing the level of threats and making recommendations on appropriate actions. • Security controls: We incorporate physical- and software-based preventive, detective, and corrective security controls to prevent or detect unauthorized activities and proactively alert us should an unauthorized activity occur within the organization. Early detection can enable the security team to quickly contain and eradicate the unauthorized activity to reduce the time exposure window and the impact of the incident. Our Security Incident Event Management tool monitors security logs, includes detective controls, and helps to identify irregular activities. • Detection and preventative technology: We have implemented multiple technologies designed to help protect our systems from cybersecurity threats, including an intrusion prevention system, next-generation antivirus program, end point protection system, and a data loss prevention security tool. • Regular improvements: We regularly work to enhance our systems and integrate new information and technology to upgrade our systems. We review and approve software and hardware acquisitions to enhance our ability to detect and manage cybersecurity threats. We also engage the FBI, DHS, and fusion centers for incident response support and collaborate to share critical information.


text: Our employees represent the foundation of cybersecurity protection and are a key line of defense, and we seek to strengthen their ability to target risks by proactively training active employees and contractors each year. We update our online security awareness training annually to review key policies and practices for security. To engage our workforce and inform employees of applicable security topics, we provide a monthly internal cybersecurity newsletter. Our monthly campaign on mock phishing emails is designed to serve as a reminder to employees to refrain from clicking on fraudulent emails disguised as safe content. We also assign enhanced cybersecurity training to employees who have access to potentially sensitive government information.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely on our information technology (IT), operational technology (OT), and a number of complex business systems to assist with the management of our business and customer and supplier relationships, and a disruption of these systems, including from cyber-attacks, could adversely affect our business."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. In 2022, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our IT management team, internal security staff, or external experts as part of the Board's continuing education. Six members of our Board of Directors have information security expertise, including Joseph C. Beery, Gary S. Guthart, Ph. D., Amal M. Johnson, Sreelakshmi Kolli, Keith R. Leonard, Jr., and Mark J. Rubash.