text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.

companyName: CRISPR Therapeutics AG

ticker: CRSP

secItem: Item 1C


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity.


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.


text: As is the case for similar companies of our size and industry, we may be the target of cyber attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: We engage certain external parties, including cybersecurity and privacy firms, to enhance our cybersecurity oversight and risk reduction abilities. We also perform an annual cybersecurity assessment designed to help align our cybersecurity program with industry best practices. In addition, we regularly consult with industry groups, peer organizations, and external executives to assess the cybersecurity threat landscape throughout the year.


text: Our cybersecurity policies, standards, and procedures include cyber and data breach response plans benchmarked against multiple cybersecurity risk frameworks. Our incident response plan is designed to help coordinate the response to and recovery from cybersecurity incidents and includes processes to identify, investigate, triage, assess the severity of, escalate, contain, and remediate incidents and comply with applicable legal or regulatory obligations. We also regularly perform technical reviews of our systems to help secure our digital environment and confirm software patches are appropriately up-to-date.


text: To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have implemented a third-party risk management program designed to help protect against information misuse and assess the information technology security measures of potential third parties and business partners. We perform a third-party risk assessment before starting a relationship with certain service providers and utilize a third-party risk intelligence program to monitor the activity of critical vendors following engagement. In addition, we maintain cyber insurance coverage as part of our overall risk mitigation strategy. This cyber insurance coverage may not be sufficient to cover against all claims.


text: We do not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.


text: We also have a cybersecurity steering committee responsible for assisting with our overall day-to-day cybersecurity responsibilities and implementing our cybersecurity programs. The cybersecurity steering committee is currently comprised of members of our digital and enterprise capabilities team and is chaired by our executive director of cybersecurity. Among other things, the cybersecurity steering committee: • reviews our internal controls to help protect our information assets; • assists with developing practices, procedures, and controls designed to identify, assess, and manage critical cybersecurity programs and risks; and • works to align our risk governance structure, including policies and procedures, with our business objectives.


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience, including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.


text: In addition, to help prevent and detect cybersecurity threats, we provide all employees, including part-time and temporary employees, with monthly cybersecurity and privacy training, which covers timely and relevant cybersecurity topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security.


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors, and individuals. In addition, the advancement of AI has given rise to additional vulnerabilities and potential entry points for cyberattacks. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure, and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Our enterprise risk management program, which includes cybersecurity risks that are identified through our cybersecurity risk management program, is designed to identify, report, and manage relevant material risks and opportunities.


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our CSO and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.


text: We have a cybersecurity risk management program that is managed by a team of full-time cybersecurity professionals that utilizes a variety of tools and techniques to identify and assess material cybersecurity threats, their potential impact and opportunities for mitigation. The industry-standard security frameworks that we apply to our cyber environment include various security and risk assessments, such as internal threat assessments and internal control self-assessments. Because we are aware of the risks associated with third-party providers, we conduct third-party provider security assessments and benchmarking before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. These assessments include evaluation of risk profiles through vendor questionnaires, review of System and Organization Controls attestation reports and monitoring on an ongoing basis by our IT risk management team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance, and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.


text: We also have a cybersecurity incident response plan and procedures to manage cybersecurity incidents. These procedures include steps to identify, classify, communicate, contain, eradicate, and recover from a cybersecurity incident. These procedures also include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors.


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect, and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 34 years of experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.


text: Through oversight of the cybersecurity risk management program, our CSO is continually informed about the status of the program, including the effectiveness of the process and controls to monitor, prevent, detect, mitigate, and remediate cybersecurity incidents. The CSO is also made aware of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO, in his capacity, regularly informs the Chief Information Officer and other members of our senior management team of all aspects related to cybersecurity risks and incidents.


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board of directors performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for assisting the board of directors in reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board of directors, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: Our cybersecurity policies, standards, processes and practices are informed by industry-recognized standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.


text: Cyber Risk Management and Strategy Under the board of directors'and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. Our internal audit team evaluates the results of these risk assessments to determine critical areas for audit as part of our annual internal audit plan. The results of the internal audits are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data are in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and monitor high-risk vendors on an ongoing basis, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.


text: We employ a formal process to identify, track, prioritize and remediate cybersecurity incidents that may impact the confidentiality, integrity and availability of data stored and processed on our information systems. This process addresses event detection, triage and classification, investigation and escalation, containment and mitigation, recovery and corrective actions. We maintain a written incident response plan that establishes roles, responsibilities and procedures to guide incident response operations.


text: Our security and legal teams actively participate in industry and other advisory groups and monitor regulatory requirements to keep apprised of evolving risks. Policies and procedures, including our Written Information Security Policy, are periodically updated to adapt to evolving business conditions and information technology requirements.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Our board of directors has final oversight responsibility over cybersecurity-related matters. The full board of directors participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, internal audits, technological trends and information security considerations arising with respect to our peers and third parties.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board of directors.


text: As appropriate, the board of directors also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.


text: Our risk management program for cybersecurity is led by the HubSpot Security & Privacy Committee, which we refer to as the Committee. The Committee oversees our information and technology risk management, compliance, and control functions, and serves as a forum for the discussion of issues involving information security and risk management.


text: The Committee's members include senior members of management who are responsible for and collectively have experience in information security, information technology, data protection, risk management and compliance. This collaboration helps us incorporate cyber risk management across all of our significant risk management programs.


text: The Committee is chaired by the CISO, who works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. The CISO attends regular meetings with representatives from the legal, ERM and security teams to review newly identified cybersecurity risks and re-review previously identified risks. The Committee then determines how identified risks should be treated. The results of these risk review processes are included in periodic presentations to our executive leadership team and the audit committee.


text: Our CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 12 years.


text: In the ordinary course of our business, we collect and store sensitive data, including IP, proprietary business information of ours and that of our suppliers and licensees, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our licensees and third-party providers also possess certain of our sensitive data. The secure maintenance of such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, designed to identify, assess, help mitigate, and monitor IT risks across our organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party IT risk management, audit management, incident response and security awareness, including employee awareness trainings and other initiatives. Our ISMS includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks and related mitigations identified, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS and our broader information security program.


text: As part of our information security program, we also have processes in place for management of cybersecurity risks associated with third-party handling of our confidential information, including in such third parties' provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and ongoing monitoring of such third parties, utilizing tools such as security ratings services and periodic reassessment questionnaires.


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.


text: Our information security team is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. This team works cross-functionally throughout our organization to assess and prepare the Company for identification and mitigation of, and if necessary respond to, information security risks. The information security team is led by our Chief Information Officer, who has over 35 years of experience in various information technology roles, including 18 years at the Company serving in roles with increasing levels of responsibility. Our Vice President of Information Security and Technology, a Certified Information Systems Security Professional, with over 20 years of global experience in various information security roles, including 14 years of experience at the Company, is responsible for day-to-day management of information security team initiatives. The other members of the information security team have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to IT and cybersecurity and mitigations put in place, or to be put in place, in response to such risks and opportunities. The audit and risk committee periodically reports to the full board of directors regarding its oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our CIO and Vice President of Information Security on our ISMS and other information security initiatives, and on our information security governance framework.


text: Cybersecurity risk management is an integral part of our enterprise risk management program. Our cybersecurity program is designed to align with industry best practices and provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers.

companyName: American Well Corp

ticker: AMWL


text: Our Board has overall oversight responsibility for our risk management and is briefed periodically on cybersecurity risk management and any material cybersecurity incidents by our Chief Information Officer, or CIO, and General Counsel. The Board is responsible for ensuring that management has processes in place designed to (i) identify and evaluate cybersecurity risks to which the company is exposed and (ii) manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 15 years of technology leadership experience.


text: Amwell's cybersecurity team has implemented processes to: • assess the severity of a cybersecurity threat through continuous monitoring and determine the nature, scope and timing of the event to assess whether it is material; • identify the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, utilizing our Information Security Incident Response Plan; • implement cybersecurity countermeasures and mitigation strategies; • and inform our board of directors of material cybersecurity threats and incidents.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.


text: The Company relies on our internal Technology Solutions team and third-party vendors to deliver effective and efficient services to our customers, process claims, and report information accurately and promptly to carriers. This often requires the secure handling of confidential, sensitive, proprietary, and other types of information. We actively monitor the risks associated with potential cybersecurity breaches of any of these systems. Therefore, we have made investments, and will continue to invest, in technology security initiatives, information technology policies, resources, and teammate training to mitigate the risk of unauthorized access to sensitive or personally identifiable information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full board of directors. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief security officer on the Company's latest information security risks and mitigation strategies.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.


text: The Company's chief security officer is responsible for developing and implementing our information security program. Our chief security officer has more than 35 years of experience in technology, operations, information risk and security. Our chief security officer has deep experience developing comprehensive information security programs for large and complex organizations. He also brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.


text: Our information security team deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: Internal persistent scans and external monthly scans;


text: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.


text: Additionally, external partners and products undergo a comprehensive security risk assessment process using our security scorecard tool, which evaluates data security risks and vulnerability maturity. Our teammates participate in an annual online security and compliance training program that includes testing. They are also subject to security awareness communications and random simulated phishing campaigns. Moreover, teammates are required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on their location. In 2024, nearly all Brown & Brown teammates completed ethical conduct training, cybersecurity awareness training, the California Consumer Privacy Act (CCPA) Survey, and the Annual Certification for Insurance Licensees training, which serves as a reminder of the regulatory obligation to report certain changes to the jurisdictions where they are licensed.


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our security operations center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions team for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the board of directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.


text: The Company maintains information systems which contain personal data, financial reports and proprietary data. As a result, we are exposed to cybersecurity threats which could result in loss of or damage to our intellectual property, proprietary information, client data and reputation, or interruption of our business operations, or additional costs to prevent, respond to, or mitigate cyber-attacks.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: Our Board of Directors is responsible for oversight of the risks that the Company faces, including cybersecurity threats. Our operating divisions and management teams help identify risks that are relevant to the Company during our periodic business planning and review cycle and rank these risks in relation to the achievement of business objectives. We understand cybersecurity threats to be dynamic and to intersect with various other enterprise risks within the organization. We have therefore integrated cybersecurity risk into our overall risk management program.


text: As a result, in addition to our information technology policies and procedures, we have implemented cybersecurity processes that aim to address, among other things, information security, password security, third party vetting, security incident response and vulnerability management. Our cybersecurity procedures include requiring multiple authentication factors prior to granting access to our assets, launching endpoint security software to guard against malware, viruses, and other cyber-attacks, use of third-party software to automate IT system monitoring for unusual or suspicious activity, conducting annual cybersecurity training for all employees, and providing cybersecurity information to employees through newsletters and fliers. We utilize third-party consultants to assist us with endpoint detection and response and routinely conduct penetration testing of our network infrastructure. Our consultants also provide digital forensics analysis of our systems, as needed. Additionally, we have sought to align our cybersecurity risk management in accordance with the National Institute of Standards and Technology Cybersecurity Framework.


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.


text: We have established a permanent management position of Director of Cybersecurity and IT Governance that reports directly to the Chief Financial Officer. Our current Director of Cybersecurity and IT Governance, has an undergraduate degree in computer science and is a Certified Information Systems Security Professional. He possesses over 20 years of IT experience with more than 10 years in managerial positions and has been actively involved in IT security related projects, initiatives, audits and associated program management in the last seven years. As part of our cybersecurity incident response plan, we have established a dedicated incident response team to assess and manage risks arising from cybersecurity threats, consisting of our Director of Cybersecurity and IT Governance and various members of senior management, including our Chief Financial Officer and General Counsel.


text: The Company also maintains an IT Steering Committee as part of its control environment, which meets regularly to address matters pertaining to the Company's information technology systems. The IT Steering Committee is led by the Company's three IT directors, one of which is the Director of Cybersecurity and IT Governance, and is represented by leaders from corporate departments and operations. In each meeting, the Director of Cybersecurity and IT Governance provides an overview of cybersecurity matters, including status update on threat reduction initiatives undertaken by the Company and future initiatives under consideration.


text: The Audit Committee is responsible for overseeing our cybersecurity threat risks and receives updates during its quarterly meetings from our Director of Cybersecurity and IT Governance. At each meeting, the Audit Committee is briefed on matters pertaining to our exposure to material privacy and cybersecurity risks, as well as risks that are deemed to have a moderate or higher business impact, even if immaterial. The Director of Cybersecurity and IT Governance also routinely briefs senior management on such matters as they arise.


text: In addition, we have established a Data Privacy Committee coordinated by our Data Privacy Officer and represented by seven other committee members from various corporate functional departments. The objective of the Committee is to ensure that personal data is protected and handled in accordance with applicable law and Core Lab policies.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident or cybersecurity threat that has materially affected, or is reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we understand that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include: • Risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, key third-party partners, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for key third-party vendors and suppliers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are subject to cybersecurity risks to operational systems, security systems, or infrastructure owned by Allison or third-party vendors or suppliers" in Part I, Item 1A. of this Annual Report on Form 10-K.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Officer ("CIO") and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for implementing our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team, led by our CISO, is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal cybersecurity team members and external consultants, threat intelligence and other information obtained from public or private sources, and alerts and reports produced by security tools deployed in our information technology environment. Our CISO has over 25 years and our CIO has over 10 years of experience in designing and implementing corporate information technology security systems and strategies. In addition, our CISO leads the operational cybersecurity team, which has an average of over 10 years of experience. Collectively, the members of the operational cybersecurity team have various certifications, including, but not limited to, CISSP, GSOM, GCIA, GCIH, CISA, CCSK, SSCP, GPEN, CEH, and CISM.


text: We understand the importance of identifying, assessing, and managing risks related to cybersecurity threats and data protection. We acknowledge the potential adverse effects of cybersecurity incidents on our business. As part of our enterprise risk management program, cybersecurity risks are evaluated alongside other company risks within the broader risk assessment process. Our data security plan incorporates a specialized cybersecurity risk assessment process, which helps us identify potential risks by benchmarking our procedures against National Institute of Standards and Technology (NIST) standards and engaging third-party experts to test the security of our information systems. Key aspects of our risk management program include: • Monitoring Regulatory Changes: We monitor emerging data protection laws and, if necessary, implement changes to our policies and employee training processes. • Cybersecurity Policy Reviews: We regularly review and update (when applicable) our policies and procedures related to cybersecurity. • Security Tools and Response Exercises: We use various tools, such as network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to assist in risk identification and assessment. We then use these findings (where applicable) to enhance our processes and technologies. • Employee Training: We conduct annual cybersecurity awareness training for all employees with computer access, as well as specific training for those who handle sensitive data or are involved in cybersecurity management. • Expert Collaboration: We work with third-party subject matter experts to assess cybersecurity threats, their severity, and potential mitigation strategies. • Safeguard Third-Party Data: Through policy, practice, and contracts (as applicable), we require employees, as well as third parties providing services on our behalf, to treat customer information and data with care. • Use of Third-Party Service Providers: As cybersecurity considerations affect the selection and oversight of our third-party service providers, we also conduct pre-engagement assessments for third-party providers based on the sensitivity of the data they handle, and annually review SOC 1 or 2 reports for certain outsourced service providers whose systems are utilized in processing company or employee data. • Phishing Simulations: Regular phishing simulations help employees recognize and respond to potential email threats, with additional training provided, as necessary • NIST Framework: We leverage the NIST incident handling framework to guide our responses to actual or potential cybersecurity incidents, covering identification, protection, detection, response, and recovery.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Cybersecurity Incident Response Process Our incident response plan outlines the steps we take to prepare for, detect, respond to, and recover from cybersecurity incidents. This process includes assessing severity, escalating, containing, investigating, and remediating incidents, while ensuring compliance with applicable legal obligations and protecting our brand reputation. As part of this process, we regularly engage with third-party assessors and consultants to review and improve our cybersecurity program, focusing on compliance and areas for improvement. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity specific risk identification program, both of which are discussed above.


text: Oversight of Cybersecurity Risk Our cybersecurity risk management strategy is led by the Information Technology Director (IT Director) and the Director of Information Security (IS Director). Our IS Director has over eleven years of experience managing information security, developing cybersecurity strategy and implementing relevant and effective cybersecurity programs. Together, our IT Director and IS Director hold numerous credentials, including a Bachelor of Science in Cybersecurity & Information Assurance. Both have extensive experience in cybersecurity management with credentials including CISSP, CCSP, GIAC, GCFA, GCIH, and others.


text: The IT Director reports directly to the Chief Financial Officer, ensuring timely notification of significant cybersecurity incidents to the senior management team. The management team and the enterprise risk committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The enterprise risk committee, which includes the Chief Financial Officer, IT Director as well as other members of senior management, review cybersecurity risk management as a component of our overall enterprise risk management.


text: The audit committee of the board of directors is responsible for the oversight of the company's enterprise risk management program. The audit committee's oversight includes reviewing and discussing with management (at least annually) management's report on assessment of risk exposure and risk management, the processes in place to identify and manage significant risks, steps taken by management to control or mitigate such exposures, and management's report on cybersecurity risk management, which includes strategies to mitigate data protection and cybersecurity risks. Additionally, the IT Director reports at least annually to the audit committee on cybersecurity threat risks, and our Chief Executive Officer reports regularly to the chair of our board of directors, and the full board of directors, as appropriate, about emerging threats to our operations, both at scheduled board meetings and through communications between board meetings. Pursuant to the company's incident response plan, if a significant cybersecurity incident occurs that may have a material effect on the company's business or its financial statements, management will discuss the incident and management's mitigation and remediation plan for such incident with the audit committee. As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial results, or long-term financial condition. For more information on cybersecurity risks, see the risk factor entitled "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" in Part I – Item 1. Business, Item 1A. Risk Factors contained in this report.


text: We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Executive Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including a biennial maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; • policies to establish requirements for protecting information assets and defining acceptable behaviors to ensure compliance, mitigate risks, prevent unauthorized access, and foster a culture of security awareness and accountability, thereby enhancing the organization's overall security posture; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or cash flows.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Executive Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.


text: Our management team, including our Global Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, law enforcement, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Operating Officer and Chief Information Officer, Chief Risk Officer, General Counsel, Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S. in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Directors is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Directors at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.


text: We have an enterprise-wide information security program designed to protect our information systems from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our digital assets and our risk profile using various methods. We monitor security events that are internally discovered or externally reported that may affect our systems and have processes and procedures to assess those events for potential cybersecurity impact or risk and consequently improve our security measures and planning. Additionally, we work with third parties from time to time that assist us in refining our cybersecurity risk strategy in order to identify, assess and manage cybersecurity risks, including professional services firms and consulting firms. We seek to detect and investigate unauthorized attempts and attacks against our network and services, and to minimize their occurrence and recurrence through changes or updates to our internal processes and tools and changes or updates to our services; however, we remain potentially vulnerable to known or unknown threats.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from information technology ("IT"), operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.


text: We also have a third-party risk management program in place to manage cybersecurity risks associated with third-party service providers. While we do maintain processes and procedures to identify, prioritize and assess risks associated with third-party service providers, we must rely on third parties to augment our security program, and we cannot ensure in all circumstances that their efforts will be successful.


text: While to date we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Any significant disruption to our systems could adversely affect our business and results of operations. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A, Risk Factors, for a discussion of cybersecurity risks.


text: Our Information Technology Security Team, under the oversight of our Senior Vice President and Chief Technology Officer and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President and Chief Technology Officer and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.


text: The Audit Committee of our Board of Trustees oversees our annual enterprise risk management assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee oversees our ongoing cybersecurity risk management efforts and regularly receives detailed reports from representatives of our Information Technology Security Team addressing a wide range of related topics. At least annually, our IT leadership (and external cybersecurity experts if applicable) reviews key cybersecurity strategies and policies with the full Board of Trustees, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends and other areas of importance.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan. This plan was developed with support from our Audit Committee and in consultation with key stakeholders across our organization to ensure it accurately reflects their respective roles and responsibilities. The plan has been selectively disseminated throughout our organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We design and assess our program based on industry standards to align closely with information security frameworks and guidelines. This does not imply that we meet or are in compliance with any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect our information and data and alert us to potential information security breaches. The third party engaged by us to oversee and host our network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.


text: We previously engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and worked with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means.


text: While we have not experienced any cybersecurity incidents to date, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity incidents in the future. For additional information, see "Item 1A. Risk Factors—Risks Related to Our Business and Operations—We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business" in this Annual Report on Form 10-K.


text: Our Board of Directors actively considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risk to the Audit Committee. The Audit Committee is instrumental in overseeing the implementation of our cybersecurity risk management program by management.


text: The Audit Committee receives detailed quarterly reports from management about our cybersecurity risks, and management provides timely updates to the Audit Committee about any significant cybersecurity incidents, as well as those with lesser impact potential if deemed appropriate to do so.


text: The Audit Committee informs the full Board of Directors about its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies.


text: Our management team, including our Chief Financial Officer, and members of the Audit Committee play a pivotal role in assessing and managing material risks stemming from cybersecurity threats. The management team is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants.


text: Efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents are supervised by our management team. These efforts include briefings from internal security personnel, leveraging threat intelligence and information from governmental, public, and private sources, engagement with external consultants, and utilizing alerts and reports generated by our security tools within the IT environment.


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security and provide technical oversight. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: 1. Context establishment - Established in accordance with the requirements of International Organization for Standardization 27001 and 27002 ("ISO 27001" and "ISO 27002"). The ISO 27001, Information security management systems, provides a framework and guidelines for establishing, implementing and managing an ISMS and ISO 27002, Information security controls, provides a reference set of generic information security controls including implementation guidance.


text: 2. Risk Assessment - Relates to an evaluation and identification of risks, threats and vulnerabilities that exist or could exist, identifies the likelihood of occurrence and potential consequences. As part of the risk assessment management prioritizes the assessed risks from low to high based on likelihood and level of impact.


text: 3. Risk Treatment – will detail the remediation process for risks, vulnerabilities and threats identified to reduce the risk to an acceptable level.


text: 4. Risk Acceptance- The Company's risk assessment is evaluated from a Low (1) to a High (3) on the Impact the threat would have on the Company and its operations and the likelihood of occurrence. Threat ratings created from the Impact and probability calculations will result with a value from 1- 9.


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate levels of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.


text: 6. Risk Monitoring and Review - Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the Form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.


text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board of Directors (through the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and vendors based on their criticality and risk profile.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We may be vulnerable to security breaches or cyber-attacks which could disrupt our operations and have a material adverse effect on our financial performance and operating results."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Accounting Officer.


text: Our management team, including our Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over ten years of overseeing IT risk management and compliance, day-to-day IT operations, and coordinating with external IT security experts. Our Chief Accounting Officer also works in tandem with an external cybersecurity consultant that has experience in cybersecurity assessment, response, and mitigation.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management's plans for monitoring and testing compliance with data security regulations.


text: The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.


text: We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.


text: We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization's cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.


text: We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: The Company's Board of Directors (the Board) is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has information security and risk management policies and procedures designed to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of incidents in a timely manner. • Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. Additionally, the Company leverages an industry standard Endpoint Detection and Response (EDR) tool to manage and monitor endpoint security for laptops and servers including scanning and monitoring of vulnerabilities. Further, the Company has mandated multi-factor authentication for all employees in addition to periodic security and phishing training and awareness.


text: In 2023, the Company engaged an independent assessor to assess the maturity of its cybersecurity program against the NIST Cybersecurity Framework (NIST CSF). The results of the NIST CSF maturity assessment laid the roadmap for the cyber initiatives conducted in 2023 and future. Further, a third-party conducted an external and internal penetration test, performed a dark web scan for any Aptevo private and confidential data and assessed Aptevo's cloud security configuration posture. All critical and high-risk findings from that assessment were addressed in 2023.


text: • Incident Response and Recovery Planning: The Company has established and maintains security incident response and disaster recovery plans designed to address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.